Event ID : 6398 - WSS (IndexingScheduleJobDefinition - Access Denied)

It’s been three days I have been struggling with rectifying an insane error which keeps popping up in Windows Event Viewer under application category. I checked everything starting from permission settings on DCOM Component Services (OSearch) to recreating entire index and resetting all crawl rules and scopes, even creating new SSP. Steps as suggested in some Microsoft TechNet Posts are specified in my previous post, which did not help in full resolution of the issue. Following were the two errors which were giving me lot pain while setting up the environment. 

 Event ID 10016 and Event ID 6398

For resolution steps for Event 10016 click here.

Event ID 6398: Windows SharePoint Services 3    Error  Timer  6398   N/A   WIN2K3R2EE    "The Execute method of job definition Microsoft.Office.Server.Search.Administration.IndexingScheduleJobDefinition (ID b991a523-c9a3-402d-878c-31e7fa8b04b2) threw an exception. More information is included below.

Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

Root Cause Analysis:

Upon visiting following path: Central Administration > Operations > Timer Job Status I saw one of the job was failing each time. 

Indexing Schedule Manager on WIN2K3R2EE Failed 2/20/2009 6:00 PM  

Once Indexing Schedule Manager Timer Job was deactivated, alerts stopped coming. Upon reactivating, alerts appeared again. This seemed to be the culprit.

Next, I checked Central Administration > Operations > Services on Server > Windows SharePoint Services Search Service Settings where I found Service Account was running under predefined "Network Service".

Under service account comments it said: "The search service account must not be a built-in account in order to access the database. Examples of built-in accounts are Local Service and Network Service."

Final point to take note of it, error states it’s a Windows SharePoint Services 3 Timer Error. I went ahead WSS Timer Service at Start > Administrative Tools > Services

As one can see in the the above figure Windows SharePoint Service Timer is running as Network Service and error showed as "Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))"

Solution:

Following are the steps which helped me in resolving this issue.

1) Create new user account "X" (ensure accounts X have admin level privledges)

2) Associate account "X" with

i)  Central Administration > Operations > Services on Server > Windows SharePoint Services Search Service

ii )Start > Administrative Tools > Services > Windows SharePoint Service Timer

This did the trick. Am not seeing any 6398 alerts any more.

Cheers