Forum Discussion

trooper's avatar
trooper
Level 3
16 years ago

Event 4216 following upgrade

I have recently upgraded EV from v6 sp4 to v7sp5 and then to v2007 sp5 and although all archiving etc seems to be happening as expected I am receiving the following warning messages in the event logs a few times overnight


Event Type: Warning
Event Source: Enterprise Vault
Event Category: Task Controller Service
Event ID: 4216
Description:
Access denied. User is not in a role that allows 'Can manage Enterprise Vault Exchange Mailbox tasks'.
User: 'NT AUTHORITY\SYSTEM'

Event Type: Warning
Event Source: Enterprise Vault
Event Category: Task Controller Service
Event ID: 4216
Description:
Access denied. User is not in a role that allows 'Can manage Enterprise Vault Exchange Public Folder tasks'.
User: 'NT AUTHORITY\SYSTEM'

should be worried and what can i do to stop them?
or is it a case of adding SYSTEM to the Exchange Administrator role assignment?

thanks in advance




Enterprise Vault
Information Governance
Upgrade
  • Paul_Grimshaw's avatar
    Paul_Grimshaw
    16 years ago
    So we can see the problem in the following line:-

    CSecurityWrapper::IsServerClientTheVSA - hr=0 InClientCOMCall:T VSA:F

    So we are seeing this as VSA=False as again the user is 'NT AUTHORITY\SYSTEM'

    What is performing this task restart as I see it is happening at 04:37am. Is this being restarted by a backup post script?
  • Paul_Grimshaw's avatar
    Paul_Grimshaw
    Level 6
    16 years ago
    Have a look on your task controller service and ensure that the logo On As is the vault service account and not local System
  • trooper's avatar
    trooper
    Level 3
    16 years ago
    Hi,

    The task controller service and the individual tasks for mailbox archiving and public folder all have the vault service account as the log on as user
  • Paul_Grimshaw's avatar
    Paul_Grimshaw
    Level 6
    16 years ago
    Hmmm This strain of error has been reported previously and written about here:-
    http://support.veritas.com/docs/287299
    http://support.veritas.com/docs/297512

    But as you can see these are not the same as the tasks that your errors are referring to

    Just wondering why it is mentioning 'NT AUTHORITY\SYSTEM'

    Can you check on the Mailbox Task and Public Folder tasks and ensure that the VSA is configured on the Logon Tab there as well
    If not then setup a DTRACE of the task controller service restart it, repro the warnings and post the log
  • Paul_Grimshaw's avatar
    Paul_Grimshaw
    Level 6
    16 years ago

    Also try a VSA Reset by going to the properties of teh directory and then the service account tab. Re-enter the password
    If that does not fix it then do the following:-
    1. Run DCOMCNFG
    2. Expand Component Services
    3. Expand Computers
    4. Expand My Computer
    5. Expand DCOM Config
    6. Find Enterprise Vault Task Controller Service
    7. Right click - Properties
    8. Identity Tab
    9. Is this user selected and the VSA listed. If not then make it so and restart TCS,

  • trooper's avatar
    trooper
    Level 3
    16 years ago
    hi
    this is the dtrace log from last night showing the error (at 4:37:02 in the event log)

    19086 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
    19087 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Exit) |Success [0] |
    19088 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
    19089 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Exit) |Success [0] |
    19090 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
    19091 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Exit) |Success [0] |
    19092 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
    19093 04:37:01.667 [2992] (TaskController) <620> EV:L CRetrievalTask::RetrievalWorkToDo (Entry) |
    19094 04:37:01.667 [2992] (TaskController) <620> EV:L CRetrievalTask::RetrievalWorkToDo (Exit) |The time specified for MQReceiveMessage to wait for the message elapsed. [0xc00e001b] |
    19095 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Exit) |Success [0] |
    19096 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
    19097 04:37:01.667 [2992] (TaskController) <620> EV:L CRetrievalTask::RetrievalWorkToDo (Entry) |
    19098 04:37:01.667 [2992] (TaskController) <620> EV:L CRetrievalTask::RetrievalWorkToDo (Exit) |The time specified for MQReceiveMessage to wait for the message elapsed. [0xc00e001b] |
    19099 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Exit) |Success [0] |
    19100 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::HasServerClientGotPermission, Admin Operation: 48
    19101 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::IsServerClientTheVSA
    19102 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::IsServerClientTheVSA - hr=0 InClientCOMCall:T VSA:F
    19103 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::CommonRoleAccessCheck
    19104 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::UpdateAzStoreCacheIfNecessary
    19105 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::CommonRoleAccessCheck : Access denied
    19106 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::HasServerClientGotPermission: Role: Denied, Operation: 48
    19107 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::GetOperationNameFromID
    19108 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::CheckPermissions: Role: Denied, Operation: Can manage Enterprise Vault Exchange Mailbox tasks
    19109 04:37:02.682 [2992] (TaskController) <5556> EV~W Event ID: 4216 Access denied. User is not in a role that allows 'Can manage Enterprise Vault Exchange Mailbox tasks'.|User: 'NT AUTHORITY\SYSTEM'| |
    19110 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::HasServerClientGotPermission, Admin Operation: 49
    19111 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::IsServerClientTheVSA
    19112 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::IsServerClientTheVSA - hr=0 InClientCOMCall:T VSA:F
    19113 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::CommonRoleAccessCheck
    19114 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::UpdateAzStoreCacheIfNecessary
    19115 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::CommonRoleAccessCheck : Access denied
    19116 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::HasServerClientGotPermission: Role: Denied, Operation: 49
    19117 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::GetOperationNameFromID
    19118 04:37:02.854 [2992] (TaskController) <2472> EV:M CSecurityWrapper::CheckPermissions: Role: Denied, Operation: Can manage Enterprise Vault Exchange Public Folder tasks
    19119 04:37:02.854 [2992] (TaskController) <2472> EV~W Event ID: 4216 Access denied. User is not in a role that allows 'Can manage Enterprise Vault Exchange Public Folder tasks'.|User: 'NT AUTHORITY\SYSTEM'| |
    19120 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::ProcessTaskList (Entry) |
    19121 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::CheckAgentClientBroker (Entry) |
    19122 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::CheckAgentClientBroker (Exit) |Success [0] |
    19123 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::CheckForRestartAllMAPITasks (Entry) |
    19124 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::CheckForRestartAllMAPITasks (Exit) |Success [0] |
    19125 04:37:03.667 [2992] (TaskController) <620> EV:M CTask::ProcessTask - Task State [Stopped] [1514E8561F49FD643A1B82186C549A0F41012000EVAULT]
    19126 04:37:03.667 [2992] (TaskController) <620> EV:M CTask::ProcessTask - Task State [Stopped] [1598B66A777D442DCB33CE126B5121D361012u00EVAULT]
    19127 04:37:03.667 [2992] (TaskController) <620> EV:M CTask::ProcessTask - Task State [Stopped] [181DB5F05EE31A242A4D1D09A875FC1511012000EVAULT]
    19128 04:37:03.667 [2992] (TaskController) <620> EV:M CTask::ProcessTask - Task Is Running [185035AACA6DAF7489A03C4E59A1B3E4D1011z00EVAULT]
    19129 04:37:03.667 [2992] (TaskController) <620> EV:M CTask::ProcessTask - Task Is Running [1CFCD27DB2C0B4B4EA6354C87AA56B9721012100EVAULT]
    19130 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::ProcessTaskList (Exit) |Success [0] |
    19131 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
  • trooper's avatar
    trooper
    Level 3
    16 years ago
    I'll be resetting the VSA password tonight and re-run the trace - I wanted to do this step by step
    Also the VSA account is set for DCOMCNFG in Pauls suggestion
    I'll post the new dtrace info tomorrow morning
  • Paul_Grimshaw's avatar
    Paul_Grimshaw
    Level 6
    16 years ago
    So we can see the problem in the following line:-

    CSecurityWrapper::IsServerClientTheVSA - hr=0 InClientCOMCall:T VSA:F

    So we are seeing this as VSA=False as again the user is 'NT AUTHORITY\SYSTEM'

    What is performing this task restart as I see it is happening at 04:37am. Is this being restarted by a backup post script?
  • trooper's avatar
    trooper
    Level 3
    16 years ago
    ok
    yes this is being restarted by a post backup command from the CA BrightStor agent on the box, that runs as System, stops the services, puts the server back into normal write mode and then starts the services as below....


    EVService stop EVServer "Mailbox Archiving Task for Exchange server"
    EVService stop EVServer "Public Folder Task for Exchange server"
    EVService stop EVServer "Enterprise Vault Storage Service"
    c:\scripts\backup\sleep 45
    EVService stop EVServer "Enterprise Vault Indexing Service"
    c:\scripts\backup\sleep 45
    EVService stop EVServer "Enterprise Vault Shopping Service"
    c:\scripts\backup\sleep 45
    REM *** Enter normal mode ***
    regedit /s c:\scripts\backup\normal.reg
    c:\scripts\backup\sleep 10
    REM specify the actual computer when starting a service
    EVService start EVServer "Enterprise Vault Storage Service"
    c:\scripts\backup\sleep 45
    EVService start EVServer "Enterprise Vault Indexing Service"
    c:\scripts\backup\sleep 45
    EVService start EVServer "Enterprise Vault Shopping Service"
    c:\scripts\backup\sleep 45