cancel
Showing results for 
Search instead for 
Did you mean: 

Event 4216 following upgrade

trooper
Level 3
I have recently upgraded EV from v6 sp4 to v7sp5 and then to v2007 sp5 and although all archiving etc seems to be happening as expected I am receiving the following warning messages in the event logs a few times overnight


Event Type: Warning
Event Source: Enterprise Vault
Event Category: Task Controller Service
Event ID: 4216
Description:
Access denied. User is not in a role that allows 'Can manage Enterprise Vault Exchange Mailbox tasks'.
User: 'NT AUTHORITY\SYSTEM'

Event Type: Warning
Event Source: Enterprise Vault
Event Category: Task Controller Service
Event ID: 4216
Description:
Access denied. User is not in a role that allows 'Can manage Enterprise Vault Exchange Public Folder tasks'.
User: 'NT AUTHORITY\SYSTEM'

should be worried and what can i do to stop them?
or is it a case of adding SYSTEM to the Exchange Administrator role assignment?

thanks in advance




1 ACCEPTED SOLUTION

Accepted Solutions

Paul_Grimshaw
Level 6
Employee Accredited Certified
So we can see the problem in the following line:-

CSecurityWrapper::IsServerClientTheVSA - hr=0 InClientCOMCall:T VSA:F

So we are seeing this as VSA=False as again the user is 'NT AUTHORITY\SYSTEM'

What is performing this task restart as I see it is happening at 04:37am. Is this being restarted by a backup post script?

View solution in original post

11 REPLIES 11

Paul_Grimshaw
Level 6
Employee Accredited Certified
Have a look on your task controller service and ensure that the logo On As is the vault service account and not local System

trooper
Level 3
Hi,

The task controller service and the individual tasks for mailbox archiving and public folder all have the vault service account as the log on as user

Paul_Grimshaw
Level 6
Employee Accredited Certified
Hmmm This strain of error has been reported previously and written about here:-
http://support.veritas.com/docs/287299
http://support.veritas.com/docs/297512

But as you can see these are not the same as the tasks that your errors are referring to

Just wondering why it is mentioning 'NT AUTHORITY\SYSTEM'

Can you check on the Mailbox Task and Public Folder tasks and ensure that the VSA is configured on the Logon Tab there as well
If not then setup a DTRACE of the task controller service restart it, repro the warnings and post the log

Paul_Grimshaw
Level 6
Employee Accredited Certified

Also try a VSA Reset by going to the properties of teh directory and then the service account tab. Re-enter the password
If that does not fix it then do the following:-
1. Run DCOMCNFG
2. Expand Component Services
3. Expand Computers
4. Expand My Computer
5. Expand DCOM Config
6. Find Enterprise Vault Task Controller Service
7. Right click - Properties
8. Identity Tab
9. Is this user selected and the VSA listed. If not then make it so and restart TCS,

trooper
Level 3
hi
this is the dtrace log from last night showing the error (at 4:37:02 in the event log)

19086 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
19087 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Exit) |Success [0] |
19088 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
19089 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Exit) |Success [0] |
19090 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
19091 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Exit) |Success [0] |
19092 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
19093 04:37:01.667 [2992] (TaskController) <620> EV:L CRetrievalTask::RetrievalWorkToDo (Entry) |
19094 04:37:01.667 [2992] (TaskController) <620> EV:L CRetrievalTask::RetrievalWorkToDo (Exit) |The time specified for MQReceiveMessage to wait for the message elapsed. [0xc00e001b] |
19095 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Exit) |Success [0] |
19096 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |
19097 04:37:01.667 [2992] (TaskController) <620> EV:L CRetrievalTask::RetrievalWorkToDo (Entry) |
19098 04:37:01.667 [2992] (TaskController) <620> EV:L CRetrievalTask::RetrievalWorkToDo (Exit) |The time specified for MQReceiveMessage to wait for the message elapsed. [0xc00e001b] |
19099 04:37:01.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Exit) |Success [0] |
19100 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::HasServerClientGotPermission, Admin Operation: 48
19101 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::IsServerClientTheVSA
19102 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::IsServerClientTheVSA - hr=0 InClientCOMCall:T VSA:F
19103 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::CommonRoleAccessCheck
19104 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::UpdateAzStoreCacheIfNecessary
19105 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::CommonRoleAccessCheck : Access denied
19106 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::HasServerClientGotPermission: Role: Denied, Operation: 48
19107 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::GetOperationNameFromID
19108 04:37:02.667 [2992] (TaskController) <5556> EV:M CSecurityWrapper::CheckPermissions: Role: Denied, Operation: Can manage Enterprise Vault Exchange Mailbox tasks
19109 04:37:02.682 [2992] (TaskController) <5556> EV~W Event ID: 4216 Access denied. User is not in a role that allows 'Can manage Enterprise Vault Exchange Mailbox tasks'.|User: 'NT AUTHORITY\SYSTEM'| |
19110 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::HasServerClientGotPermission, Admin Operation: 49
19111 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::IsServerClientTheVSA
19112 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::IsServerClientTheVSA - hr=0 InClientCOMCall:T VSA:F
19113 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::CommonRoleAccessCheck
19114 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::UpdateAzStoreCacheIfNecessary
19115 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::CommonRoleAccessCheck : Access denied
19116 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::HasServerClientGotPermission: Role: Denied, Operation: 49
19117 04:37:02.839 [2992] (TaskController) <2472> EV:M CSecurityWrapper::GetOperationNameFromID
19118 04:37:02.854 [2992] (TaskController) <2472> EV:M CSecurityWrapper::CheckPermissions: Role: Denied, Operation: Can manage Enterprise Vault Exchange Public Folder tasks
19119 04:37:02.854 [2992] (TaskController) <2472> EV~W Event ID: 4216 Access denied. User is not in a role that allows 'Can manage Enterprise Vault Exchange Public Folder tasks'.|User: 'NT AUTHORITY\SYSTEM'| |
19120 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::ProcessTaskList (Entry) |
19121 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::CheckAgentClientBroker (Entry) |
19122 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::CheckAgentClientBroker (Exit) |Success [0] |
19123 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::CheckForRestartAllMAPITasks (Entry) |
19124 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::CheckForRestartAllMAPITasks (Exit) |Success [0] |
19125 04:37:03.667 [2992] (TaskController) <620> EV:M CTask::ProcessTask - Task State [Stopped] [1514E8561F49FD643A1B82186C549A0F41012000EVAULT]
19126 04:37:03.667 [2992] (TaskController) <620> EV:M CTask::ProcessTask - Task State [Stopped] [1598B66A777D442DCB33CE126B5121D361012u00EVAULT]
19127 04:37:03.667 [2992] (TaskController) <620> EV:M CTask::ProcessTask - Task State [Stopped] [181DB5F05EE31A242A4D1D09A875FC1511012000EVAULT]
19128 04:37:03.667 [2992] (TaskController) <620> EV:M CTask::ProcessTask - Task Is Running [185035AACA6DAF7489A03C4E59A1B3E4D1011z00EVAULT]
19129 04:37:03.667 [2992] (TaskController) <620> EV:M CTask::ProcessTask - Task Is Running [1CFCD27DB2C0B4B4EA6354C87AA56B9721012100EVAULT]
19130 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::ProcessTaskList (Exit) |Success [0] |
19131 04:37:03.667 [2992] (TaskController) <620> EV:L CTaskControl::SynchRetrievalTask (Entry) |

TonySterling
Moderator
Moderator
Partner    VIP    Accredited Certified
have you reset the VSA password yet?

trooper
Level 3
I'll be resetting the VSA password tonight and re-run the trace - I wanted to do this step by step
Also the VSA account is set for DCOMCNFG in Pauls suggestion
I'll post the new dtrace info tomorrow morning

Paul_Grimshaw
Level 6
Employee Accredited Certified
So we can see the problem in the following line:-

CSecurityWrapper::IsServerClientTheVSA - hr=0 InClientCOMCall:T VSA:F

So we are seeing this as VSA=False as again the user is 'NT AUTHORITY\SYSTEM'

What is performing this task restart as I see it is happening at 04:37am. Is this being restarted by a backup post script?

trooper
Level 3
ok
yes this is being restarted by a post backup command from the CA BrightStor agent on the box, that runs as System, stops the services, puts the server back into normal write mode and then starts the services as below....


EVService stop EVServer "Mailbox Archiving Task for Exchange server"
EVService stop EVServer "Public Folder Task for Exchange server"
EVService stop EVServer "Enterprise Vault Storage Service"
c:\scripts\backup\sleep 45
EVService stop EVServer "Enterprise Vault Indexing Service"
c:\scripts\backup\sleep 45
EVService stop EVServer "Enterprise Vault Shopping Service"
c:\scripts\backup\sleep 45
REM *** Enter normal mode ***
regedit /s c:\scripts\backup\normal.reg
c:\scripts\backup\sleep 10
REM specify the actual computer when starting a service
EVService start EVServer "Enterprise Vault Storage Service"
c:\scripts\backup\sleep 45
EVService start EVServer "Enterprise Vault Indexing Service"
c:\scripts\backup\sleep 45
EVService start EVServer "Enterprise Vault Shopping Service"
c:\scripts\backup\sleep 45


Paul_Grimshaw
Level 6
Employee Accredited Certified
ok cool so run that job as VSA as you should be OK

trooper
Level 3
excellent
ran the backup job and therefore the pre and post jobs as VSA and all works

many thanks