VSS Warnings in the Application Event Log of SBS 2011 Standard – Event ID 8230

Posted on by Mark Pace

Collapse imageSYMPTOMS

On Small Business Server 2011 Standard, you may see warnings in the application event log similar to the following:

Log Name:      Application
Source:        VSS
Date:          4/11/2011 9:48:48 AM
Event ID:      8230
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      CONTOSOSERVER.contoso.local
Description:
Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key.

The warnings may also reference the spfarm account.

Collapse imageCAUSE

SBS 2011 Standard Edition installs Sharepoint 2010 Foundation in SharePoint farm mode. The accounts SPfarm and SPsearch are used as service accounts for some of the Sharepoint services. In order to be able to utilize the VSS writers, the accounts must be granted access to VSS. The accounts are added by SBS to the vssaccesscontrol registry key but the VSS service fails to locate the accounts. As Microsoft knowledge base article 2483007 suggests you can ignore the warnings. The warnings don’t affect the operation of VSS. If you wish to remove the warnings, you can use the steps in the resolution section.

Collapse imageRESOLUTION

You can use the following steps to workaround the issue.

1. In Active Directory Users and Computers, create a Domain Local Security Group named VSSRegistryGroup

2. Add SPFARM and SPSEARCH accounts to the VSSRegistryGroup Group

3. Run regedit

Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

4. Go to hklm\system\currentcontrolset\services\vss\vssaccesscontrol

5. Add Dword value of DOMAIN\vssregistrygroup where domain is the netbios domainname (example: CONTOSO\vssregistrygroup Note: The Domain name must be in all caps) set the value to 1

6. Remove values for domain\spsearch and domain\spfarm

7. Go to hklm\system\currentcontrolset\services\vss\diag

8. Right click on diag and go permissions, click advanced and add VSSRegistrygroup group with Full Control.

9.  Remove spsearch and spfarm accounts from the list of permissions

10. Reboot the server

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.