Error event ID 6398 and 6482 – about security rights of OSearch service

I have huge number of following erros in the event log “Application folder”:

Event ID 6398
The Execute method of job definition Microsoft.Office.Server.Search.Administration.IndexingScheduleJobDefinition (ID b94e8106-b5f9-4c2d-ad98-2871bcc4c669) threw an exception. More information is included below.
Retrieving the COM class factory for component with CLSID {3D42CCB1-4665-4620-92A3-478F47389230} failed due to the following error: 80070005.

And this:

Event ID 6482
Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance (7d8b475a-6dda-47e8-8ab7-dbd171926b39).
Reason: Retrieving the COM class factory for component with CLSID {3D42CCB1-4665-4620-92A3-478F47389230} failed due to the following error: 8007000e.

Actually in “System” folder there are 2 events revealing more information about it. It turned out that I need to grant the account that is used by “Office SharePoint Server Search” with Local Activation rights.

Open Component Services->DCOM Config->OSearch->Properties->Security, I added Network Service (may not need) and the account to run “Office SharePoint Server Search” service and gave them “Local Activation” rights (in “Launch and Activation Permissions” group). Those error messages do not appear anymore.

This doesn’t limit to this service and SharePoint only. You can actually search on registry on that CLSID and it might be different DCOM object. For example the other day I got same error with CLSID
{61738644-F196-11D0-9953-00C04FD919C1} and it turned out to IIS WAMREG admin Service.

This entry was posted in Search, Security. Bookmark the permalink.

14 Responses to Error event ID 6398 and 6482 – about security rights of OSearch service

  1. minjaeapa says:

    That was exactly the fix. After doing it, there is an informational message stating that the search service starts correctly.

    Do you have any information about why it starts? i did not notice these error messages until after i patched the site with Web Services 3.0 SP1/Sharepoint 2007 SP1

  2. calvin998 says:

    This actually remains as a puzzle for me. My search did work before I fixed it. I guess you just didn’t check your event log until after you put the SP1 patch.

  3. Johnny says:

    Thanks, this was the fix I was looking for. For me this started after I rebooted the server after having installed kb946517. Installed the kb to get rid of event id 6482, 6398 and 7076. Got those errors after I installed SP1. Had an error free log before that.

  4. Rich R says:

    Thanks. This fix worked for me too. The error started after I installed SP1. It helped to check the System event log to see the ID that did not have correct permissions.

  5. Samandus says:

    Excelent posting!

    This was spot on, and the server is no longer flooding the event log. 🙂

  6. Paul says:

    This worked for me (this site helped to) only I haven’t installed SP1 – all I installed was a hotfix designed to work around ‘case-specific’ unix boxes as crawled content.

    I have multiple ssp search accounts and a ‘master search’ account — should all or only master search be added here? I’d like to adhere to ‘least-permissions’ but I feel like throwing the kitchen sink at this to avoid future bombs.

  7. decatec says:

    Thanks that helped me a lot in getting my Sharepoint farm in sharepe

  8. Tomasz says:

    I have a similar problem with COM Object {BA126AD1-2166-11D1-B1D0-00805FC1270E} failed due to the error 80070422. There is a registry entry for it under CLSID saying it’s supposed to be called “Windows SharePoint Services Search Gathering Manager”, but there is no such thing in Component Services->DCOM Config 😦

  9. Micke says:

    Tomasz, I think that one is called spsearch in Component Services.

  10. Rajeev says:

    Wonderful. This fixed my issue and no more error logs.

  11. This worked out perfectly.

  12. Wave_Ripper says:

    This alleviated my pain to get search server express running.

    my probs were:
    windows sharepoint services 3.0 search server express 2008

    my solutions were resolved and complicated with:

    I had to edit the properties of the ssp and reset them with the appropriate credentials.

    I had to add my service account as a site collection administrator due to some installation snafus from MSFT.

    I then stopped my windows sharepoint search services, went to the shared services web site. setup my content sources and crawled.

  13. Pingback: Issues after restoring MOSS to a previous VM snapshot | The MOSS Blog

  14. Rajesh says:

    Microsoft’s hotfix had worked for me!!

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s