SBS 2011 Event 8230 Volume Shadow Copy Service error: Failed resolving account spfarm with status 1376 every hour

Question

_{Monday, December 12, 2016 10:31 PM}

I've been trying to knock down the number of errors appearing in my event log and I thought this was was taken care of.

Volume Shadow Copy Service error: Failed resolving account spfarm with status 1376. Check connection to domain controller and VssAccessControl registry key. I already applied the VSSREGISTRYGROUP registry modifications see "workaround" below. After that and a reboot the error stopped but I just noticed today it returned strangely enough at 1pm. Four errors per hour, but one hour had 5 errors and another hour only had one error. First the error below, then the workaround that I had applied below that.

Any idea what's going on here?

Operation:

Gathering Writer Data
Executing Asynchronous Operation

Context:
Execution Context: Requestor
Current State: GatherWriterMetadata

Error-specific details:
Error: NetLocalGroupGetMemebers(spfarm), 0x80070560, The specified local group does not exist.

You can use the following steps to workaround the issue.

In Active Directory Users and Computers, create a Domain Local Security Group named VSSRegistryGroup
Add SPFARM and SPSEARCH accounts to the VSSRegistryGroup Group
Run regedit

Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

Go to hklm\system\currentcontrolset\services\vss\vssaccesscontrol
Add Dword value of DOMAIN\vssregistrygroup where domain is the netbios domainname (example: CONTOSO\vssregistrygroup Note: The Domain name must be in all caps) set the value to 1
Remove values for domain\spsearch and domain\spfarm
Go to hklm\system\currentcontrolset\services\vss\diag
Right click on diag and go permissions, click advanced and add VSSRegistrygroup group with Full Control.

9. Remove spsearch and spfarm accounts from the list of permissions

Reboot the server

All replies (4)

_{Tuesday, December 13, 2016 12:39 AM}

Well I think I know why the error started again. I went back into hklm\system\currentcontrolset\services\vss and I found the spfarm entry once again in the registry.

Following the instructions from the "workaround" it says in step 6 to "Remove values for domain\spsearch and domain\spfarm" I took that to mean to remove the spsearch and spfarm entries all together, which I did. But the spfarm entry re-appeared with a value of 1 which is why I believe the error is now once again happening.

So. Should I set the "value" to 0 or leave the value blank? So I tried to leave it blank and it sets it to 0 which is how I have left it for the time being. I re-added the spsearch entry leaving it at 0 as well.

Thanks,

Roveer

update

The errors continue right at the top of every hour. This time i got an error for spfarm and spsearch (both entries I put back into the registry and set to 0). So it appears the only way to supress the errors is to remove the registry entries for both. The continuing problem, what keeps putting the spfarm entry back into the registry and starting the errors again? It was a few days before it returned.

_{Wednesday, December 14, 2016 3:53 AM}

Hi Roveer,

Looks like the issue was commonly existed. Check the below similar threads.

SBS 2011 VSS Errors- Spfarm keeps recreating

https://social.technet.microsoft.com/Forums/en-US/6dbeb8bf-6185-4271-adaf-ffd2eadf3709/sbs-2011-vss-errors-spfarm-keeps-recreating?forum=smallbusinessserver

SBS 2011 VSS Errors- Deleted SPFarm Registry Key is Re-Created

https://social.technet.microsoft.com/Forums/en-US/c0e2d17a-4f1d-4c65-9326-0283360e710f/sbs-2011-vss-errors-deleted-spfarm-registry-key-is-recreated?forum=smallbusinessserver

Best Regards,

Alvin Wang

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Thursday, December 15, 2016 10:35 AM}

One of those "safe to ignore" things: https://support.microsoft.com/en-us/kb/2483007

Simon

Simon Weel

_{Monday, December 26, 2016 3:36 AM}

Hi,

Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.