I created a script that takes a system state backup and I schedule it to run once a week so that we have a local copy of System state if we ever need it. I’m not sure that we’ve ever actually needed it, but just call me captain safety pants. About a week ago the script just stopped working, the scheduled job was failing, but the logs were pretty much empty with the exception of this one warning that was getting logged each time the script was run:
Event ID: 8230
Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key.
Gather writers' status
Executing Asynchronous Operation
Current State: GatherWriterStatus
Error: NetLocalGroupGetMemebers(spsearch), 0x80070560, The specified local group does not exist.
I’m not sure what the spsearch user account has to do with taking a System State Backup, but it looks like that account is listed under the registry as having access to the VSS writers. The problem is it doesn’t have permissions to the writers, so when the writers start they error out saying this account does not have permissions even though they don’t need to run under this user’s context, and in fact are running under the admin user’s context (configured in the scheduled task’s job preferences).
Since this particular Server (SBS 2011) is not going to be used for sharepoint services I just removed the account from the list in the following registy entry:
Once that user was removed from that registry key I restarted the scheduled task and the script completed fine. I’m not sure if this account not being in this key will cause any problems but I suspect it wont because it does not have permissions to the VSS writers anyway, which is why the script started failing in the first place.
If anyone has any spare time and wants to explain the purpose of spsearch account being in the VssAccessControl key please feel free to leave a comment.