farhanfaiz’s Weblog – SharePoint / MOSS

We have changed the password of the account used to run some services of MOSS server. After some time, Event ID 6641 started to appear after approximately 5 minutes in the event viewer. 

Event Type:        Error

Event Source:     Office SharePoint Server

Event Category:  Office Server Shared Services

Event ID:   6641

Date:        XXXXXX

Time:        XXXXXX

User:         N/A

Computer:  XXXXXX

Description:

The SSP Timer Job Distribution List Import Job was not run. 

Reason: Logon failure: unknown user name or bad password 

Technical Support Details:

System.ComponentModel.Win32Exception: Logon failure: unknown user name or bad password

   at Microsoft.Office.Server.Utilities.WindowsSecurity.GetUserTokenFromCredentials(String userDomainName, String password, LogonType logonType)

   at Microsoft.Office.Server.Utilities.WindowsSecurity.GetUserTokenFromCredentials(String userDomainName, String password)

   at Microsoft.Office.Server.Administration.JobHandler.Execute(Object state, Boolean timedOut) 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. 

Resolution: 

Run following two commands using STSADM: 

stsadm -o updatefarmcredentials  [-identitytype] <configurableid/NetworkService>

[-userlogin] <domain\user name> [-password] <password> [-local] 

stsadm -o updateaccountpassword -userlogin <domain\name> -password <password> [-noadmin]

MOSS server machine Event Viewer getting flooded by following two events after every minute.

Event Type:        Error

Event Source:     Office SharePoint Server

Event Category:  Office Server Shared Services

Event ID:   6482

Date:        XXXXXXXX

Time:        XXXXXXXX

User:         N/A

Computer:  Server Name

Description:

Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchAdminSharedWebServiceInstance (a30c0eb5-8dac-4654-be59-5c9f950ed3b4).

Reason: The specified account name is invalid.

Parameter name: account

Techinal Support Details:

System.ArgumentException: The specified account name is invalid.

Parameter name: account —> System.Security.Principal.IdentityNotMappedException: Some or all identity references could not be translated.

   at System.Security.Principal.NTAccount.Translate(IdentityReferenceCollection sourceAccounts, Type targetType, Boolean forceSuccess)

   at System.Security.Principal.NTAccount.Translate(Type targetType)

   at Microsoft.Office.Server.Utilities.WindowsSecurity.ValidateAccount(NTAccount account, Boolean throwIfInvalid)

   — End of inner exception stack trace —

   at Microsoft.Office.Server.Utilities.WindowsSecurity.ValidateAccount(NTAccount account, Boolean throwIfInvalid)

   at Microsoft.Office.Server.Administration.SharedAccessRule.Validate()

   at Microsoft.Office.Server.Administration.SharedComponentSecurity.SetAccessRule(SharedAccessRule accessRule)

   at Microsoft.Office.Server.Administration.SharedResourceProvider.GetApplicationSecurity()

   at Microsoft.Office.Server.Administration.SharedWebServiceInstance.ProvisionSharedResourceProviderWebConfigSettings(SharedResourceProvider srp)

   at Microsoft.Office.Server.Administration.SharedWebServiceInstance.Synchronize()

   at Microsoft.Office.Server.Administration.ApplicationServerJob.ProvisionLocalSharedServiceInstances(Boolean isAdministrationServiceJob)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:        Error

Event Source:     Office SharePoint Server

Event Category:  Office Server Shared Services

Event ID:   6481

Date:        XXXXXXXX

Time:        XXXXXXXX

User:         N/A

Computer:  Server Name

Description:

Application Server job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance (d245dafa-360e-4267-993d-501d04d03025).

Reason: No mapping between account names and security IDs was done. (Exception from HRESULT: 0×80070534)

Techinal Support Details:

System.Runtime.InteropServices.COMException (0×80070534): No mapping between account names and security IDs was done. (Exception from HRESULT: 0×80070534)

   at Microsoft.Office.Server.Search.Administration.MSSITLB.IGatherApplication2.SetUsersPermittedToQuery(String[] psaAccountNames, Int32 fForce)

   at Microsoft.Office.Server.Search.Administration.SearchApi.SetUsersPermittedToQuery(String[] userNames, Boolean force)

   at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.Synchronize()

   at Microsoft.Office.Server.Administration.ApplicationServerJob.ProvisionLocalSharedServiceInstances(Boolean isAdministrationServiceJob)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Resolution:

First stops following two services one by one:

Windows SharePoint Services Administration and

Windows SharePoint Services Timer. If stopping “Windows SharePoint Services Administration” results in ending Event: 6482 and stopping “Windows SharePoint Services Timer” results in ending Event: 6481, kindly try looking / resetting services account in Central Administration.

• SharePoint Central Administration -> Operations ->Service accounts (Security Configuration).
• Select “Web application pool” rradio button and then select “Windows SharePoint Services Web Application”.
• Select appropriate application pool like “Sharepoint – 80” and select “Configurable” radio button.  Enter desired user name and password and hit “OK”. (Do not forget to note existing settings just in case).
• Restart IIS (type iisreset –noforce using command prompt).