SharePoint Search and VSS Warnings
Unnecessary warnings in your event logs are annoying and one of the biggest culprits is the SharePoint Search service. The latest one I have come across is actually reported as a VSS warning and takes the form of VSS EventID 8230
“Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key.”
Although Microsoft list this as a benign message which can be safely ignored in KB 2483007, it would be nice to stop it from appearing in the event log.
Investigating the registry key in the warning message takes you to HKLMSystemCurrentControlSetServicesVSSVSSAccessControl where Microsoft’s documentation states that the accounts entered here are granted permission to use the VSS writer. Reading the event log warning carefully, I noticed that the error stated that the VSS service was unable to find the security group spsearch rather than the user account spsearch. Taking this as a possible error in the documentation, I removed the registry entries for spfarm and spsearch and added a newly created Security Group VSS Writer as a member of Backup Operators with the two removed accounts as members with the hope that the VSS warning is looking for a group rather than a user account. Happily, this resolved the issue for the above error for account spsearch.
For the sake of completeness, I should point out that five days later I had thirteen occurrences of the above Event warning specifying account spfarm instead of spsearch (but only on one day between 1300h-1339h), so the above fix doesn’t appear to have the same effect for spfarm.