You May Get VSS Warnings in the Application Event Log of SBS 2011 Standard

Applies to: Windows Small Business Server 2011 Standard


On Small Business Server 2011 Standard, you may see warnings in the application event log similar to the following:

Log Name:      Application
Source:        VSS
Date:          4/11/2011 9:48:48 AM
Event ID:      8230
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      CONTOSOSERVER.contoso.local
Volume Shadow Copy Service error: Failed resolving account spsearch with status 1376. Check connection to domain controller and VssAccessControl registry key.

The warnings may also reference the spfarm account.


SBS 2011 Standard Edition installs Sharepoint 2010 Foundation in SharePoint farm mode. The accounts SPfarm and SPsearch are used as service accounts for some of the Sharepoint services. In order to be able to utilize the VSS writers, the accounts must be granted access to VSS. The accounts are added by SBS to the vssaccesscontrol registry key but the VSS service fails to locate the accounts. As Microsoft knowledge base article 2483007suggests you can ignore the warnings. The warnings don't affect the operation of VSS. If you wish to remove the warnings, you can use the steps in the resolution section. 


You can use the following steps to workaround the issue.

1. In Active Directory Users and Computers, create a Domain Local Security Group named VSSRegistryGroup

2. Add SPFARM and SPSEARCH accounts to the VSSRegistryGroup Group

3. Run regedit  

   Important This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows

4. Go to hklm\system\currentcontrolset\services\vss\vssaccesscontrol      

5. Add Dword value of DOMAIN\vssregistrygroup where domain is the netbios domainname (example: CONTOSO\vssregistrygroup Note: The Domain name must be in all caps) set the value to 1      

6. Remove values for domain\spsearch and domain\spfarm      

7. Go to hklm\system\currentcontrolset\services\vss\diag      

8. Right click on diag and go permissions, click advanced and add VSSRegistrygroup group with Full Control.

9.  Remove spsearch and spfarm accounts from the list of permissions

10. Reboot the server

More Information

If the VSSAccessControl registry key does not contain the exact right accounts, the service Sharepoint 2011 VSS Writer will fail to start and the following error will be logged in the application event log:

Log Name:      Application
Source:        VSS
Date:          4/11/2011 12:23:15 PM
Event ID:      8213
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      CONTOSOSERVER.contoso.local
Volume Shadow Copy Service error: The process that hosts the writer with name SharePoint Services Writer and ID {da452614-4858-5e53-a512-38aab25c61ad} does not run under a user with sufficient access rights. Consider running this process under a local account which is either Local System, Administrator, Network Service, or Local Service.

   Initializing Writer

   Writer Class Id: {da452614-4858-5e53-a512-38aab25c61ad}
   Writer Name: SharePoint Services Writer