Eventid 6482 – Reason: Access to the path ‘C:\WINDOWS\system32\drivers\etc\HOSTS’ is denied.

If you get this error every other minute:
Event Type: Error
Event Source: Office SharePoint Server
Event Category: Office Server Shared Services
Event ID: 6482
Date:  2007-06-05
Time:  11:53:44
User:  N/A
Computer: XXXXXXXX
Description:
Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance (3eac0144-1ce6-4219-bba6-b402a50568ea).
Reason: Access to the path ‘C:\WINDOWS\system32\drivers\etc\HOSTS’ is denied.
Techinal Support Details:
System.UnauthorizedAccessException: Access to the path ‘C:\WINDOWS\system32\drivers\etc\HOSTS’ is denied.
   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
   at System.IO.FileInfo.Delete()
   at Microsoft.Search.Administration.Security.HOSTSFile.CleanupDedicatedGathering(Hashtable HOSTSFileMappings, StringBuilder HOSTSComments, IEnumerable obsoleteHosts, String dedicatedName, Boolean isDirty)
   at Microsoft.Search.Administration.Security.HOSTSFile.ConfigureDedicatedGathering(SearchServiceInstance searchServiceInstance, SPServer dedicatedWebFrontEndServer, IList`1 previousWebApplicationHostNames)
   at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.SynchronizeDefaultContentSource(IDictionary applications)
   at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.Synchronize()
   at Microsoft.Office.Server.Administration.ApplicationServerJob.ProvisionLocalSharedServiceInstances(Boolean isAdministrationServiceJob)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

You could start troubleshooting by enabling auditing for failure on the HOST-file, in my case it showed that my Server Farm Account (http://technet2.microsoft.com/Office/en-us/library/f07768d4-ca37-447a-a056-1a67d93ef5401033.mspx?mfr=true) failed to do something to the file.

 

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date:  2007-06-05
Time:  11:53:44
User:  XXXXXX\SPSFarmAAccount
Computer: XXXXXXX
Description:
Object Open:
  Object Server: Security
  Object Type: File
  Object Name: C:\WINDOWS\system32\drivers\etc\hosts
  Handle ID: -
  Operation ID: {0,398988958}
  Process ID: 616
  Image File Name: C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\12\BIN\OWSTIMER.EXE
  Primary User Name: SPSFarmAAccount
  Primary Domain: XXXXXX
  Primary Logon ID: (0x0,0x190A8)
  Client User Name: SPSFarmAAccount
  Client Domain: XXXXX
  Client Logon ID: (0x0,0x190A8)
  Accesses: DELETE
   
  Privileges: -
  Restricted Sid Count: 0
  Access Mask: 0x10000
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
According to the Technet article you don’t have to add any specific permission om the MOSS server.
But The account need to be able to add some entries to the host file for search purposes.
 
Update: Apparently COMPUTER\WSS_ADMINWPG is suppose to have Modify permissions on the HOSTS-file, which fixes this problem.

About these ads
This entry was posted in Sharepoint. Bookmark the permalink.

5 Responses to Eventid 6482 – Reason: Access to the path ‘C:\WINDOWS\system32\drivers\etc\HOSTS’ is denied.

  1. Angelo says:

    After researching this issue for several days, looking at every single blog and premier case in Microsft I followed adding WSS_ADMIN_WPG and modify permissions to the WSS_ADMIN_WPG as follows:

    List Folder / Read Data
    Read Attributes
    Read Extended Attributes
    Create Files / Write Data
    Create Folders / Append Data
    Write Attributes
    Write Extended Attributes
     Read Permissions
    iisreset everything, and restarted the search, and voila no more problem…
    What happens if you add modify permissions instead of advanced permissions is that the system will delete the host file and you get another funky error that looks like this:Event Type: ErrorEvent Source: Office SharePoint ServerEvent Category: Office Server Shared Services Event ID: 6482Date:  1/16/2008Time:  1:03:28 PMUser:  N/AComputer: YOURCOMPUTERNAMEDescription:Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance (d298755c-557b-49fc-8cda-c98f8617ae7a).
    Reason: Access to the path \’C:\\WINDOWS\\system32\\drivers\\etc\\HOSTS\’ is denied.
    Techinal Support Details:System.UnauthorizedAccessException: Access to the path \’C:\\WINDOWS\\system32\\drivers\\etc\\HOSTS\’ is denied.   at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)   at System.IO.FileInfo.Delete()   at Microsoft.Search.Administration.Security.HOSTSFile.CleanupDedicatedGathering(Hashtable HOSTSFileMappings, StringBuilder HOSTSComments, IEnumerable obsoleteHosts, String dedicatedName, Boolean isDirty)   at Microsoft.Search.Administration.Security.HOSTSFile.ConfigureDedicatedGathering(SearchServiceInstance searchServiceInstance, SPServer dedicatedWebFrontEndServer, IList`1 previousWebApplicationHostNames)   at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.SynchronizeDefaultContentSource(IDictionary applications)   at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.Synchronize()   at Microsoft.Office.Server.Administration.ApplicationServerJob.ProvisionLocalSharedServiceInstances(Boolean isAdministrationServiceJob)
    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

  2. Unknown says:

    Thanks for the helpful post. I am getting similar errors. A few questions:
     
    1) How or where do you enable auditing for failure on the HOST-file?
     
    2)You said that you added the account WW_ADMIN_WPG. Where did you add it, or under what group in the AD?
     
    Thanks,
    Stephan

  3. d says:

    FIX: In Sharepoint Central Administration, go to Operations->Services on Server -> Office SharePoint Server Search Service Settings, and scroll down to the "Web Front End And Crawling" section. Change to the "Use all web-front end computers for crawling" radio button INSTEAD of "Use a dedicated web front end computer for crawling" IF you match the description on the left on that screen: "your index server is also running the Excel Calculation service or other shared services, select no dedicated web front end for crawling. Otherwise, these services may not work as expected. ANother bizarre error seemingly unrelated to the event log message. Dan G.

  4. Jose Angel says:

    I only had to do what "Dan G" said about FIX: In Sharepoint Central Administration, go to Operations->Services on Server -> Office SharePoint Server Search Service Settings, and scroll down to the "Web Front End And Crawling" section. Change to the "Use all web-front end computers for crawling" radio button INSTEAD of "Use a dedicated web front end computer for crawling" IF you match the description on the left on that screen: "your index server is also running the Excel Calculation service or other shared services, select no dedicated web front end for crawling. Otherwise, these services may not work as expected. ANother bizarre error seemingly unrelated to the event log message. Thanks Dan.

  5. Shelly says:

    you\’ve been kicked …. Thanks for saving me tons of time!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s