none
Event 6 on RTM SBS2011

    Question

  • I'm getting the error below every half-hour on an RTM and clean intall SBS2011 server.  The server is fully patched including the Update Rollup 2 for Exchange 2010.

    Cmdlet failed. Cmdlet Get-User, parameters {Identity=NT AUTHORITY\SYSTEM}

    In the details: Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException: The operation couldn't be performed because object 'NT AUTHORITY\SYSTEM' couldn't be found on 'SBS2011.contoso.local'

    Pete

    Monday, December 27, 2010 5:30 AM

Answers

  • Problem: The following error may be recorded in the MSExchange Management event log every 30 minutes

    Log Name:      MSExchange Management
    Source:        MSExchange CmdletLogs
    Date:          12/22/2010 8:00:13 AM
    Event ID:      6
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      CONTOSOSERVER.contoso.local
    Description:
    Cmdlet failed. Cmdlet Get-User, parameters {Identity=NT AUTHORITY\SYSTEM}.

    Cause: The error is generated by the Small Business Server datacollectorservice. When the datacollectorservice runs Exchange related tasks a check is performed to determine whether or not the current user is an Exchange admin and mail-enabled. The datacollectorservice runs under the context of the local system check so the check fails and the error is generated.

    Resolution: The error is benign and may be safely ignored.

     

    Turns out it's an "ignore this" issue

    Tuesday, December 28, 2010 2:29 AM

All replies

  • I'm assuming you haven't named your server contoso.local?
    Monday, December 27, 2010 9:54 PM
  • Of course not.  I just didn't want to disclose my client's domain name.

    Pete

    Monday, December 27, 2010 9:57 PM
  • :-)  Just wanted to make sure, as if it said exactly that, that would be interesting.

    I'm assuming this has no a/v installed at this time?  Which exact event log are you seeing this?

    Monday, December 27, 2010 10:13 PM
  • I do have Symantec Mail Security for Exchange 6.5.2.96 installed since it supports Exchange 2010 but no AV.

    Pete

    Monday, December 27, 2010 10:20 PM
  • Please run “Best Practices Analyzer” against SBS server from Toolbox for health and permission check

    Resources:

    Managing Tools in the Toolbox

    James Luo

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com  


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Tuesday, December 28, 2010 2:28 AM
  • Problem: The following error may be recorded in the MSExchange Management event log every 30 minutes

    Log Name:      MSExchange Management
    Source:        MSExchange CmdletLogs
    Date:          12/22/2010 8:00:13 AM
    Event ID:      6
    Task Category: General
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:      CONTOSOSERVER.contoso.local
    Description:
    Cmdlet failed. Cmdlet Get-User, parameters {Identity=NT AUTHORITY\SYSTEM}.

    Cause: The error is generated by the Small Business Server datacollectorservice. When the datacollectorservice runs Exchange related tasks a check is performed to determine whether or not the current user is an Exchange admin and mail-enabled. The datacollectorservice runs under the context of the local system check so the check fails and the error is generated.

    Resolution: The error is benign and may be safely ignored.

     

    Turns out it's an "ignore this" issue

    Tuesday, December 28, 2010 2:29 AM
  •  

    This is an issue that I am getting on a couple of the servers I have out there...

    I understand that it may not actually 'Hurt' anything,... but I build and support servers and networks for small business clients (being Small Business Server, this seems appropriate) and these people want to know what they are paying for. Sometimes, they actually look at the servers themselves - not often, but sometimes. More importantly, I don't like logging into a clients’ server and having to weed through the 'errors' to identify which ones 'are' and which 'are not' "benign".

    My biggest issue is that Microsoft seems to think this is an acceptable answer.

    Moreover, I find it sad that Microsoft has us all so 'trained' like little puppies to accept that as an answer that we actually actually take that and mark the issue as "Solved" - thus causing the rest of us to have to weed through this drivel while trying to find an 'actual solution' - again, so much so, that technet, and even Google searches get filled up with answers that basically say "Oh, don't worry about that..." that not only is it impossible to find real answers, but we basically stop 'looking for real answers'.

    I think it would be neat to join together and stop accepting these 'non-answers as answers'.

    If anyone actually finds a solution for this issue, I'd love to hear it.

    -Les

    Sunday, May 29, 2011 8:12 PM
  • We're trying, but that's the best I have at this time.

    https://connect.microsoft.com/SBS/feedback/details/666961/excessive-winrm-errors-need-a-fix-or-work-around

    If you have access to that bug, vote it up please.

    Monday, May 30, 2011 3:27 AM
  • I agree 100%. I don't mind so much the slew of errors that comes with a reboot, or the "standard" few from cleaning up WSUS, but it sure would be easier to monitor errors if the ones that are known to be spurious were suppressed. Especially the many-times-per-day not-really-errors.
    Monday, May 30, 2011 11:33 PM
  • Has anyone found a fix to this isue?  I continue to have this error every few seonds!

     

     

    Monday, August 08, 2011 5:17 PM
  • Usually, this error coming on, if you have changed mailbox (E-mail address) for existing user. Just make sure that, all users have first given email address in domain.
    Wednesday, November 30, 2011 5:08 AM
  • I just noticed that Exchange 2010 SP2 was just released. Has anyone tried this to see if it resolves all these "benign" errors?
    Tuesday, January 10, 2012 2:03 PM
  • It does not.
    Tuesday, January 10, 2012 2:58 PM
  • Good to know. Thanks Susan.
    Tuesday, January 10, 2012 3:33 PM
  • How can you safely ignore when the database won't mount and this is the only error you get?
    Sunday, May 20, 2012 1:46 PM
  • You have to be getting other failures. Can you start a new thread please as it will get lost in this one.
    Sunday, May 20, 2012 5:29 PM
  • http://support.microsoft.com/kb/2483007

    Use the following steps to grant the SPFARM account the local activation right.

      • Click Start, click Run, type dcomcnfg in the Open box, and then click OK
      • Expand Component Services, expand Computers, expand My Computer, and then click DCOM Config
      • Right-click IIS WAMREG admin Service, and then click Properties
      • Click the Security tab. 
      • Under Launch and Activation Permissions, click Edit
      • Click on the SharePoint Farm Account and check the box for Local Activation.
      • Click OK and close out of the Component Services Utility.

    I am attempting to try this and will let you know if it resolves it for me....

    Tuesday, September 25, 2012 7:49 PM
  • http://support.microsoft.com/kb/2483007

    Use the following steps to grant the SPFARM account the local activation right.

      • Click Start, click Run, type dcomcnfg in the Open box, and then click OK
      • Expand Component Services, expand Computers, expand My Computer, and then click DCOM Config
      • Right-click IIS WAMREG admin Service, and then click Properties
      • Click the Security tab. 
      • Under Launch and Activation Permissions, click Edit
      • Click on the SharePoint Farm Account and check the box for Local Activation.
      • Click OK and close out of the Component Services Utility.

    I am attempting to try this and will let you know if it resolves it for me....

    This would be a possible resolution for DCOM event ID 10016, I believe.. Not the issue being discussed in this thread.
    • Proposed as answer by tomiko094 Tuesday, October 22, 2013 3:49 AM
    Thursday, September 27, 2012 2:57 PM
  • I could not agree with you more, Les. It's only natural when you see 463 error 6's in a daily Details SBS Report that to go into panic mode.  Then you spend an age only to be effectively told by microsoft that, "We are just pulling your chain sunshine to see if you are awake!".

    I tried Susan Bradley's Vote link, but it comes up "Page not found" - and that's a Microsoft error page, not an Explorer one.

    George.


    George Bell (UK based)

    Sunday, April 14, 2013 3:57 PM
  • I know this is a bit old, but thought I would throw my two pence in. I was looking at this and thought can we change the 'datacollectionservice' (Windows SBS Manager I think) to run as to an account that has a mailbox? Would that then let the cmdlet get the response it wants and carry on error free?

    Tim

    • Proposed as answer by JOHNBANNON Wednesday, October 23, 2013 3:58 PM
    Friday, June 07, 2013 9:52 PM
  • I wonder if that would remove the error. Have you tested this? I don't think we should have to create our own service accounts in order to fix a benign error but if well documented it's better than nothing.
    Tuesday, October 08, 2013 12:16 PM
  • Just tried that, and set Windows SBS Manager Services to run as an account with a mailbox. Its to soon to confirm but it seems to be working, had nothing logged in the last hour.

    • Proposed as answer by JOHNBANNON Wednesday, October 23, 2013 3:59 PM
    Monday, October 14, 2013 10:05 AM
  • I'm 120% behind what Les says.  I'm find myself wasting a seriously, great deal of time ploughing through Google and various resources only to find that Microsoft say that an error can be safely ignored.

    It really is time that Microsoft addressed this kind of issue so that we can all see the proverbial wood from the trees.

    George


    George Bell (UK based)

    Tuesday, October 22, 2013 9:10 AM
  • Whilst this is an old post I cant tell you how bloody annoying that error has been amongst the other 'just put up and shut up' ones. I have googled for close to twelve months periodically to see if there was a solution to this and all I can say is thank god for JohnBannon's post. Maybe now my monitoring software might breath a little easier not having to worry about that event every 30 minutes !
    Saturday, November 02, 2013 12:11 AM
  • Yeah...thank god for JohnBannon's post. Started the "Windows SBS Manager"-service with domainadmin-account and taataa...no more errors in the last two hours. Before this action the error was logged every 30 minutes. Perhaps no ideal solution, but it works.

    Now i can safely ignore this error as recommended by MS !!! ;-)

     Grettings from Stuttgart, Germany

    Arno

    Monday, January 13, 2014 1:11 PM
  • John,

    Can you be more specific and give steps to "run as to an account that has a mailbox"?

    Tuesday, January 28, 2014 7:17 PM
  •  I am trying the same solution. Thanks for pointing to a possible solution. So far, it seems to be working. Thank God for Johnm Bannon's post.  side note - (There is only one God. Therefore you don't have to use the lower case g when referring to Him. The title "God" refers to Him and since He is the only God, it therefore is more fitting to use the capital G.) Thanks again, B.
    Wednesday, March 05, 2014 3:34 PM
  • Kristinte, Arno said that he changed the account that logs in when the Windows SBS Manager service is starting from, I imagine, the local System account, to the Domain Admin account. That account has a mailbox - or at least it should. In services, (Run - services.msc) right click on Windows SBS Manager, choose Properties, and the Log On tab. Click the radio button that says This Account. Fill in the information with the Domain Admin's credentioals, and click Apply. Then try to stop and start that service. If it restarts, the fix should work. Thanks, B. 
    Wednesday, March 05, 2014 3:42 PM