1

In my event log I see this error generating every minute (Event ID 6482):

Application Server Administration job failed for service instance Microsoft.Office.Server.Search.Administration.SearchServiceInstance (e1df40b4-a364-47af-a4fa-69e010bf3893). Reason: A call to SSPI failed, see inner exception. Technical Support Details: System.ServiceModel.Security.SecurityNegotiationException: A call to SSPI failed, see inner exception. ---> System.Security.Authentication.AuthenticationException: A call to SSPI failed, see inner exception. ---> System.ComponentModel.Win32Exception: The target principal name is incorrect --- End of inner exception stack trace --- at System.Net.Security.NegoState.StartSendAuthResetSignal(LazyAsyncResult lazyResult, Byte[] message, Exception exception) at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult) at System.Net.Security.NegoState.CheckCompletionBeforeNextSend(Byte[] message, LazyAsyncResult lazyResult) at System.Net.Security.NegoState.ProcessReceivedBlob(Byte[] message, LazyAsyncResult lazyResult) at System.Net.Security.NegoState.StartSendBlob(Byte[] message, LazyAsyncResult lazyResult) at System.Net.Security.NegoState.ProcessAuthentication(LazyAsyncResult lazyResult) at System.Net.Security.NegotiateStream.AuthenticateAsClient(NetworkCredential credential, String targetName, ProtectionLevel requiredProtectionLevel, TokenImpersonationLevel allowedImpersonationLevel) at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeInitiator.OnInitiateUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity) --- End of inner exception stack trace --- Server stack trace: at System.ServiceModel.Channels.WindowsStreamSecurityUpgradeProvider.WindowsStreamSecurityUpgradeInitiator.OnInitiateUpgrade(Stream stream, SecurityMessageProperty& remoteSecurity) at System.ServiceModel.Channels.StreamSecurityUpgradeInitiatorBase.InitiateUpgrade(Stream stream) at System.ServiceModel.Channels.ConnectionUpgradeHelper.InitiateUpgrade(StreamUpgradeInitiator upgradeInitiator, IConnection& connection, ClientFramingDecoder decoder, IDefaultCommunicationTimeouts defaultTimeouts, TimeoutHelper& timeoutHelper) at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.SendPreamble(IConnection connection, ArraySegment`1 preamble, TimeoutHelper& timeoutHelper)
at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.DuplexConnectionPoolHelper.AcceptPooledConnection(IConnection connection, TimeoutHelper& timeoutHelper) at System.ServiceModel.Channels.ConnectionPoolHelper.EstablishConnection(TimeSpan timeout) at System.ServiceModel.Channels.ClientFramingDuplexSessionChannel.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)
at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.CallOnceManager.CallOnce(TimeSpan timeout, CallOnceManager cascade) at System.ServiceModel.Channels.ServiceChannel.EnsureOpened(TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation) at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message) Exception rethrown at [0]: at Microsoft.Office.Server.Search.Administration.SearchServiceInstance.Synchronize() at Microsoft.Office.Server.Administration.ApplicationServerJob.ProvisionLocalSharedServiceInstances(Boolean isAdministrationServiceJob)

Also Event 6398 shows up every now and then :

The Execute method of job definition Microsoft.Office.Server.Search.Administration.CustomDictionaryDeploymentJobDefinition (ID ec00dacf-a390-48ff-a800-05f9678bf768) threw an exception. More information is included below. Failed to run flow Microsoft.CustomDictionaryDeployment. Correlation Id: ed8f429d-8e96-509c-0eb5-1627b4f98499.

I have been trying to resolve these for the last couple of days. But nothing helped.

Just to let you know, I tried adding/resetting the SPN from PowerShell as Administrator using setspn but it says "Insufficient Access Rights to perform this operation" although ideally it should since I am using the privileged account to run this script. Moreover I dont access to have Domain Controller so can not delegate the access rights either.

Please let me know how to resolve this as these 2 errors are filling up my event logs and might be causing the site to go down quite often.

3

clearly, it is SPN issue. You have to make sure the SPN properly created.Could you please run the setspn and get list of all SPN which already created.

if you need to allow delegated administrators to configure service principal names (SPNs), you must ensure that their user accounts have the Validated write to service principle name permission. More information, please refer to the link: http://technet.microsoft.com/en-us/library/cc731241.aspx

Source

Another thing: please check the service accounts of SharePoint Timer Service and SharePoint Search Host Controller service, add a SPN entry for each the service account as the following command:

Setspn.exe -A HTTP/

After the above, do an IISREST.

  • Thank you Waqas Sarwar. Well, if I run setspn -L <account> I see: – Ria Nov 17 '15 at 20:15
  • Thank you @Waqas . Well, if I run setspn -L <account> I see - Registered ServiceName for Cn=**** and so on DC=com: <blank> . So now when I try to run setspn -A or setspn -S in order to register the SPN to a host it says I dont have necessary permission. But I am running the script as an administrator. Also I can't delegate the access as I dont have the option to use the domain controller. So looks like I myself will have to add the SPN, is there any alternative way to do that? Or how can i resolve this permission issue because I am already using the administrator account? – Ria Nov 17 '15 at 20:21
  • if you are using the kerberos, you have to create the SPN properly. On the AD server, do you have other administrator who can runt he setspn for you. – Waqas Sarwar MVP Nov 17 '15 at 20:24
  • if you check the technet, they have information how to delegate the permission – Waqas Sarwar MVP Nov 17 '15 at 20:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.