Event ID 370 or 371 Appears in the Windows Application Event log and the SMSMSE Shared Resource Cannot Be Brought Online

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

You have installed Symantec Mail Security for Microsoft Exchange (SMSMSE) in a Microsoft Exchange cluster and correctly created the SMSMSE resource, but the SMSMSE resource will not come online in the Cluster Administrator mmc. Attempts to bring it online result in a "Failed" status for the resource.

Symptoms
One of the following events appears in the Windows Application Event log: 

Type: Error
Date:
Time:
Event: 371
Source: Symantec Mail Security for Microsoft Exchange
Category: Settings
User: N/A
Computer: EXCH_NODE_2
Description:Failed to save settings to the shared storage location (H:\SMSMSE\SHARED).

Type: Error
Date:
Time:
Event: 370
Source: Symantec Mail Security for Microsoft Exchange
Category: Settings
User: N/A
Computer: EXCH_NODE_2
Description:Failed to retrieve settings from the shared storage location (H:\SMSMSE\SHARED).

Events similar to the following appear in the Windows System Event Log: 

Type: Error
Date:
Time:
Event: 1069
Source: ClusSvc
Category: Failover Mgr
User: N/A
Computer: EXCH_NODE_2
Description:Cluster resource 'SMSMSE ' in Resource Group 'EVS1' failed.

Type: Error
Date:
Time:
Event: 10016
Source: DCOM
Category: None
User: DOMAINNAME\ClusterAdmin
Computer: EXCH_NODE_2
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{3AE2B8E5-7555-4E0E-B56C-A804C743D1CB}
to the user DOMAINNAME\ClusterAdmin SID (S-1-5-21-3050410616-167133423-812606468-1106). This security permission can be modified using the Component Services administrative tool.
HKEY_CLASSES_ROOT\AppID\{3AE2B8E5-7555-4E0E-B56C-A804C743D1CB} 

Cause

Possible causes:

• The Cluster Administrator account (the account with which the Cluster service is configured to run- see below for details) is not a member of the SMSMSE Admins group.
• You are using EMC PowerPath in Multi-Path mode.
• Permissions problems.
• Problems accessing files on the shared resource.
• The SMSMSE resource has been created with incorrect dependencies.
• You upgraded from one major release of SMSMSE to another major release, SMSMSE 5.x -> SMSMSE 6.x, without deleting the settings.xml located on the shared storage.

Resolution

Using Active Directory Users and Computers, add the Cluster Administrator account to the SMSMSE Admins group and restart the Cluster service on each node.

Or, if you are using EMC powerpath, ensure that EMC PowerPath is set to single path mode for the disk.

To determine the Cluster Administrator account:
 

1. Click Start > Administrative Tools > Services.
2. Right-click the Cluster service.
3. Click Properties.
4. The Cluster Administrator account is listed on the Log On tab.

To add the cluster Administrator account to the SMSMSE Admins group:
 

1. On the Domain Controller click Start > Programs > Administrative Tools > Active Directory Users and Computers.
2. Open Users.
3. Right-click SMSMSE Admins.
4. Click Properties.
5. On the Members tab, add the Cluster Service account.
6. On the Windows taskbar, click Start > Programs > Administrative Tools > Cluster Administrator.
7. Right-click one of the nodes and click Stop Cluster Service.
8. When the cluster service stops, start it on the same node.
9. Repeat steps 6 - 8 for each cluster node.

NOTE
If, for security reasons, the Domain Admin group is restricted, install SMSMSE with the Cluster account.

NOTE
An installation on Microsoft Cluster requires that drive letters are assigned to the Cluster Resource "Symantec Mail Security"
Using Mountpoints will generate Event ID 371.


References
Installing Symantec Information Foundation Mail Security 6.x for Microsoft Exchange on an Exchange 2000 Server or an Exchange Server 2003 Cluster

Technical Information
In cases where difficulties persisted after adding the Cluster Administrator account to the SMSMSE Admins group, a reboot of the server node has been seen to work. Once the appropriate group permissions have been applied and services reinitialized, the SMSMSE resource should be capable of being brought online.