Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Windows Indexing and PST creations during Discovery / Compliance Accelerator exports

Created: 01 Mar 2013 • Updated: 13 Mar 2013 | 4 comments
Kenneth Adams's picture
This issue has been solved. See solution.

Greetings, everyone;

We've just learned that the Windows Indexing, which is from the Windows Search Service that is available through the Windows Server 2008R2 File Services role, can cause Compliance Accelerator and Discovery Accelerator exports to PST files to stop processing.  The issue is noted by a PST export creating and populating some PST files, but stopping at some point and not providing any more movement of the MSG files into PST files.  In the Application Event Log, we can see the following warning:

Log Name:        Application
Source:            Microsoft-Windows-Search
Event ID:          3036
Task Category: Gatherer
Level:               Warning
Keywords:        Classic
Description:

The content source <mapi://{S-1-5-21-1641732182-3450206618-3135297742-1108}/> cannot be accessed.
Context:  Application, SystemIndex Catalog
Details:
                A server error occurred. Check that the server is available.  (HRESULT : 0x80041206) (0x80041206)

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="32768">3036</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2013-03-01T15:07:42.000000000Z" />
    <EventRecordID>8869</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>ev-da.evlabs.org</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">
Context:  Application, SystemIndex Catalog
Details:
                A server error occurred. Check that the server is available.  (HRESULT : 0x80041206) (0x80041206)
</Data>
    <Data Name="URL">mapi://{S-1-5-21-1641732182-3450206618-3135297742-1108}/</Data>
  </EventData>
</Event>

If exporting to PST through the Vault Admin Console, the same issue may be experienced.

If you experience failures to create PST files while exporting to PST from Enterprise Vault, Compliance Accelerator, or Discovery Accelerator, check your Application Event log for the Event ID 3036 warning.  If you find it, check for Windows Search Service and stop it if found and see it's running.

We're generating documentation about this and will have our CA and DA installation guides updated in our next release to recommend uninstalling the Windows Search role / feature on the CA and DA servers.

Operating Systems:

Comments 4 CommentsJump to latest comment

AndrewB's picture

interesting find

Andy Becker | Authorized Symantec Consultant | Trace3 | Symantec National Partner | www.trace3.com

DeadEyedJacks's picture

Fortunately on recent versions of Windows Server the search / index services aren't installed by default. 

You would have to have consciously choosen to add the File Servers role and specific search / indexing  features. 

Authorised Symantec Consultant on Archiving and eDiscovery ASC, STS, SCS, SSE+

Microsoft, NetApp and VMware certified professional MCTS, MCSE, MCSA, NCDA, NCIE-BR, VCP, VTSP

Kenneth Adams's picture

You are correct, DeadEyedJacks.  That feature must be manually selected, which we do not recommend for any Compliance Accelerator or Discovery Accelerator (OR Enterprise Vault) server used to export items to PST files.

Ken Adams

Backline Support for CA, DA, ACE, UCE, PSTD, ARMS, EVDC
US Support Region