Moss 2007 - Event Log EventId:7888 Windows NT user or group not found

Question

I am getting this event in my Application event log:

Event Type: Error
Event Source: Office SharePoint Server
Event Category: Office Server General 
Event ID: 7888
Date:  11/8/2010
Time:  11:15:36 AM
User:  N/A
Computer: ENTERPRISE
Description:
A runtime exception was detected. Details follow. 
Message: Windows NT user or group 'domain.com\admin' not found. Check the name again.

Techinal Details:
System.Data.SqlClient.SqlException: Windows NT user or group 'domain.com\admin' not found. Check the name again.
   at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)
   at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
   at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj)
   at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavior runBehavior, String resetOptionsString)
   at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, Boolean async)
   at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result)
   at System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(DbAsyncResult result, String methodName, Boolean sendToPipe)
   at System.Data.SqlClient.SqlCommand.ExecuteNonQuery()
   at Microsoft.Office.Server.Data.SqlSession.ExecuteNonQuery(SqlCommand command)
   at Microsoft.Office.Server.Data.SqlServerManager.GrantLogin(String user)
   at Microsoft.Office.Server.Administration.SharedResourceProvider.SynchronizeConfigurationDatabaseAccess(SharedComponentSecurity security)
   at Microsoft.Office.Server.Administration.SharedResourceProvider.SynchronizeAccessControl(SharedComponentSecurity sharedApplicationSecurity)
   at Microsoft.Office.Server.Administration.SharedResourceProvider.Microsoft.Office.Server.Administration.ISharedComponent.Synchronize()

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I am convinced that it is because I installed and configured Sharepoint with a domain.com\admin account and not the netbios version, domain_com\admin. I have encountered this with other parts of sharepoint.

My question is: Does anyone know how to figure out what/where to change that account so that the error will go away. I have tried to add the account domain.com\admin to the sql server but since the account domain_com\admin is already there it won't let me. (It is the same account).

The site seems to work fine, other than filling up the event log.

I have searched the world over and found nothing.

I am having some issues with IIS where I need to do a reset. This is caused by the Sharepoint Timer service and I think if I can fix this issue it might fix the timer issue.

Thanks.

Answer 1

Can you login to the server or sharepoint with the given username?

First off, if you only used domain.com/admin as the installation user and nothing else, I don't think that is the cause of the problem.

Then take a look for Failure Audit entries on your sharepoint server and your domain controller to see if there is an obvious reason for the "user not found" error.

If that doesn't lead anywhere, take a look at all your Sharepoint service accounts, as these are the accounts that will be logging in here and there for Sharepoint. Given the "general" nature of the error, it seems likely to be the Central Admin app pool account, but it could be a Shared Service Provider pool account, or even a web application. Oh man - Sharepoint can have a lot of different accounts - it's a nightmare to keep track, even if only one of you set this up!

You should check each application pool's identity tab in IIS for your Sharepoint server, and note down which pool uses which account. Also check the account used by SQL server, and any other accounts you may have used for crawling etc.

Once you have this list, you can follow Microsoft's procedure for changing service accounts. If all your services/functions use the same account, you could try changing them to see if that fixes it.

If worst comes to the worst and things aren't working, as long as you have your config and content databases intact, you can blow away the Sharepoint server, and start again with your accounts. If you do this, I recommend using different accounts for each function as suggested by Microsoft. It may seem like overkill, but if nothing else makes the errors a lot easier to deal with!