Searching across Enterprise Vault (EV) 32 bit indexes fails when searching across EV servers

Searching across Enterprise Vault (EV) 32 bit indexes fails when searching across EV servers

Article: 100011024
Last Published: 2014-05-02
Ratings: 0 1
Product(s): Enterprise Vault


This issue can occur when searching an EV archive index that resides on a different EV server to the EV server that is connected to in the URL. For example, the user could be connecting to any EV web application as follows:-

http://EV1/EnterpriseVault/Search.asp or http://EV1/EnterpriseVault/ArchiveExplorerUI.asp or http://EV1/EnterpriseVault/Searcho2k.asp

The archives index, in this example, is hosted on an EV server called EV2.

In this example, process that hosts the search (W3WP.exe) on EV1 contacts EV2 to get the information from the index. That particular connection fails due to an access issue and the error below is generated within the Enterprise Vault event log on EV1.

Error Message

The Enterprise Event log shows the following error:

A DTRACE on the originating server of the W3WP process shows the following error:-

(w3wp)    EV:L    {VAULTCOCREATEINSTANCEEX.EN_US} CLSID [{562FF725-C308-11D1-93DA-0000F87A3C75}] Server Name [EV2] Used Server Name [EV2] Num of attempts [1] Total elapsed [0.014s] Result [Success(0)]
(w3wp)    EV:M    CCIndexBrokerPtr::GetIndexBrokerPtr Setting DCOM security
(w3wp)    EV~E    Event ID: 7231 A COM error occurred. |Access is denied.  (0x80070005) |Internal reference: CRSS GetIndexServer|
(w3wp)    EV:H    {CIndexServerPtr<T>::CreateServer} (Exit) Status: [Access is denied.  (0x80070005)]
(w3wp)    EV:H    {CIndexServerPtr<T>::GetIndexServerPtr} (Exit) Status: [Access is denied.  (0x80070005)]
(w3wp)    EV:H    CFederatedSearchItem::GetAsyncInterface VolSetId:6 - hr=Access is denied.  (0x80070005)|
(w3wp)    EV:H    CFederatedSearchItem::BeginSearch2 Search failed with 'normal' error: hr=Access is denied.  (0x80070005).


This issue is caused by the request from the originating EV server (EV1 in this example) incorrectly using the computer account credentials when contacting EV2. The computer account does not have access in DCOM and so "access denied" is the response to the request, which is seen in the event log generated.

The issue can be verified further via a network trace which will show the "access denied" being generated in the response packet. Reproduce the issue with a network trace running and search on the string IIndexAccess2 in the Packet Details. Follow the TCP Stream and the "access denied" will be shown in the response packet as indicated below. This screen shot shows the request with the computer account credentials being incorrectly used and the response denying the request:



Add the originating EV servers computer account (EV1 in this example) to the local administrators group of the EV server that hosts the index (EV2 in this example)

Veritas Corporation has acknowledged that the above-mentioned issue is present in the current version(s) of the product(s) mentioned at the end of this article. Veritas Corporation is committed to product quality and satisfied customers.
This issue is currently under investigation by Veritas Corporation. Pending the outcome of the investigation, this issue may be resolved by way of a patch or hotfix in current or future revisions of the software. However, this particular issue is not currently scheduled for any release.  If you feel this issue has a direct business impact for you and your continued use of the product, please contact your Veritas Sales representative or the Veritas Sales group to discuss these concerns.  For information on how to contact Veritas Sales, please see

Please be sure to refer back to this document periodically as any changes to the status of the issue will be reflected here.


Etrack : 3231801

Was this content helpful?