Archived items fail to index or index rebuild task fail and Event ID 10016 and Event ID 41352 are logged on the EV Server

Problem

Archived items fail to Index or index rebuild task fail and numerous DCOM error Event ID 10016 appear in the System event log and error Event ID 41352 appear in the Veritas Enterprise Vault event log.

Error Message

[System event log]
Source: Microsoft-Windows-DistributedCOM
Event ID: 10016
Description:
The application-specific permission settings do not grant Remote Launch permission for the COM Server application with CLSID
{F4D3EB5B-C7C5-11D1-90DB-0000F879BE6A}
and APPID
{95DCB63F-C982-11D1-90E0-0000F879BE6A}
to the user NT AUTHORITY\ANONYMOUS LOGON SID (S-1-5-7) from address 10.4.1.13. This security permission can be modified using the Component Services administrative tool.
V-437-10016

[Enterprise Vault event log]

Event ID: 41352
Task Category: Index Volumes Processor
Description: The processing of the Rebuild Sub task has stopped following errors.
Archive name: User 1
Task: Rebuild_2015-02-16_11:26:47_AM
Rebuild Sub task ID: 1E5B61E06AB7C9848902C7525A7E08A9D1110000evserver1_7
Reason: Undefined
Error Type: NonCritical
Description: Retrieving the COM class factory for remote component with CLSID {3A92686F-E5E8-4505-ABB5-49E5F725617A} from machine evserver1.EV.Local failed due to the following error: 80070005.
V-437-41352

Dtrace of EVIndexVolumesProcessor

{VAULTCOCREATEINSTANCEEX } Attempt [1] to create COM object failed. CLSID [{23228C7A-3C82-4A7D-948E-BE99EEF5991D}] Server Name [EVMail.Domain.in] Elapsed [0.016s] Result [Access is denied. (0x80070005)]
{VAULTCOCREATEINSTANCEEX } CLSID [{3A4119F2-3387-11D3-AD9F-0000F877C79D}] Server Name [EVAMAIL1] Used Server Name [EVMAIL1] Num of attempts [1] Total elapsed [0.007s] Result [Success (0)]

<Fetcher Thread for 1691A764A3155D44DA29FF597F5AF53B11110000EVAMail_10:4640> EV-H {STORAGEPROXY.EN_US} Exception: Retrieving the COM class factory for remote component with CLSID {3A92686F-E5E8-4505-ABB5-49E5F725617A} from machine EVMail.Domain.in failed due to the following error: 80070005. Info:Could not get a storage object. EntryId=[1691A764A3155D44DA29FF597F5AF53B11110000EVAMail], StorageComputer=[EVAMail.in-kon.ch], ObjectType=[System.__ComObject] Diag: Type:System.UnauthorizedAccessException ST: at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle& ctor, Boolean& bNeedSecurityCheck)| at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean fillCache)| at System.RuntimeType.CreateInstanceImpl(Boolean publicOnly, Boolean skipVisibilityChecks, Boolean fillCache)| at System.Activator.CreateInstance(Type type, Boolean nonPublic)| at Symantec.EnterpriseVault.Indexing.ContentSource.ActivatorWrapper.CreateInstance(Type type)| at Symantec.EnterpriseVault.Indexing.ContentSource.StorageProxy.GetStorageObject(String entryID) Inner:None

<Fetcher Thread for 1691A764A3155D44DA29FF597F5AF53B11110000EVAMail_10:4640> EV-H {ITEMADDITIONSALLOCATOR } Exception: Retrieving the COM class factory for remote component with CLSID {3A92686F-E5E8-4505-ABB5-49E5F725617A} from machine EVMail.Domain.in failed due to the following error: 80070005. Info:Could not determine if there are additions to do Diag: Type:System.UnauthorizedAccessException ST: at System.RuntimeTypeHandle.CreateInstance(RuntimeType type, Boolean publicOnly, Boolean noCheck, Boolean& canBeCached, RuntimeMethodHandle& ctor, Boolean& bNeedSecurityCheck)| at System.RuntimeType.CreateInstanceSlow(Boolean publicOnly, Boolean fillCache)| at System.RuntimeType.CreateInstanceImpl(Boolean publicOnly, Boolean skipVisibilityChecks, Boolean fillCache)| at System.Activator.CreateInstance(Type type, Boolean nonPublic)| at Symantec.EnterpriseVault.Indexing.ContentSource.ActivatorWrapper.CreateInstance(Type type)| at Symantec.EnterpriseVault.Indexing.ContentSource.StorageProxy.GetStorageObject(String entryID)| at Symantec.EnterpriseVault.Indexing.ContentSource.EVArchiveCrawlerAccessor.GetArchiveCrawler(String archiveID)| at Symantec.EnterpriseVault.Indexing.ContentSource.EVAdditionDataReaderFactory.GetArchiveCrawler(String archiveId)| at Symantec.EnterpriseVault.Indexing.ContentSource.EVAdditionDataReaderFactory.GetInstance(UInt64 nextItemSequenceNumber, UInt64 maxItemSequenceNumber, UInt32 timeoutInSeconds, UInt32 maxRetries)| at Symantec.EnterpriseVault.Indexing.IndexVolumesProcessor.ItemAdditionFetcher.GetItem(UInt64 nextItemActionID, UInt64 maxItemID)| at Symantec.EnterpriseVault.Indexing.IndexVolumesProcessor.ItemAdditionFetcher.GetNextItem(UInt64 nextItemID, UInt64 maxItemID)| at Symantec.EnterpriseVault.Indexing.IndexVolumesProcessor.ItemAdditionsAllocator.get_HasSomeWorkToDo() Inner:None

Cause

DCOM is disabled in the Enterprise Vault server or the Microsoft loopback check security feature that is designed to help prevent reflection attacks is enabled.

Solution

1. Verity that DCOM is enabled on Enterprise Vault Server.

2. Disable loopback check on the Enterprise Vault Server in the registry:

HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Dword value: DisableLoopbackCheck
Value data (Decimal): 00000001

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly.  Great care should be taken when making changes to a Windows registry.  Registry modifications should only be carried-out by persons experienced in the use of the registry editor application.  It is also recommended that a complete backup of the registry and workstation / server be made prior to making any registry changes.    

Note: For the BackConnectionHostNames value, add the Hostname, FQDN, and IP address (one entry per line).