SBS 2011 – SharePoint Foundation Event ID 6398 – Access Denied Every 30 Minutes

We applied the following update via WSUS on one of our production hosted SBS 2011 VMs:

• KB2345322: MS10-072: Description of the security update for Microsoft SharePoint Foundation 2010: October 12, 2010
• 

Since doing so we have seen a lot of the following errors in the Event Logs:

Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Date:          1/5/2011 12:30:17 PM
Event ID:      6398
Task Category: Timer
Level:         Critical
Keywords:     
User:          DOMAIN\spfarm
Computer:      SBS.DOMAIN.local
Description:
The Execute method of job definition Microsoft.SharePoint.Administration.SPUsageImportJobDefinition (ID xxxx-xxxx) threw an exception. More information is included below.

Access to the path 'C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\LOGS' is denied.

To fix the error we need to reset the permissions on that folder as the KB sets the following permissions:

1. Check Include inheritable permissions …
• 
2. Add Network Service and set FULL permissions.
• 
3. WSS_ADMIN_WPG (DOMAIN\WSS_ADMIN_WPG) has Modify
• 
4. WSS_RESTRICTED_WPG_V4 (DOMAIN\WSS_RESTRICTED_WPG_V4) has Modify.
1. 

The errors should clear up after the above changes are made.

Thanks to Microsoft’s SBS PSS Wayne McIntyre for the fix.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer