A dtrace of RetrievalTask shows the following warning:
Event ID: 5218 The Retrieval Service on computer
V-437-5218
The IIS logs on the EV server show entries similar to the following:
2013-11-12 05:15:22 W3SVC1 ..........................GET /EVAnon/restoreo2k.asp............443 - .......................... - 560 0 64
2013-11-12 05:37:04 W3SVC1 ......................... GET /EVAnon/restoreo2k.asp ............443 - ......................... - 560 0 0
The Enterprise Vault components are misconfigured in DCOM to run as the incorrect user.
1. On the Enterprise Vault server, open the Component Services utility (Start > Administrative Tools > Component Services).
2. Expand Component Services > Computers > My Computer.
3. Expand DCOM Config Folder. It will list all the DCOM Components on left pane.
4. Verify the Identity for the EV Components listed below. One by one, right-click and select Properties and select Identity Tab. The option should be set to This user, with the credentials specified for the Vault Service Account.
5. Restart the Admin Service.