Event ID 4289 occurring on a Windows file server running the File Placeholder Service
Article ID: 100034320
Updated On:
Description
Error Message
Log Name: Veritas Enterprise Vault
Source: Enterprise Vault
Event ID: 4289
Task Category: File Placeholder Service
Level: Warning
Computer: FileServer.EVLab.Local
Description:
Unable to connect to server 'EVSERVER' using Kerberos authentication.
Reason: The RPC server is unavailable. (0x800706ba)
The DCOM connection was attempted with:
CLSID: {F4D3EB5B-C7C5-11D1-90DB-0000F879BE6A}
Server name: EVSERVER
Server Principal Name: dcom/evserver.evlab.local
The connection was made using WinNT authentication. Check that the server name identifies a known server.
There may be a problem with Kerberos authentication or a security issue. An unknown server could indicate a man-in-the-middle attack.
V-437-4289
Cause
The Service Principal Name does not exist for the Enterprise Vault (EV) server in the format reported in the Warning.
Resolution
Add the specified entry in the error as an SPN in Active Directory using the following command syntax.
setspn -S dcom/evserver.evlab.local EV
In this example, the dcom/evserver.evlab.local entry is being added to the server named EV in Active Directory. The following command will return a list of entries for the server with the name EV.
setspn -l EV
Notes:
1. In the above examples the server name EV should be replaced with the correct server name for the Enterprise Vault server.
2. This solution should work for clustered and non-clustered Enterprise Vault servers. If this solution does not work in either configuration, please contact Veritas Support for assistance.
Issue/Introduction
