I spent some time today troubleshooting an alert that we received in Operations Manager 2007 from one of the client SharePoint servers that we manage in our Operations Center. The alert referenced Event ID 6398 which indicates that the execute method of a SharePoint timer job definition had thrown an exception. I logged onto the client SharePoint server and looked in the Application event log and, sure enough, it was full of the following 6398 event:
Event Type: Error
Event Source: Windows SharePoint Services 3
Event Category: Timer
Event ID: 6398
Date: 11/19/2008
Time: 1:05:53 PM
User: N/A
Computer: <ServerName>
Description:
The Execute method of job definition Microsoft.Office.Server.Search.Administration.IndexingScheduleJobDefinition (ID 03d6f1b3-879c-42d9-8921-3f14b9e5678f) threw an exception. More information is included below.
Retrieving the COM class factory for component with CLSID {3D42CCB1-4665-4620-92A3-478F47389230} failed due to the following error: 80070005.
The System event log contained numerous instances of the following DCOM error as well:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10016
Date: 11/19/2008
Time: 1:06:26 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: ATI-SHAREPOINT
Description:
The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{3D42CCB1-4665-4620-92A3-478F47389230}
to the user NT AUTHORITY\NETWORK SERVICE SID (S-1-5-20). This security permission can be modified using the Component Services administrative tool.
This problem can be resolved by accessing the Component Services applet by way of Start > Administrative Tools > Component Services. In the task pane expand Component Services, expand Computers, and expand My Computer, and click on DCOM Config.
In the details pane on right, locate and right-click on the OSearch application and select Properties from the menu. On the OSearch Properties dialog box, click on the Security tab. In the Launch and Activation Permissions section, select the Customize option and then click the Edit button.
On the Launch Permissions dialog box, add the NETWORK SERVICE user and grant it Local Launch and Local Activation permissions as shown above. Click the OK button twice and then close the Component Services applet. You should now have a much quieter and happier event log!


[...] SharePoint Execute Method Exception (Event ID 6398) [...]
I kept stumbling over why I was getting “System.Security.Policy.PolicyException: Execution permission cannot be acquired”. I finally figured out I was missing permissions
http://blogs.windwardreports.com/tomasr/2009/07/sharepoint-custom-cas-policies-grant-all-of-the-permissions-you-need.html.