Sporadical Event ID 33502/33503 on SCSM DWH Management Server

  • Article

Behavior:
You might see sporadically Event ID 33502 / 33503 and 33580 on your SCSM Datawarehouse Management Server.
Those events indicates several issues with extract job modules.
The extract jobs run every 5 minutes by default, but the error occurs very sporadically ( ones a day or less) only. That can't not caused by any configuration failure.

Dnaiel_2016_03_18_1

All of them tell you that the DWH extract job can't run successful due to a login failure.

ETL Module Execution failed:
ETL process type: Extract
Batch ID: 690023
Module name: Extract_System.WorkItem.BillableTimeHasWorkingUser
Message: LogonUser() failed with error code:1385. called by Helper.GetConnection.

Error code 1385 means "The user has not been granted the requested logon type at this computer.  "

Reason:
While checking the security event log I figured out that every time when those events 33xxx in OpsMgr log were logged something happens with local group member ships on the DWH Management Server.

Dnaiel_2016_03_18_2

The underlying reason was a Group Policy (GPO) refresh that happens every 90 minutes by default.
During the refresh all local group memberships (managed by GPO) were removed first and added afterwards again.

The whole GPO refresh takes a few seconds only but during this update of local group memberships a few SCSM extract jobs might fail.

Conclusion:
In general that's not an issue. After 5 minutes the next extract job will run without failure, but I might confuse you a bit, because you see a lot of Error and Warning events in you OpsMgr event log.