Access denied for writing to disk

Microsoft.Windows.SharePoint.Services.3.0.Access_denied_for_writing_to_disk (Rule)

The application pool used by Windows SharePoint Services uses a service account when writing to a registry key or a file folder in the Windows file system.

Knowledge Base article:

Summary

The application pool used by Windows SharePoint Services uses a service account when writing to a registry key or a file folder in the Windows file system.

Causes

This error occurs when the application pool that Windows SharePoint Services uses attempts to update a registry key or file folder and is denied access because the service account used by the application pool has inadequate permissions.

This error occurs when the application pool that Windows SharePoint Services attempts to update a registry key or file folder and is denied access because the service account used by the application pool has inadequate permissions.

This may occur when the application pool was updated incorrectly. For example, when an administrator changes the credentials on the application pool in Internet Information Services (IIS) Manager, instead of using the stsadm.exe command-line utility, the updated credentials are not added to the WSS_WPG and WSS_ADM_WPG NT Groups used by Windows SharePoint Services.

Resolutions

Grant required permissions to the service account used by the application pool for the Web application on the registry key or for the folder location identified in the Windows NT Event log. See the Windows SharePoint Services Administrator’s Guide for the required permission settings.
Verify that you have used the prescriptive guidance in the Windows SharePoint Services Administrator’s Guide for using the stsadm.exe command-line utility in order to change the service account on the application pool.

Element properties:

Target

Microsoft.Windows.SharePoint.Services.3.0.WSS.Application

Category

EventCollection

Enabled

True

Event_ID

6589

Event Source

Windows SharePoint Services 3

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

Access denied for writing to disk

Event ID {0} from Source {2} on agent computer {3} has triggered this Alert Description : {1}

Event Log

Application

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
CollectData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
DataWarehousePublishData	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
WSS.GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.Windows.SharePoint.Services.3.0.Access_denied_for_writing_to_disk" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.SharePoint.Services.3.0.WSS.Application" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="MSWL!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="MSWL!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>6589</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Windows SharePoint Services 3</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="CollectData" TypeID="SystemCenter!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="DataWarehousePublishData" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="WSS.GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.SharePoint.Services.3.0.Access_denied_for_writing_to_disk.AlertMessageID"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDisplayNumber$</AlertParameter1>

        <AlertParameter2>$Data/EventDescription$</AlertParameter2>

        <AlertParameter3>$Data/PublisherName$</AlertParameter3>

        <AlertParameter4>$Target/Host/Property[Type="MSWL!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter4>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>