Archive for March, 2014

Sharepoint 2010 Timer Service Stops Unexpectedly

Thursday, March 27th, 2014
Issue:
SharePoint 2010 Timer Service Stops Unexpectedly / SharePoint 2010 Timer Service keeps failing. Starting the service in Windows Services console will fail after sometime , logging error in Event Viewer.

Environment: 
SharePoint Application Server in a multi-tier medium farm. SharePoint WFE, App and database running on separate servers.

Scenario:
On one of the app server SharePoint 2010 Timer service keeps failing. In Windows Services console window if you start the service, after some moment it will stop automatically.

Looking at the Event Viewer logs on the server reports the following errors.

Error 1 on App Server 1
Log Name:      System
Source:        Service Control Manager
Date:          1/25/2014 11:28:04 AM
Event ID:      7034
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SPAppServer1.domain.com
Description:
The SharePoint 2010 Timer service terminated unexpectedly.  It has done this 4 time(s).
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Service Control Manager” Guid=”{555908d1-a6d7-4695-8e1e-26931d2012f4}” 

EventSourceName=”Service Control Manager” />
    <EventID Qualifiers=”49152″>7034</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime=”2014-01-25T16:28:04.344856500Z” />
    <EventRecordID>144167</EventRecordID>
    <Correlation />
    <Execution ProcessID=”524″ ThreadID=”6932″ />
    <Channel>System</Channel>
    <Computer>SPAppServer1.domain.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name=”param1″>SharePoint 2010 Timer</Data>
    <Data Name=”param2″>4</Data>
  </EventData>
</Event>

Error 2 on App Server 1
Log Name:      System
Source:        Service Control Manager
Date:          1/25/2014 11:25:04 AM
Event ID:      7031
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      SPAppServer1.domain.com
Description:
The SharePoint 2010 Timer service terminated unexpectedly.  It has done this 2 time(s).  The 

following corrective action will be taken in 30000 milliseconds: Restart the service.
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Service Control Manager” Guid=”{555908d1-a6d7-4695-8e1e-26931d2012f4}” 

EventSourceName=”Service Control Manager” />
    <EventID Qualifiers=”49152″>7031</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime=”2014-01-25T16:25:04.378034500Z” />
    <EventRecordID>144161</EventRecordID>
    <Correlation />
    <Execution ProcessID=”524″ ThreadID=”848″ />
    <Channel>System</Channel>
    <Computer>SPAppServer1.domain.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name=”param1″>SharePoint 2010 Timer</Data>
    <Data Name=”param2″>2</Data>
    <Data Name=”param3″>30000</Data>
    <Data Name=”param4″>1</Data>
    <Data Name=”param5″>Restart the service</Data>
  </EventData>
</Event>

Error 3 on App Server 1
Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Date:          1/26/2014 11:55:00 AM
Event ID:      8312
Task Category: Topology
Level:         Information
Keywords:      
User:          domainSPFarmSvcAct
Computer:      SPAppServer1.domain.com
Description:
SharePoint Web Services Round Robin Service Load Balancer Event: Initialization
Process Name: OWSTIMER
Process ID: 5132
AppDomain Name: DefaultDomain
AppDomain ID: 1
Service Application Uri: urn:schemas-microsoft-

com:sharepoint:service:abb4158ae70a418586e2f02f1c25966e#authority=urn:uuid:db81a38b0d1f41a0b81887

9a36c1c4cf&authority=https://SPAppServer2:32844/Topology/topology.svc
Active Endpoints: 1
Failed Endpoints:0
Endpoint List:
http://SPAppServer1:32843/abb4158ae70a418586e2f02f1c25966e/ProfileService.svc

Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Microsoft-SharePoint Products-SharePoint Foundation” Guid=”{6FB7E0CD-52E7-

47DD-997A-241563931FC2}” />
    <EventID>8312</EventID>
    <Version>14</Version>
    <Level>4</Level>
    <Task>13</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime=”2014-01-26T16:55:00.166105300Z” />
    <EventRecordID>560552</EventRecordID>
    <Correlation ActivityID=”{A04B162B-0875-4979-9829-C2055D7BFC99}” />
    <Execution ProcessID=”5132″ ThreadID=”6840″ />
    <Channel>Application</Channel>
    <Computer>SPAppServer1.domain.com</Computer>
    <Security UserID=”S-1-5-21-1627688274-1190192956-3999157559-1626″ />
  </System>
  <EventData>
    <Data Name=”string0″>Initialization</Data>
    <Data Name=”string1″>OWSTIMER</Data>
    <Data Name=”int2″>5132</Data>
    <Data Name=”string3″>DefaultDomain</Data>
    <Data Name=”int4″>1</Data>
    <Data Name=”string5″>urn:schemas-microsoft-

com:sharepoint:service:abb4158ae70a418586e2f02f1c25966e#authority=urn:uuid:db81a38b0d1f41a0b81887

9a36c1c4cf&amp;authority=https://SPAppServer2:32844/Topology/topology.svc</Data>
    <Data Name=”int6″>1</Data>
    <Data Name=”int7″>0</Data>
    <Data 

Name=”string8″>http://SPAppServer1:32843/abb4158ae70a418586e2f02f1c25966e/ProfileService.svc
</Data>
  </EventData>
</Event>
Error 4 – DCOM 10016 on App Server 1
Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          1/25/2014 8:37:42 AM
Event ID:      10016
Task Category: None
Level:         Error
Keywords:      Classic
User:          NETWORK SERVICE
Computer:      SPAppServer1.domain.com
Description:
The application-specific permission settings do not grant Local Launch permission for the COM 

Server application with CLSID 
{1BE1F766-5536-11D1-B726-00C04FB926AF}
 and APPID 
{1BE1F766-5536-11D1-B726-00C04FB926AF}
 to the user NT AUTHORITYNETWORK SERVICE SID (S-1-5-20) from address LocalHost (Using LRPC). 

This security permission can be modified using the Component Services administrative tool.
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Microsoft-Windows-DistributedCOM” Guid=”{1B562E86-B7AA-4131-BADC-

B6F3A001407E}” EventSourceName=”DCOM” />
    <EventID Qualifiers=”49152″>10016</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime=”2014-01-25T13:37:42.000000000Z” />
    <EventRecordID>143120</EventRecordID>
    <Correlation />
    <Execution ProcessID=”0″ ThreadID=”0″ />
    <Channel>System</Channel>
    <Computer>SPAppServer1.domain.com</Computer>
    <Security UserID=”S-1-5-20″ />
  </System>
  <EventData>
    <Data Name=”param1″>application-specific</Data>
    <Data Name=”param2″>Local</Data>
    <Data Name=”param3″>Launch</Data>
    <Data Name=”param4″>{1BE1F766-5536-11D1-B726-00C04FB926AF}</Data>
    <Data Name=”param5″>{1BE1F766-5536-11D1-B726-00C04FB926AF}</Data>
    <Data Name=”param6″>NT AUTHORITY</Data>
    <Data Name=”param7″>NETWORK SERVICE</Data>
    <Data Name=”param8″>S-1-5-20</Data>
    <Data Name=”param9″>LocalHost (Using LRPC)</Data>
  </EventData>
</Event>
A quick search on Microsoft KB article resulted in the following solution for the DCOM issue
At the 4th step of above KB article, I got stuck with the security tab being grayed out. I was running Windows 2008 R2. In short you take ownership for the service account and add full control permissions of the following registry key:
HKEY_CLASSES_ROOTAppID{61738644-F196-11D0-9953-00C04FD919C1}
Default Settings
Farm Service Account with permissions added
Reference: 
I found the following article to enable the security tab for IIS WAMREG Admin. 
After following above, the error 10016 was gone. I started the Sharepoint 2010 Timer Service but it stopped again after some time reporting the same errors listed above (except DCOM 10016 error) . A review of Central Admin app server, following errors were seen in the Event Viewer.
Error 1 on Central Admin App Server
Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Date:          1/26/2014 11:20:29 AM
Event ID:      8313
Task Category: Topology
Level:         Error
Keywords:      
User:          domainFMasood
Computer:      SPAppServer2.domain.com
Description:
SharePoint Web Services Round Robin Service Load Balancer Event: EndpointFailure
Process Name: w3wp
Process ID: 9888
AppDomain Name: /LM/W3SVC/784624454/ROOT-1-130403119376795973
AppDomain ID: 2
Service Application Uri: urn:schemas-microsoft-

com:sharepoint:service:de6d45dc853941058fe7920ad771208a#authority=urn:uuid:db81a38b0d1f41a0b81887

9a36c1c4cf&authority=https://SPAppServer1:32844/Topology/topology.svc
Active Endpoints: 2
Failed Endpoints:1
Affected Endpoint: http://SPWFEServer1:32843/de6d45dc853941058fe7920ad771208a/SearchService.svc
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Microsoft-SharePoint Products-SharePoint Foundation” Guid=”{6FB7E0CD-52E7-

47DD-997A-241563931FC2}” />
    <EventID>8313</EventID>
    <Version>14</Version>
    <Level>2</Level>
    <Task>13</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime=”2014-01-26T16:20:29.100686100Z” />
    <EventRecordID>1953825</EventRecordID>
    <Correlation ActivityID=”{CF33969D-E8B0-47C9-8A64-666110FB9663}” />
    <Execution ProcessID=”9888″ ThreadID=”9660″ />
    <Channel>Application</Channel>
    <Computer>SPAppServer2.domain.com</Computer>
    <Security UserID=”S-1-5-21-1627688274-1190192956-3999157559-386822″ />
  </System>
  <EventData>
    <Data Name=”string0″>EndpointFailure</Data>
    <Data Name=”string1″>w3wp</Data>
    <Data Name=”int2″>9888</Data>
    <Data Name=”string3″>/LM/W3SVC/784624454/ROOT-1-130403119376795973</Data>
    <Data Name=”int4″>2</Data>
    <Data Name=”string5″>urn:schemas-microsoft-

com:sharepoint:service:de6d45dc853941058fe7920ad771208a#authority=urn:uuid:db81a38b0d1f41a0b81887

9a36c1c4cf&amp;authority=https://SPAppServer1:32844/Topology/topology.svc</Data>
    <Data Name=”int6″>2</Data>
    <Data Name=”int7″>1</Data>
    <Data 

Name=”string8″>http://SPWFEServer1:32843/de6d45dc853941058fe7920ad771208a/SearchService.svc</Data

>
  </EventData>
</Event>
The following error(s) were noted on the SharePoint Web Front End (WFE)
Error 1 on WFE
Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Portal Server
Date:          1/26/2014 11:00:04 AM
Event ID:      5553
Task Category: User Profiles
Level:         Error
Keywords:      
User:          domainSPFarmSvcAct
Computer:      SPWFEServer1.domain.com
Description:
failure trying to synch site 96372276-8424-4f7a-9796-b05091a9f2ab for ContentDB 1146e13b-cb37-

43ab-83ce-cbc2e9d34248 WebApp 615621ff-80ea-487a-8ee5-60a7baaea6d4.  Exception message was Cannot 

insert duplicate key row in object ‘dbo.UserMemberships’ with unique index 

‘CX_UserMemberships_RecordId_MemberGroupId_SID’. The duplicate key value is (0c37852b-34d0-418e-

91c6-2ac25af4be5b, 9851, 600, 0x010500000000000515000000528d04613ce7f046374d5eeea1630000).
The statement has been terminated..
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Microsoft-SharePoint Products-SharePoint Portal Server” Guid=”{8B3DDD3D-2B09

-4669-BF81-E2D6921FEEEA}” />
    <EventID>5553</EventID>
    <Version>14</Version>
    <Level>2</Level>
    <Task>8</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime=”2014-01-26T16:00:04.103198800Z” />
    <EventRecordID>3208869</EventRecordID>
    <Correlation ActivityID=”{406758CA-3384-438B-936D-75C531CE9928}” />
    <Execution ProcessID=”2176″ ThreadID=”4584″ />
    <Channel>Application</Channel>
    <Computer>SPWFEServer1.domain.com</Computer>
    <Security UserID=”S-1-5-21-1627688274-1190192956-3999157559-1626″ />
  </System>
  <EventData>
    <Data Name=”string0″>failure trying to synch site 96372276-8424-4f7a-9796-b05091a9f2ab for 

ContentDB 1146e13b-cb37-43ab-83ce-cbc2e9d34248 WebApp 615621ff-80ea-487a-8ee5-

60a7baaea6d4.</Data>
    <Data Name=”string1″>Cannot insert duplicate key row in object ‘dbo.UserMemberships’ with 

unique index ‘CX_UserMemberships_RecordId_MemberGroupId_SID’. The duplicate key value is 

(0c37852b-34d0-418e-91c6-2ac25af4be5b, 9851, 600, 

0x010500000000000515000000528d04613ce7f046374d5eeea1630000).
The statement has been terminated.</Data>
  </EventData>
</Event>
Error 2 on WFE
Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Date:          1/26/2014 11:00:00 AM
Event ID:      2137
Task Category: Health
Level:         Error
Keywords:      
User:          domainSPFarmSvcAct
Computer:      SPWFEServer1.domain.com
Description:
The SharePoint Health Analyzer detected an error.  One or more servers is not responding.
The following servers have not executed any timer jobs in the last 2 hours: SPAppServer1.  This 

can happen if the server was shut down or lost network connectivity, or if the timer service on 

that server has crashed, hung, or been stopped.
Ensure that the server(s) listed above are running and connected to the network.  If the timer 

service is not started, restart the service by typing the following command at the command prompt 

on each server: “net start SPTimerV4.”  If the server was intentionally removed from the farm, 

remove the record of the server from the SharePoint topology in the Central Administration site 

at http://SPAppServer2:8000/_admin/FarmServers.aspx. For more information about this rule, see 

“http://go.microsoft.com/fwlink/?LinkID=142656”.

Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Microsoft-SharePoint Products-SharePoint Foundation” Guid=”{6FB7E0CD-52E7-

47DD-997A-241563931FC2}” />
    <EventID>2137</EventID>
    <Version>14</Version>
    <Level>2</Level>
    <Task>8</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime=”2014-01-26T16:00:00.931303500Z” />
    <EventRecordID>3208868</EventRecordID>
    <Correlation ActivityID=”{BC7B69CF-8A4C-4E48-8AF8-87CED41958A0}” />
    <Execution ProcessID=”2176″ ThreadID=”2652″ />
    <Channel>Application</Channel>
    <Computer>SPWFEServer1.domain.com</Computer>
    <Security UserID=”S-1-5-21-1627688274-1190192956-3999157559-1626″ />
  </System>
  <EventData>
    <Data Name=”string0″>One or more servers is not responding.
The following servers have not executed any timer jobs in the last 2 hours: SPAppServer1.  This 

can happen if the server was shut down or lost network connectivity, or if the timer service on 

that server has crashed, hung, or been stopped.
Ensure that the server(s) listed above are running and connected to the network.  If the timer 

service is not started, restart the service by typing the following command at the command prompt 

on each server: “net start SPTimerV4.”  If the server was intentionally removed from the farm, 

remove the record of the server from the SharePoint topology in the Central Administration site 

at http://SPAppServer2:8000/_admin/FarmServers.aspx. For more information about this rule, see 

“http://go.microsoft.com/fwlink/?LinkID=142656”.
</Data>
  </EventData>
</Event>
Stop the User Profile Service in Sharepoint Central Admin
The user profile error on the WFE prompted me to stop the User Profile Service on the App Server 1 and enable it on other server. I went through the following to start ‘User Profile Service’ on App Server 2 and stop it on App Server 1.
1. On Central Administration homepage click on ‘Manage servers in the farm’ under Systems Settings section
2. Click on an application server name that can serve the ‘User Profile Service’
3. Under Action column for the User Profile Service, click Start to start the service. Refresh the page after sometime to make sure the status column says Started
4. Go back to Page in step 2 and follow below
5. Click on the application server that has Sharepoint 2010 Timer Service stopping automatically and is running the ‘User Profile Service’
6. On that server, click Stop for the service under Action column
7. Refresh the page to make sure the service is stopped 

Start the ‘User Profile Service’ on App Server 2 using Central Admin
Now the service is started on App Server 2 and stopped on App Server 1 from Central Administration. Review the Windows Services console for the the service called ‘Forefront Identity Manager Service’.
After stopping the User Profile Service from Central Admin, Windows Event Viewer reported the following errors. It seems like the service had some issues and that why it crashed the process.
Error on App Server 1 – Windows Error Reporting
Log Name:      Application
Source:        Windows Error Reporting
Date:          1/26/2014 2:22:03 PM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      SPAppServer1.domain.com
Description:
Fault bucket , type 0
Event Name: CLR20r3
Response: Not available
Cab Id: 0

Problem signature:
P1: owstimer.exe
P2: 14.0.7105.5000
P3: 51e754a5
P4: mscorlib
P5: 2.0.0.0
P6: 5265c965
P7: 4220
P8: 51
P9: DI4EQZGVCWKDLTHKQTZWPXE3YRFKN1I2
P10: 

Attached files:

These files may be available here:
C:ProgramDataMicrosoftWindowsWERReportQueue

AppCrash_owstimer.exe_9a66a4341b3e295f2340a8bc2dbe53c6c5_440cadbf6144

Analysis symbol: 
Rechecking for solution: 0
Report Id: 44e8fbeb81-b51b-4411e3-9abb-44005056930138
Report Status: 4
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Windows Error Reporting” />
    <EventID Qualifiers=”0″>1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime=”2014-01-26T19:22:03.000000000Z” />
    <EventRecordID>560580</EventRecordID>
    <Channel>Application</Channel>
    <Computer>SPAppServer1.domain.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>CLR20r3</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>owstimer.exe</Data>
    <Data>14.0.7105.5000</Data>
    <Data>51e754a5</Data>
    <Data>mscorlib</Data>
    <Data>2.0.0.0</Data>
    <Data>5265c965</Data>
    <Data>4220</Data>
    <Data>51</Data>
    <Data>DI4EQZGVCWKDLTHKQTZWPXE3YRFKN1I2</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>C:ProgramDataMicrosoftWindowsWERReportQueue

AppCrash_owstimer.exe_9a66a4341b3e295f2340a8bc2dbe53c6c5_440cadbf61</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>e8fbeb81-b51b-11e3-9abb-44005056930138</Data>
    <Data>4</Data>
  </EventData>
</Event>
Error on App Server 1 – WAS
Log Name:      System
Source:        Microsoft-Windows-WAS
Date:          1/26/2014 2:53:43 PM
Event ID:      5009
Task Category: None
Level:         Warning
Keywords:      Classic
User:          N/A
Computer:      SPAppServer1.domain.com
Description:
A process serving application pool ‘dab7bc212ce84107bf62c8e661155b7c’ terminated unexpectedly. 

The process id was ‘5220’. The process exit code was ‘0xfffffffe’.
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Microsoft-Windows-WAS” Guid=”{524B5D04-133C-4A62-8362-64E8EDB9CE40}” 

EventSourceName=”WAS” />
    <EventID Qualifiers=”32768″>5009</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime=”2014-01-26T19:53:43.000000000Z” />
    <EventRecordID>144299</EventRecordID>
    <Correlation />
    <Execution ProcessID=”0″ ThreadID=”0″ />
    <Channel>System</Channel>
    <Computer>SPAppServer1.domain.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name=”AppPoolID”>dab7bc212ce84107bf62c8e661155b7c</Data>
    <Data Name=”ProcessID”>5220</Data>
    <Data Name=”ExitCode”>fffffffe</Data>
  </EventData>
</Event>
Outcome:
At this point, the User Profile Service was active on App Server 2 and was stopped on App Server 1. After it starting the Sharepoint 2010 Timer Service on the App Server 1 worked and the service stayed active.
Error on WFE Server
Log Name:      Application
Source:        Microsoft-SharePoint Products-SharePoint Foundation
Date:          1/26/2014 6:10:30 AM
Event ID:      6398
Task Category: Timer
Level:         Critical
Keywords:      
User:          domainSPFarmSvcAct
Computer:      SPWFEServer1.domain.com
Description:
The Execute method of job definition 

Microsoft.SharePoint.Administration.SPTimerRecycleJobDefinition (ID b88100e2-5681-4b05-929c-

34926b8216a4) threw an exception. More information is included below.

The timer service was not recycled because the following jobs were still running: Microsoft 

SharePoint Foundation Usage Data Import
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
  <System>
    <Provider Name=”Microsoft-SharePoint Products-SharePoint Foundation” Guid=”{6FB7E0CD-52E7-

47DD-997A-241563931FC2}” />
    <EventID>6398</EventID>
    <Version>14</Version>
    <Level>1</Level>
    <Task>12</Task>
    <Opcode>0</Opcode>
    <Keywords>0x4000000000000000</Keywords>
    <TimeCreated SystemTime=”2014-01-26T11:10:30.850325300Z” />
    <EventRecordID>3208858</EventRecordID>
    <Correlation ActivityID=”{88AD9857-12B9-421C-AE8A-C2A98C0D4204}” />
    <Execution ProcessID=”2176″ ThreadID=”1504″ />
    <Channel>Application</Channel>
    <Computer>SPWFEServer1.domain.com</Computer>
    <Security UserID=”S-1-5-21-1627688274-1190192956-3999157559-1626″ />
  </System>
  <EventData>
    <Data Name=”string0″>Microsoft.SharePoint.Administration.SPTimerRecycleJobDefinition</Data>
    <Data Name=”string1″>b88100e2-5681-4b05-929c-34926b8216a4</Data>
    <Data Name=”string2″>The timer service was not recycled because the following jobs were still 

running: Microsoft SharePoint Foundation Usage Data Import</Data>
  </EventData>
</Event>
Follow this article for the above error. 
Now after this work, make sure to review the Event Viewer log for any errors. Test the User Profile Service functionality by searching for the users and visiting the user profile pages.
Search and visit user’s Profile to Test the working of User Profile Service

Enjoy SharePoint!

Word Automation Services Vulnerability and Sharepoint Server

Tuesday, March 25th, 2014
There is a vulnerability in Microsoft Word that could allow remote execution. That security issue impacts:
1.       Microsoft Word 2003 to 2013
2.       MS Word Viewer
3.       Word Automation Services  in Sharepoint 2010 and 2013
4.       MS Office Web Server 2010 and 2013
The issue is mainly with the special RTF formatted data.

Risk Mitigation:
1.       Use non-admin rights on the local systems. That will lower the impact
2.       Disabling opening RTF on Word / Outlook
7.       In Sharepoint Server – Uncheck the RTF as the supported file format
 
 
Sharepoint Server – Work Automation Services:
Follow the steps below to disable the RTF file format within Word Automation Services on Sharepoint Server 2010 / 2013. Make sure to understand the impact of this change in your organization.
1.       Go to Sharepoint Central Administration website of your farm
2.       Under Application Management, click on ‘Manage Service Applications’
3.       Under ‘Supported File Formats’, uncheck the Rich Text Format (.rtf)
4.       Click OK to save settings
 
 
 
References:
1.       Vulnerability in Microsoft Word Could Allow Remote Code Execution – Microsoft Security Advisory (2953095)
2.       MS Knowledge Base
3.       CVE Page