6641 and 6482 errors ...

Overview
For starters, you should not have any local Administrators running a service or application pool for SharePoint 2007. As tempting as it may be to resolve errors by simply adding them to the Administrators group, it is simply not necessary.

Issue
When you start to back out/restrict permissions after installation/configuration ... you will most likely start to see a number of errors popping up (6641 and 6482). They are permissions related.

Event Type: Error
Event Source: Office SharePoint Server
Event Category: Office Server Shared Services
Event ID: 6641
Date: 12/15/2007
Time: 2:00:00 AM
User: N/A
Computer: COMPUTERNAME
Description:
The SSP Timer Job User Profile Change Job was not run.

Reason: Logon failure: the user has not been granted the requested logon type at this computer


Solution
For each of these steps I recommend restarting IIS and affected services ... or if you can (to eliminate any doubts) ... reboot the server.

Step 1 - Check to make sure your service accounts have "Log on as a Service" permissions.

• Go to Start > run > gpedit.msc ... to pull up group policies (shown right).
  
  
• Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignments
  
  
• Double click "Log on as service" and check to see if your service accounts are listed under the "Local Security Setting" tab
  
  
• If they are not there they will need to be added
  
  
• Double click "Log on as a batch job" and check to see if your service accounts are listed under the "Local Security Setting" tab
  
  
• If they are not there they will need to be added
  
  
• If you have updated your policies you will at least need to run gpupdate/force from the command line.

Step 2 - Add the service accounts to the Backup Operators local group.

• The Backup Operators have a few more policy permissions that can tackle some of those pesky errors.

Step 3 - Add the service accounts to the WSS_WPG group.

• There are a number of posts out there that tell you to go into component services and manually add the service accounts to IIS WAMREG or SPSEARCH. DO NOT add them individually. SharePoint has already populated the WSS_WPG group to these DCOM applications.

Worst case, you will need to add more permissions for the WSS_WPG group via component services (explained below):

1. Start > Programs > Admin Tools > Component Services
   
   
2. Computers > My Computer > DCOM Config > IIS WAMREG (and SPSearch)
   
   
3. Right click > Properties > Security tab
   
   
4. Under Launch and Activation Permissions click Edit
   
   
5. Check the checkbox for Remote Launch and Remote Activation
   
   
6. Click OK