0xa0008488 error doing individual mailbox backups

[Brian_Kinzel]

We have a Windows NT machine as our Exchange Server (version 5.5) running BE 9.1

Every night, we run two backup jobs, one a full information Store backup (high level), and then a secondary individual mailbox backup. The first job runs fairly nicely with no problems, the time it takes is about an hour and 43 minutes.

The second job is where my problem is... I know it takes longer, and the current rate it's been taking about 7 hours.
It's been failing the last two nights.
"Final error category: Security Errors"

I get the 0xa0008488 error when the job fails. This is accompanied by Exceptions saying 2-4 mail messages are "in use - skipped" and it's these same messages that show up in the error report as having "Access Denied to file" They are in the same mailbox, but different e-mail message subjects. They look like valid e-mails, nothing "spammy" or corrupt about them.

My current thinking is that it's taking too long to backup the individual mailboxes and people are starting to come in and access their mailboxes while this is running, giving me these errors... Could this be correct?

Is this a matter of moving my backup window back to compensate for the long run time? I start at 0:00 and it runs up to 9 o'clock in the morning. (People start to roll in to the office at around 6:30)

[Brian_Kinzel]

Anyone have any kind of insight into this? Surely I can't be the only one?

[Brian_Kinzel]

I have a support contract with Veritas, but apparently I have to use these Forums to relay my questions. Can anyone help me out with this issue?

[Amruta_Purandar]

Hello,

Please refer the following technotes to troubleshoot this error.

Title:
Troubleshooting basic "access denied" and "access is denied" messages in Backup Exec 9.x and 10.0 for Windows Servers
http://support.veritas.com/docs/266075

Title:
The backup job log displays the error "Access Denied or could not be accessed" for some folders.
http://support.veritas.com/docs/261744


NOTE : If we do not receive your reply within two business days, this post would be marked assumed answered and would be moved to answered questions pool.

[Brian_Kinzel]

I have checked those technotes accordingly, and they do not fit with the problem I am having.

Some more history on this problem, on my Friday night/Saturday morning backup, it ran fine. Again, I attribute this to noone being in the office. However, I'd like to know for sure if this is the case.

This question remains unanswered.

[Brian_Kinzel]

This would be the third day in a row that this job has come back as "failed".

I'm only thankful that we're backing up the entire Information Store. I'll keep checking this thread. Anybody?

[Brian_Kinzel]

More information.

The account with which I use the mailbox backup is the Service Account Administrator, assigned at Site, Server, and Recipients levels. As far as permissions go, they look fine according to the troubleshooting articles above.

[Brett_Montgomer]

Brian,

From reading your statement, it was working before, correct?

Could anyone change the user account in Active directory? The reason is this, I had a new Admin come in and he started cleaning up domain accounts. He did not realize that the account that I used for backups, needed a mailbox to backup the other mailboxes. He deleted the exchange mailbox for that domain account and I could not backup the mailboxes until I went back in and corrected the issue.

If nothing has changed there, you can test your theory on Sunday if the users do not come in until later.

[Brian_Kinzel]

Thanks for the suggestion Brent, but we only use WinNT Authentication. No Active directory setup (yet).

However, in one post you've offered better info than what I've been able to get so far. Any other ideas?

[Brian_Kinzel]

Err I meant Brett.

Also, the backup ran fine on Friday night / Saturday morning, which we'll see if it's successfull again this coming weekend. I just don't want to wait until then to get a definitive answer.

[Brett_Montgomer]

Brian,

Sorry, I wish I had some additional suggestions. However, if you do find out that it is a time issue, maybe you change the backup job. Are you currently backing up to tape or disk? I was thinking you could break the job in two and backup to disk. Then after they complete, backup the previous jobs to tape and maybe that way your files would not be changing during the backup. I don't know if that would work, just trying to think of another route.

Good Luck
P.S. No issues with the name. I get called may things.... :o)

[Brian_Kinzel]

I am considering moving the backup jobs back a few hours, but I want to know what the issue could be so I can plan better in the future. If we can't get backups of stuff that's being accessed at the time in mailboxes, that's not too big a deal. I just want to understand why these errors are happening.

[Amruta_Purandar]

Hello,

Please verify if Backup Exec Service Account has been assigned the following rights:
- Authenticate as any user and gain access to resources under any user identity.
- Create a token object, which can then be used to access any local resources.
- Log on as a service.
- Administrative rights (provides complete and unrestricted rights to the computer).
- Backup operator rights (provides rights to restore files and directories).
- Manage auditing and security log.

Also verify if the logon account has the same rights.

- Confirm that the Backup Exec Service Account has "Service Account Admin" rights to the Exchange site.

- Ensure the mailbox is not hidden - The mailbox must be seen in the GAL (Global Address List). This can be tested by composing a new mail message in outlook and clicking the 'To:' field. Should you not see the display name in this list it is hidden.

- The Backup Exec service account's mailbox must be unique to the organization. No other mailbox can share the first 5 characters in common with this mailbox in the entire organization. This can be tested by composing a new mail message and then in 'To:' field type the first 5 characters of the mailbox display name, then press , this should resolve the name, if a menu pops up, then there are multiple accounts which share these first 5 characters. The matching names should be changed or the BESA mailbox name should be changed to something unique.

- The Backup Exec service account must have its own mailbox that has been tested with Outlook prior to configuring mailbox backups. If the mailbox has not had mail traffic, it can be flagged as "Inactive" by Exchange. This can be corrected by simply sending this account mail.

- When configuring mailbox backups, always log on as the Backup Exec service account.

- Some security rights can be tested with Outlook by going to File | Open | Other User's Folder and selecting another user's Inbox An error message indicates that security is not properly configured, and Backup Exec will not be able to backup the mailboxes.

- Stop and re-start the Backup Exec services after making any of the above changes.


NOTE : If we do not receive your reply within two business days, this post would be marked assumed answered and would be moved to answered questions pool.

[Brian_Kinzel]

I will double check the list above. Another valuable peice of information I will pass along is that the user whose mailbox I would get those errors with didn't come at the usual time, and the backup completed successfully. Although this could be an anomoly, I'd like to think it does lend some possible creedence to the theory that individual box backups DO NOT like people accessing them while their being worked on.

Again, it's just a theory.

[Shilpa_pawar_2]

Hi,

For test purpose try deactivating antivirus and test backup.

Additionally also refer the following documents:
http://support.veritas.com/docs/267437
http://seer.support.veritas.com/docs/255047.htm
http://support.veritas.com/docs/249456

NOTE : If we do not receive your reply within two business days, this post would be marked "assumed answered" and would be moved to "answered questions" pool.