Active Directory B2D with GRT fails with "Access denied" error

[Netics]

Hi everyone!
Our company has Backup Exec Server 12.5 installed on Windows Server 2003 x32. Licenses for Active Directory Recovery Agent are installed.
Active directory in installed on 2 domain controllers with Windows Server 2008 x32 and working in 2008 native mode.
We are doing 2 backups of AD with GRT enabled: 1st is B2D ( Full and incremental with reset archive bit) and 2nd is backup to LTO ( daily Copy Backup with GRT). They are both worked properly till the previos week. Previous week we have removed last Exchange 2003 from organization and now there is only Exchange 2007 servers in organization.

Now 1st (B2D backup) fails with Access Denied Error:

Backup- \\dc1.domain.name\System?State V-79-57344-33928 - Access Denied. Cannot backup directory and its subdirectories.
Backup- \\dc2.domain.name\System?State V-79-57344-33928 - Access Denied. Cannot backup directory and its subdirectories.

and backup to tape is working properly without any errors.

I have created a new test B2D job with GRT disabled and it doesn't fail. But when I enable GRT it fails.
So, I have a question: how can I resolve this issue.

Best regards,
Alex.

[Drinkingbird]

Yes that's what I've been doing for a week now, but it requires manually running liveupdate, usually I just let the virus defs run updates every hour or so.  You also have to disable automatic updates in SEP client which I have running on the server also.

[JRV]

Wow...I didn't realize that. Beginning to sound like running SEPM and BEWS on the same server is not a good plan.

[Drinkingbird]

At least on mine, everytime SEP runs a liveupdate (automatic or manual) it also updates BEWS, so for now I've got it set to not run automatically and to run interactive mode and am updating it by hand 1-2x per day.  I believe there is a way to de-register BEWS from liveupdate but then you can't even manually update it unless you look through the website and find patches when they come out.  Though with the issues I've had with patches for BEWS, might not be a bad thing.

[JRV]

According to this--

http://seer.entsupport.symantec.com/docs/319567.htm

--the -OptOut switch should prevent this, and this is supposedly the BEWS default during Setup. But I have to confess I've always just had blind faith in the article and never tested it, so I don't know if it's true.

Now that I think about it, though, you may be right...I don't remember getting any e-mail notifications from BEWS regarding BEWS updates, only installed ones, despite my setting it to manual in the BEWS UI. Maybe Symantec has never tested it, either!

OTOH, BEWS LU is broken by SEPM upgrade installations frequently, so I probably don't really know how BEWS LU is set, most of the time. Maybe while LU in the BEWS GUI is broken, LU in SEPM is quietly updating BEWS. I probably should get in the habit of rerunning BEUpdateOps.exe whenever I upgrade SEPM.

[Drinkingbird]

Yup the updateops removes it from SEP (I only have client on this server, not SEPM) and makes it start working via BEWS again.  Like a year ago, the BEWS liveupdate kept dying and saying "no products installed" even if you did updateops, it would die again shortly, so I had to add it to SEP using OPTIN.  But at this point, I don't want it downloading updates anyway so whatever.  Looks like updateops just does an optout for BEWS from one liveupdate and adds it to the other.

From what I can see, if you run a liveupdate from SEP or SEPM you shouldn't see BEWS listed, and if you run one from BEWS, you should only see BEWS listed....

I'll turn my SEP back to automatic and BEWS to prompt (or just disable it) and see if the patch stays uninstalled.

Joy

[yll]

I doing a backup job from server A straight store the data to server B's hard disk, but try many times also fail. Anyone know why the media set(B2D) going to offline? Below is the error msg and also try search solution from symantec, but can't work.

 Media Check
Online media check : Insufficient online or nearline media is available to start job.Overwrite media check: There is no media online or nearline that can be overwritten or the job has been marked append/terminate.Media check status : Failed

can somebody help me?

[JRV]

I suggest starting a new thread for your issue. It is different than the issue discussed here, and will be more visible to others and more likely to be solved if it's in its own thread.

[JRV]

Hehe, it just keeps getting better.

I forwarded the URL of this thread and of the KB article, added the quote about contacting sales if we feel it deserves a fix, and a brief description of why I felt the issue needed fixing, all to Symantec sales. Here is their reply:

"Thank you for your interest in Symantec. I understand you are upset about something to do with Backup Exec, however I am unsure exactly what your issue is. I recommend your client speak with technical support if this is a technical issue. If they are unable to provide a suitable solution, please ask that they escalate your case so that more engineers kind troubleshoot a solution. You can reach technical support at 800-342-0652."

Catch-22

[Drinkingbird]

I guess I'll try posting this a second time.  The forum works almost as well as the product it supports!

I had BEWS now set to "alert me of new updates but do not download or install".  Last night, at the time I have it set to check, every sunday night, it downloaded and installed the hotfix again!  Then of course it de-registered itself from liveupdate.

So this morning I uninstalled the hotfix yet again, and it immediately reinstalled itself!  Pretty impressive when it is set to only check on Sunday night and liveupdate doesn't even see BEWS installed!

Ran the updateops again and totally disabled updates in BEWS.  Lets hope that stops it from installing.

Really frustrating for enterprise software from a giant company.  At least it isn't bluescreening my server like one of the updates last year.  But I really don't understand why liveupdate can't just work right, and why a patch that has caused a problem for many people isn't immediately removed from liveupdate and fixed.

[Gene_Tang]

Has anyone installed BE 12.5 SP3 (released yesterday) and had any success with it in solving the Access Denied Errors as above? SP3 has Hotfix 324011 installed as part of the package, and given Symantec's official word for the fix is:

1) Remove the hotfix
2) Redesign your backup system to backup directly to tape

This poses a problem since I'm currently using recommendation 1: removing the hotfix.  I can't use option 2 because we don't use tapes.  Hard Disks are so much cheaper and versatile than tapes these days.

This problem is a huge oversight on Symantec's part, and somehow it doesn't surprise me they've done this.

[vITv]

> Has anyone installed BE 12.5 SP3 (released yesterday) and had any success with it in
> solving the Access Denied Errors as above?

Unfortuately I installed the update yesterday, should have known better.  It didn't solve the issue, it created it.

Same situation here, whe don't use tapes, only disks and I don't feel like removing SP3 altogether, given the quality track record of Symantec, it'll probably crash the server rather then fix the problem.

I guess it's better to laugh about the situation then cry, after reading the above posts I still wonder why this issue is still unresolved and why this hotfix was ever included in SP3.  Anyway, I guess that Symantec takes pleasure in being insulted and loosing customers. 

This package was very good under Veritas, and it became bloated and inefficient under Symantec, guess it's time to look at other solutions such as Acronis.

[Remo_Rueedi]

Hi all

I have the same story like all people here.
Uninstalling the fix has solved the problem. But now is sp3 out... and this Hotfix 324011 is included there.
What happend to me? The grt-backup of my active directory is crashing with the same error.
i think it can't be the right way to uninstall sp3 now... but what should I do? I need an operating backup immediately!

Please Symantec, give me a way or workarround to solve this problem...

[Netics]

So, Symantec not fixed this problem for a half a year.
We are afraid of installing SP3 on production server because it includes Hotfix 324011.

[Nick_Perry · Accepted solution]

I see the support doc about this issue says Hotfix 337202 solves the provlem. It's a post-SP3 hotfix.

Has anyone tried it successfully ot otherwise?

[Nick_Perry]

For the record, SP 3 with the hotfix works OK.