Active Directory System State access denied since SP3

[Deatheye]

hi

We got the same error from : http://seer.entsupport.symantec.com/docs/328487.htm

Now we never installed that patch or uninstalled it again. It always caused us this problem. Now it looks like since installing SP3 this behaviour is back in a more annyoing form. Not sure about it right now. Hopping to find people with the same problem.
Since I installed SP3 on two media Servers they sporadically spit out this error again only on system state from Domain Controllers. Now this is wierd. It's not allways, at least on one Media server. On the second one I just installed the patch yesterday and since then it always failed with this error.

Anyone having the same error since SP3 installation?
I thought about updating the remote agent on the systems. But that actually doesn't make any sense since one of the media server itself is the Active Directory. So at least there an Update isn't even possible.

[Deatheye]

Ok seeing all that other poeple with the same or similliar errors happening I checked the systems again. Looks like it could be the hotfixes and not the actual SP3. Still wierd since it doesn't seem to happen always just most of the time.
Will check the other contributions. for possible solutions. Allready checked some which helped others but we allready had that settings active. Hopping to find other solutions.

[Deatheye]

We uninstalled all hotfixes, we are now on version 12.5 SP3, bug still remains. So it looks like
So I wonder if SP3 is the cause after all. Someone knows if http://seer.entsupport.symantec.com/docs/328487.htm  still causes that problem?!
Since we don't use any tape based backups I can't test if the problem would disappear backing up on tapes.
The KB still doesn't point to any  solution. besides uninstalling the hotfix, which means uninstalling SP3. 
No one else got that Problem back with SP3 or has a solution?

[CraigV]

Have you looked into maybe reinstalling the SP?

[Colin_Weaver]

One of our recent hotfixes corrects an issue on Domain Controllers where the System State Backup did not include NTDS.DIT - but crucially did not error if the accounts being used did not have enough permissions.

We now generate an error to warn you that you need to sort out your permissions - prior to this you had no warning that you were not correctly protecting your Active Directory.

Issue is covered here
http://entsupport.symantec.com/docs/306550

[Deatheye]

I allready looked into that. The backup user is member of the domain admins. I can see and select the active directory components inside backup exec. Also sometimes the backup finsihes without an error, sometimes I get access denied.
I first also thought that it's cause of that update but I even deinstalled it to be sure. Now we are back to 12.5 SP3 without any aditional Hotfixes and the error still appears. As I meantened above it behave exactly like it did for us with an older hotfix which we never could install since it caused problems with backing up DCs System state: http://seer.entsupport.symantec.com/docs/328487.htm 
Sadly there is still no update inside that article and the hotfix is included in SP3.
Propably today I will deinstall SP3 too and check if that hotfix also needs to be removed.


EDIT: Ok nice, just notice that that KB finally got an update about an other hotfix which should correct the issue it caused us. Well nice wasn't included last time I checked the contend. Now I need to go trough the hole case inside our own case system and check the situation again.

Will post updates again.

[Deatheye]

Ok so there is the chance back, that we got the error from SP3 which includes hotfix 324011. Which we never could install cause of an system stat access denied error. --> http://seer.entsupport.symantec.com/docs/328487.htm
Now yesterday that articel finally got updated with an solution, hotfix 337202

So let's start reverting all the changes I made the last days and hope it finally is gone.

Any technical information what that hotfix actually made wrong? Or why it caused that error for some and not for all and even not all the time?

[Deatheye]

I installed hotfix 337202 on the two BEWS Server that got the problem.
On the first one I made  two backups of system state, it worked.
On the second  one I just started the backup.

Since the error didn't happen all the time it's still not sure if this really fixed it. But checking the hystory there actually never where two backups after each other running fine since SP3, so the chance are good.

If this really fixed it http://seer.entsupport.symantec.com/docs/328487.htm needs an update. All the DCs that got the error are 2008 Servers, not 2003 R2 which are the only one listed in that Articel.

[Deatheye · Accepted solution]

Ok looks fine now. Both server with this problems had 2 or 3 jobs with systemstate from 2008 AD since I applied Backup Exec 12.5 for Windows Servers revision 2213 Hotfix 337202 http://seer.entsupport.symantec.com/docs/337202.htm