Active Directory, System State, subdomain, Access denied

[HelliR]

Hi,

both with 12.5 and 2010 I cannot backup the system state due to an "Access Denied" error:

Error category : Security Errors
Error : e000fe7d - Access is denied.
To back up or restore System State, administrator privileges are required.
For additional information regarding this error refer to link V-79-57344-65149

- The System Backup Account is the enterprise admin account.
- The Agent runs as Local System.
- I added the Enterprise Admin Account to the group "Backup Operators" on the subdomain.

Nothing helped. Any Ideas?

Thanks, Helmut

[tech29]

are you able to backup the system state with NT backup?

[HelliR]

NTBackup and Windows Server Backup is all what's left for 4 weeks now. :) Yes, they work fine logged in with the Enterprise Admin Account.

[Dev_T]

Hello,

Add the Enterprise Admin Account to the group "Domain Admin" on the subdomain.

Hope this helps...

[HelliR]

Sorry, but you can't. Domain Admins is a global security group, enterprise admins a universal security group. Read on here: http://technet.microsoft.com/en-us/library/cc755692%28WS.10%29.aspx

I could add Enterprise Domain Admins to the builtin/administrators group but this is of course default. I also tried to add the specific enterprise admin account to the builtin/administrators group but that didn't work either.

Needless to say that this worked until 2months ago for many years. I DO HAVE admin permissions on the target machine. Backup Exec on one hand confirms that when I run the tests at Resource Credentials and on the other hand it completely ignores that.

[HelliR]

I meanwhile tried with the subdomain admin, no luck either.

[CHUser]

I have the same issue, Symantec Support also went through and did the Security setup check, and still no resolution. It is REALLY annoying that the test says you have security access, but running the backup says you can't. Lets get a resolution here, Symantec!!

(BE 2010 upgraded this month)

[JT_T]

Are you backing up Windows 2008 Domain Controllers? If so, you need to allow "Logon as batch job" rights for your backup user account.

Go to your group policy management, select "Default Domain controllers policy", edit. From there, go to "Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment" and find "Allow logon as batch job" or something like that. Add your backup user there, no matter are you using Domain Admin and so on, you need to do that.