After 8/9/05 updates from MS, Job Engine won't start

[David_Crook]

After installing Microsoft critical updates from Aug 9th, the BE Job Engine service would not start unless the logon account is a member of the domain admins group. Initially appeard to be a DCOM issue but after correcting this, the Job Engine will start and run until a backup starts. Then the job engine will fail. BE 9.1 is on a Domain Controller.

[Shilpa_pawar_2]

Hi,

Please note that backup exec service account should be member of Administrators and Domain Admin groups.

What error are you getting backup job log?

Are there any errors logged in event log?

Also check if this error occurs only during a particular job (remote or local) or any backup job?

Try running repair of backup exec database:
http://seer.support.veritas.com/docs/265180.htm


Additional Information :
For information on the recent VERITAS Backup Exec security vulnerabilities, including links to the downloads for the necessary hotfixes, please refer to the following document:
Patch summary for Security Advisories VX05-001, VX05-002, VX05-003, VX05-005, VX05-006, VX05-007
http://seer.support.veritas.com/docs/277429.htm



http://support.veritas.com/docs/278434




NOTE : If we do not receive your reply within two business days, this post would be marked "assumed answered" and would be moved to "answered questions" pool.

[David_Crook]

Per our auditors interpretation of the Sarbanes-Oxley laws, we've be requested to "minimize" the number of accounts with “domain admin” privileges. Prior to the updates from MS, this account was working with only "backup operator" privileges with out errors or Job failures.

We have since discovered it will work if you add "server operator" privileges to the account. The system is a Windows Server 2003 "Domain Controller". Will look at moving BackupExec to a different server in the future.

There were no "errors" in the Job log because the Jobs wouldn't run with out the engine.

Event log showed generic "access denied" error when you try to start the Job engine.

Thanks for your response.

[Joshua_Small]

Vendors and auditors will always be at odds over this, because vendors always want Administrative permissions (even on silly applications that don't require it) and auditors will recommend otherwise. Veritas is one of the few applications where Administrative permissions are generally justified.

Microsoft locked things down in their last patch, and made many of these sort of restrictions apply. Congratulations on finding a work around.