BESA has correct privileges but BE support tool dispays "Not Set."

[KD10]

Using Backup Exec 2012

Problem:  Unable to run a restore.  Receive the error:  "The logon account that was provded is not a member of the Administrators group.  Verify that the data that you selected was backed up.  Additional privileges may be required to access the data on the Windows computer.."

Troubleshooting I performed:

• Ran the BE Support Tool to check service account credentials: The results:  Create Token Object = not set, Log on as a Batch Job = not set, and Log on as a Service = not set.
• Verified the following  BESA rights are correct under Local policy on media server, and in GPO:
•    -  Act as part of the os
•    -  Backup files and directories
•    -  Create a token object
•    -  Log on as a batch job
•    -  Log on as a service
•    -  Manage autiting and security log
•    -  Restore files and directories
•    -  Take ownership of files and other objects.

• Verified BESA is listed in AD Administratiors group.
• Added BESA to the local Administrators group.
• Ran  gpudate /force (even though I did not change a polcy setting).
• Verified under Services.msc that the following are running and assigned to the BESA:
•    - BE Device & Media Service
•    - BE Server Service
•    - BE Job Enginer
• Verified under Services.msc that the other BE services are running..

Any help is much appreciated.

[Donald_Eady]

You stated that when you ran the support tool that the rights logon as a batch and logon as a service were not given to the BESA.. did you make this correction and also you may want to verify that DENY logon as a batch and DENY logon as a service wasnt selected by mistake as this is a common error. 

Also under services.msc verify that all services are configured as per the chart in this technote

additionally what is it that youre trying to restore?

[pkh]

Create Token Object = not set, Log on as a Batch Job = not set, and Log on as a Service = not set.

You need to give these privileges to the BESA.  See these documents

Requirements for the Backup Exec Service Account (BESA).

How to define/grant the required user rights/permissions for a Backup Exec Service Account ( BESA )

[KD10]

Hi Donald & PKH,

Thanks for your responses.  Prior to my initial post I used the technotes you provided to confirm the privileges are set correctly in the GPO and local policy (both DENIES are not selected).  It was when I ran the support tool that the “not set” displayed for Create Token, Logon as Batch, and Log on as Service. 

Where I am confused is:

1. Why the support tool displays “not set” when the user privileges are correctly set in the policies?
2. Where do I make the change if the user privileges are correctly set in the policies?

I am trying to restore one user’s files from a particular subfolder on a file server.  However, when I couldn't perform this restore I tried test restores from other servers and received the same error msg listed in my original post.

Donald – I am unable to open your “this” technote link regarding services.msc.  I receive the error msg “IE cannot display the webpage.”  I checked the services again and they are running on the media server & are listed as follows:

• BE Agent Browser = BSEA
• BE Device & Media Service = BESA
• BE Error Recording Service = local system
• BE Job Engine = BESA
• BE Management Service = BESA
• BE Remote Agent = local system
• BE Server = BESA

Regards,

KD10

[KD10 · Accepted solution]

Hello,

Update….and closing this discussion thread.

Even though the BESA permission settings are correct, my inability to restore is a result of the permissions on a folder structure on the Win’2008 server where I am trying to place the files.  I couldn’t restore files from other servers because I was trying to restore the files to this same “problem” server. I incorrectly made the initial assumption the problem is with the “restore” function.

 The restore function works fine when restoring the files onto other servers (2003 and 2008).