Backup Exec 12 - Job Failed with Error Code E0008488

[IAComputing]

This is a fault I have seen on several server setups and we're now getting desperate for an answer that works.

Setup:
Windows Server 2003 Servers, up to date with patches, in a single domain on a flat IP network.
Backup Exec 12 (rev 1364) installed on server named Server1
Exchange 2007 (up to date) installed on server named ADMIN
Backup device is a multi-tape loader.

Backup Exec 12 is failing the backup jobs with the following errors:

Job ended: 30 September 2009 at 12:44:05
Completed status: Failed
Final error: 0xe0008488 - Access is denied.
Final error category: Security Errors

For additional information regarding this error refer to link V-79-57344-33928

-----

In the error log it states:

Backup- \\ADMIN\Microsoft Information Store\First Storage Group V-79-57344-33928 - Access Denied. Cannot backup directory .Mailbox Database and its subdirectories.
Backup- \\ADMIN\Microsoft Information Store\Second Storage Group V-79-57344-33928 - Access Denied. Cannot backup directory .Public Folder Database and its subdirectories.

------

Key Information:

1. In Backup Exec GRT is enabled.  This is the apparent cause of the problem, but it needs to be enabled to allow individual mailbox recovery.  A backup job without GRT enabled works.

2. A backup job of just the mailbox stores will seem to be backing up all of the data, but then fail at the last moment with the above error.

The following actions have already been taken, with no success:

1. Recreating a brand new, unique, account for the backup services to run. There is at least one email in the inbox of the new account and it is not hidden from mailing lists.

2. Everything in the Symantec post: http://seer.entsupport.symantec.com/docs/289649.htm has been checked and rechecked and checked a third time.

3. Everything in the relevant posts under this page: http://seer.entsupport.symantec.com/docs/305383.htm have been done.

4. Everything in this post has also been checked:  http://seer.entsupport.symantec.com/docs/288777.htm

Note: This link: http://seer.entsupport.symantec.com/docs/272652.htm has not helped at all.

We know that the problem is directly GRT related.  There are no disconnected mailboxes on the servers either.  There is either something wrong with permissioning for the backup exec account, despite having followed the instructions to the letter, or there is something wrong with Exchange 2007, or Backup Exec 12 just doesn't work.

We have installed the management tools on the Backup Exec server - it didn't make a difference.

I logged into the GRT mailbox and tested email both going out and coming in, just to make sure the account had an email in the inbox.

I have noticed that if I log into a PC as the backupexec system account and try to add the Outlook profile for a domain user using the backup exec account credentials the credentials fail.  The backup exec account has been given the Exchange Server Administrator role and is a Domain Administrator.

I've checked the credentials.  I never create a backup job without doing so.  Just in case, I went back and retested and everything passed ok.

I've created an entirely new selection list and backup job with just the information stores and I get exactly the same result.

I also added Organisation Administrator to the backupexec account as well just in case and that didn't make any difference.

I've added permission for the backupexec account to have Full Access Permissions to every mailbox with no success.

Can anyone please shed some light on what is wrong.  This isn't an isolated incident, we have several sites with exactly the same problem, but every site has been set up by different people, who have checked and rechecked every bit of documentation we can find.

[RahulG]

Enable legacy mailbox support from tool | options | Ms Exchange
created the following registry keyLocation : HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Backup Exec For Windows\Backup Exec\Engine\ESE

Create Dword:  E2K7_MBOX and set the value to 1
Go to new backup selection and see if you are able to expand the individual mailboxes in the backup selection . If you are not able to expand the mailboxes it might be some issue with the rights and permission ,if you are able to do so delete the registry key and try running the backup again . As i have observer after that creating the registry ,browsing the legacy mailbox selection and deleting the registry key again and then attempting to run backup resolves the issue . i m not sure what excatly happens but have seen issue getting resolved in more than 10 cases

[IAComputing]

Thankyou.  This is getting somewhere...

I wasn't sure if I should add the registry key to the server where Backup Exec is based or on the Exchange server with the remote agent installed.  I did both for the moment, but would like some clarification if possible, please.

I've added the registry key and restarted the Backup Exec services.

When attempting to expand the mailboxes I received a message:

---

Failed to access Microsoft Exchange Mailboxes
Logon account: backupexec
Access is denied.

Please select a logon account from the list: etc etc.

---

I set up the account exactly as per Symantec's instructions.  Is there a particular permission I should be giving that isn't in the instructions?

[RahulG]

The registry key just need to be created on the exchange server , the accound which you are using shoud have the following permissions
-member of domain admin/ admin group
-has to be a unique account (1st 5 characted should not match with any other account)
-not hidden from GAL
-Should have the send as and recive as rights ( check if any deny permission set )
-if you are have exchange 2003 as well ...need to make sure the mailbox for the account is on exchange 2007
you can enable debug on the exhange server --- stop the backup exec service and type -debug in the startup type and start the service
-------

[IAComputing]

When you say the account should have Send As and Receive As rights, do you mean I should add permissions to every single mailbox for the backupexec account to be able to send and receive as the users?  I've already added Full Access permissions to every mailbox.

The account is a domain admin, unique, not hidden and the registry key has been entered, and the Backup Exec agent restarted.

Exchange 2003 is not on the domain.

It still has the same error.

[Patthi]

Hi I am Pradeep, I searched a lot for the E0008488 error. I have an exchange server 2007 where the storage groups are in SAN (Dell Equallogic PS 6000). When I try to take backup of database from SAN Box it gives me the error 0xe0008488 Access is denied.
My SAN Box has exchange 2007 compatability.
I tried to do the backup wihtout using GRT Technology,  the job is successful without any errors.
Is there any solution for this? because i use the domain admin account for all the servers even for the media server from where i take backup.
Previously i use to take backup of exchange server 2007 database from the local disk of Exchange Server, but as the size increases we moved the database to SAN Box. From then i could n't take Backup with GRT technology.

I would be thankful if u give me the solution for this.

[Dev_T]

Hello,

This is definitely a Credential issue. Make sure that the Backup Exec Service Account has the following settings:
1  : Member of the Domain Admin Group and Member of the Local Admin Group if Exchange is a Member Server.
2  : Mailbox Enabled account NOT hidden from the Global Address List
Send an E-mail to the account and open it in OWA to activate the Mailbox
3  : Unique Account (1st five letters)
4  : Exchange FULL Administrator.

If Backup Exec is installed on a 32-bit Server, make sure that the Exchange 32-bit Management Client is installed on the Backup Exec Server.

Restart Backup Exec Services and the remote agent service on the Exchange server.
As you have already created the E2k3_mbox key, now try to expand individual Mailbox.

Hope this helps...

[Patthi]

 Hi Dev

I am taking backup and restoring of ex 2007 databases from past 2 years. I am not having this issue since when i started taking backup of databases from SAN. 

I ll explain it clearly,
We have deployed Ex_2007 Server in 2007, after that i started taking backup's using symantec 11d BEWS, after one year we upgraded it to 12.0.
I login to Media server using domain administrator account. Usually my ex server has small databases which were in local disk as it grown to heavy size we installed SAN Box DELL Equallogic PS 6000 in our environment. I initiated a LUN in SAN Box for exchange server and initiated it. I configured logical disk where i changed the database path of Ex_2007 from local disk. I restarted the Ex_server, no issues in initiating the Logical disk and the database is in mounted state only. When i try to take backup of the database which is in logical disk of SAN Box it gives me the above error. I tried to take backup without GRT Technology there was no error, but it is of no use as i couldn't  see individual mailboxes. 

One more thing My San Box is Radius Protocol enabled so it is in domain administrator group, It means no credentials issue for the database of ex_2007.

I have done the things what you asked me to do very long back.

Give me a correct solution.