Can't backup system state

Ok, next question...

One of our servers, that happens to be a backup domain controller, we're using to run test backups with the trial version of 2010. The system logon account (which is same as system account right now) being used to backup this dc is a member of the domain admin group which in turn is a member of the administrators group. We have even tried with another domain admin account and get same results. Have followed the error link and tried solutions but no luck...

...and we keep getting following errors on the test jobs:

Error category    : Security Errors
Error             : e000fe7d - Access is denied.
To back up or restore System State, administrator privileges are required.

For additional information regarding this error refer to link V-79-57344-65149

We have also turned on AOFO (thanks pkh).

Thanks for helping,

Klingonwork32

1 Solution

Accepted Solutions
Accepted Solution!

Domain controller Policy blocks the system state backup

Klingonwork,

As you must be aware a Domain controller has 2 kind of policy stored

1> Domain Policy

2> Domain Controller`s Policy 

The above is true for both 2003 and 2008 version of Microsoft Windows Server

Considering you case you have a Win2003 DC that you are backing up, you might want to try this

Navigate to the domain controllers policy (not domain policy)

Navigate to Security Settings >Local Policies and the User right assignment look for these rights and add the domain admin account that you are using to backup the system state of the 2003 DC

 

  • Authenticate as any user and gain access to resources under any user identity OR Act as a part of Operating System 
  • Logon as a batch job
  • Create a token object, which can then be used to access any local resources
  • Log on as a service
  • Administrative rights (provides complete and unrestricted rights to the computer)
  • Backup operator rights (provides rights to restore files and directories)
  • Manage auditing and security log

From the command prompt of the 2003 DC run > Gpudate/force <hit enter> command, run the same command on the Backup exec server too

If it still fails to backup 

Repeat the same steps with Domain Policies (Not the domain controller policy this time as its already done) 

 

Restart all the backup exec services

Run the backup.

 

 

13 Replies

Hi   Is this the DC on

Hi

 

Is this the DC on win2003 or win2008 also have you tried doing backup of system state using Ntbakup & see if that has worked or on win2008 using windows server  bakup tool

 

Thank You

Have you configued the BESA

Have you configued the BESA as "Domain\Administrator"

Good question

Trial BE 2010 on 2008R2 HP Proliant backing up a Win 2003 box. NTBackup working fine.

Klingonwork32

BESA

Hi Amol,

If BESA = Backup Exec System Logon Account then yes, that user is a domain admin. Also, I forgot to mention this is Win 2008R2 trying to backup the dc on a Win 2003 box. Don't know if that makes a difference...

Klingonwork32

Hi there.   Is the domain

Hi there.

 

Is the domain controller using win server 2008 . if yes follow the document & provide the privilege to the system logon account

http://www.symantec.com/docs/TECH74365

 

You can try this if its not win 2008

 

Go to active directory , open the properties of system log on account , go to member of tab & make sure domain admins is added . If yes highlight domain admins & select "set as primary "

Run the backups & update the results

BE on 2008R2

No, dc not on 2008 but the BE test box is, going to dc on a Win 2003 box. NTBackup OK.

Klingonwork32

  You can try this if its not

 

You can try this if its not win 2008

 

Go to active directory , open the properties of system log on account , go to member of tab & make sure domain admins is added . If yes highlight domain admins & select "set as primary "

Run the backups & update the results

Primary groups

Thanks for helping...my understanding though is doing that is for mac/unix clients, so setting domain admins as the primary group for that user would have what benefit? This dc (win 2003) is a test box and I understand replication goes on with only changes made, but changing this would BE agents expect to see the logon account as "domain user" thus failing? Perhaps I am answering my own question (just thinking out loud), and it doesn't matter since it's failing the backup anyway at system state.

Klingonwork32 

Hello   You can give a try to

Hello

 

You can give a try to the above suggestion & see if it helps .....

 

Go to \program files\symantec\backup exec\ & check the properties of the beremote.exe . Click on details tab & tell me the version number

 

 

Also 

 

Verify the following rights

http://www.symantec.com/docs/HOWTO22647

 

 

Run live update on the media server if its not up-to-date & then update the remote agent on the DC. 

BEremote

File version: 13.0.4164.0

Product version: 13.0.4164

 

and thanks for the link...reading.

Klingonwork32

Highlighted

Any update ?

Any update ?

Accepted Solution!

Domain controller Policy blocks the system state backup

Klingonwork,

As you must be aware a Domain controller has 2 kind of policy stored

1> Domain Policy

2> Domain Controller`s Policy 

The above is true for both 2003 and 2008 version of Microsoft Windows Server

Considering you case you have a Win2003 DC that you are backing up, you might want to try this

Navigate to the domain controllers policy (not domain policy)

Navigate to Security Settings >Local Policies and the User right assignment look for these rights and add the domain admin account that you are using to backup the system state of the 2003 DC

 

  • Authenticate as any user and gain access to resources under any user identity OR Act as a part of Operating System 
  • Logon as a batch job
  • Create a token object, which can then be used to access any local resources
  • Log on as a service
  • Administrative rights (provides complete and unrestricted rights to the computer)
  • Backup operator rights (provides rights to restore files and directories)
  • Manage auditing and security log

From the command prompt of the 2003 DC run > Gpudate/force <hit enter> command, run the same command on the Backup exec server too

If it still fails to backup 

Repeat the same steps with Domain Policies (Not the domain controller policy this time as its already done) 

 

Restart all the backup exec services

Run the backup.

 

 

Thanks Kenny!! forgive the

Thanks Kenny!!

forgive the late reply, but working OK now....