Exchange 2003 & Backup Exec 11d: Access is Denied

[rsmccall]

The Exchange 2003 is running on Windows Server 2003 STD and Backup Exec 11d is running on Windows Server 2003 STD R2.  

I created a new logon domain account for Backup Exec and named it BackupExecAdmin which is unique in AD, not hidden in GAL and has an active mailbox.  It is a member of the following domain accounts:  Administrators, Domain Admins, Domain Users & Exchange Domain Servers.  BackupExecAdmin is also an Exchange Full Administrator and is also a member of the local administrators group.  

AOFO is enabled along with VSS.

My full backups backup Microsoft Exhange Mailboxes, First Storage Group and System State along with other data servers.  

Current Exhange options selected are:

Tools - Options

Backup
Information Store Backup Methond = Full...
Enable the restore of individual mail messages and folders from Information Store backups is checked
Enable legacy mailbox support is checked
Mailbox backup method = full...
Enable single instance backup for message attachments is checked
Backup up the information used to automatically recreate user accounts and mailboxes is checked

Restore
Microsoft Exchange 5.5
No loss restore is checked
Restore public folder is checked
Restore private messages is checked

When I go into a job's properties and go to Microsoft Exchange the following options are set:

Information store backup
Backup method: Full
Enable the restore of individual mail messages and folders from Information Store backups is checked
Perfrom consistency check...when using VSS snapshot provider is checked
Continue is consistency fails is checked

Mailbox Backups
Backup Method: Full
Enable single instance backup for message attachments is checked

Do I need to create a new backup solely for Exchange Mailboxes and the First Storage Group, and then system state can be backed up normally along with the other data servers?  Or is my current setup OK and just needs some tweeking?

Thanks for you input.

 

[DominikG]

says, that you should backup exchange ressources seperately from other ressources.
So split the job and try it again.

best regards

Dominik

[rsmccall]

Meaning all Exchange resources i.e. Mailboxes, First Storage Group and System State, or as I mentioned above seperate Mailboxes and First Storage Group on to another tape?  

Can you get me the link to the best practice page you're speaking of?

Thank you. 

[DominikG]

No, just don't backup other servers or volumes in the same job.


here is the link to the best practice for 11d and Exchange:

http://seer.entsupport.symantec.com/docs/285753.htm

Best Practice for Exchange Agent and 12.5
http://seer.entsupport.symantec.com/docs/311710.htm

and some more information:

How to protect Exchange 2000 and 2003 servers using the Backup Exec for Windows Servers Exchange Agent
http://seer.entsupport.symantec.com/docs/266074.htm

Backup strategies for Exchange
http://seer.entsupport.symantec.com/docs/299876.htm


best regards

Dominik

[rsmccall]

The info you provided is very helpful.  What I'll do is put in a new tape and have that tape setup for Exchange only and will backup the following:   System State, Mailboxes, Public Folders, Information Store, SQL server and Shadow Copy Components.  

Should I have AOFO enabled for the Exchange Backup?  

Do you have any other helpful tips that I should look at?

Currently the BackupExec for Windows Agent service is using the Local System account for the logon account.  Leave as is or change to the backupexecadmin domain account I created?

[DominikG]

You do not need to put it on a own tape, but if you wish...

More interesting: Why do you backup the SQL with it? You should not do that.

AOFO should be diabled, as it is not supported and also not needed and not used

You also could backup the system state and shadow copy components on a regular basis with the filesystem of the exchange, as you do not need them for restoring exchange elements, but for restoring the whole server.

Personal opinion: For restoring or securing the whole server I would recommend using a desaster recovery tool like Backup Exec System Recovery, because it can handle this much better than BE....BE is a data backup solution...
In the past I had so much problems restoring whole machines, that i would never ever again try to do that with a BE backup. IDR did not work very well, which is the reason, it is EOL and now chances of restoring a whole system from a BE backup are somewhere less than 10%...but thats my opinion. ;)

[rsmccall]

I apologize, I must have confused myself...happens often ;)  You're saying that I do not need to have a seperate backup tape for exchange but rather a seperate backup job?  I'm not sure if that's possible with my media set configurations.  I'd be forced to use a new tape.  At least I think...

Currently I have full backups that backup exchange data along with other data servers and exchange is set to be backed up first. 

I don't currently backup SQL, just threw that in there for no real reason.  I won't do it I promise ha!  

I disabled AOFO.  

I'll make the changes in Job Setup for all full backups to backup the Mailboxes, Public Folders and Information Store.  I'll keep the Exchange server at the top of the Selection list.  

[Ken_Putnam]

I'm not sure if that's possible with my media set configurations

You may indeed have to change the media set associated with one or more of your jobs, as you can only APPEND when the current media set matches the media set already on the backup media

Other than that, multiple jobs stacked on the same tape is no big deal

[rsmccall]

I wasn't aware this could be done.  It's something I never needed to try I guess.  I'll see if I can get this setup as you described and will hopefully have success.

Thank you. 

[rsmccall]

So i won't need to create new media sets?  Just change the properties to allow Append for so many  hours/days etc.?  

My current setup is this.  I have daily's that run everyday.  I have a full backup off-site job that runs every Tuesday (Off-Site Backups media set), a full backup weekly on Saturdays (Weekly Backups media set), and full backup monthly's on Fridays (Monthly Backups media set).  I will need to alter the append period for each of the media sets and then will need to create three new Exchange jobs and associate them to their respective media set correct?  Then schedule the exchange backups to run within the append period of each media set.  

Does that sound right?

[Ken_Putnam]

I may a little confused

Monday  -  Daily
Tues      -  Off-Site
Wed      -   Daily
Thurs    -   Daily
Fri          -   Monthly
Sat        -    Weekly

right?

You would only need to change the OPP for each media set to 12 hours or so (however long it takes the last job to start after the first job starts)

But you would need to create 4 different jobs and schedule them on the appropriate night, with all jobs (flat file, Exchange, System State, whatever) each pointed to that media set


if I understand what you are doing :)

[rsmccall]

Ken - my backup schedule is this:
M-Sat:  Daily backups at 9PM
Tues:   Off-site at 10PM
Last Fri of month:   Monthly at 10PM
Sat:   Weekly full 10PM 

Anyhow, last night my off-site was to run and since our Exchange server is set to run maintenance between 12AM - 4AM I had to change a few things.

1. I enabled the append pd to 12 hours for the off-site media set
2. I rescheduled the off-site jobs to run at 11:59 PM 
3. I created an "Exchange Off-Site Full Backup" job and scheduled it to run at 10 PM (it ended up taking nearly 6 1/2 hours)
3A. Exchange Off-Site Full Backup selections are Microsoft Exchange Mailboxes and First Storage Group

I checked this morning and the Exchange off-site full backup failed with Access is Denied.

[rsmccall]

my job logs won't open.  i fixed this yesterday and now it's doing it again.  i 'repaired' the msxml 6 parser and rebooted and they then opened. and now again today the logs won't open.......



aside from that, can anyone point out something that I could be missing that is causing my exchange backups to fail every single time???

[rsmccall]

This account, I believe, has sufficient privelages and is also an Exchange Full Administrator and a local admin on all servers.  I can open a Backup Job and browse through the Exchange Mailboxes without getting any access denied messages, and I tested the login's via the Resource Credentials tab in the Backup Job properties.  It passes for the server login, passes for the mailboxs login, and with first storage group it passes using the server credentials.  

[rsmccall]

Should I remove the selection for First Storage Group and run a full backup to see if it fails or not?  If it fails then its something to do with backing up the Mailboxes, or if it succeeds then it's something to do with backing up First Storage Group.  

Is that a reasonable troubleshooting step? 

[rsmccall]

In the Resource Order I moved First Storage group to the first position followed by Mailboxes. 

[rsmccall]

Error, Unable to open \\server\Microsoft Information Store\First Storage Group because it is currently being backed up by another process.

There were no other backups running and Exchange maintenance doesn't run until 12AM - 4AM and this backup started at 10PM.

Any suggestions?

[DominikG]

How long does the backup run?
When the backup job has not finished till the maintenance job starts, this can cause this error.
This definetly sounds like maintenance job and backup are running the same time.

[rsmccall]

I can't remember exactly how long it ran but it was done before 12am, before maintenance would have started.   

[rsmccall · Accepted solution]

Found that there was an NT backup scheduled to run daily but it never ran for the past several months.  My supervisor set it up and I had no idea.  Anyhow, I deleted that scheduled nt backup, uninstalled RAWS, rebooted, installed RAWS, ran a full backup of exchange last night and voila, it was successful!