Job failing b/c can't attach to resource & System State error

[ahazelwood]

Well, it's a new day which means I've got a NEW Backup Exec problem.  Oh goodie.

This job has been running fine but all of the sudden today I get this error (see snapshot) - and yes, the account has admin rights.  Any ideas?  (I've searched the site but haven't found any solutions regarding BE2012.)

[Backup_Exec1]

Hi Please check link below, http://www.symantec.com/docs/TECH147431 http://www.symantec.com/docs/TECH78329 Thanks

[ahazelwood]

Thanks, but those articles were not very helpful because I am so new to this - thanks though!

[Backup_Exec1]

Hi I am new to this , sure. Please let me know if you have followed the link and have found still makes no difference or you are not sure about the steps given in link. Asking this to be sure as you said, you are new to this. Is it are you backing up system state and it is failing and the server on which it is failing is it domain controller. Thanks

[pkh]

What has the first document got to do with the problem?  Don't just search for a document using the error corde and blindly posting it.  Make sure that it is relevant to the problem.

[pkh]

@ahazelwood - Is the problem machine a DC?  If so, your account needs to have domain admin privileges.

[ahazelwood]

Yes, it is a DC and yes it has domain admin priv.

[marcusolini]

Hi.  When able, can you please attach the entire Backup Exec job log to this post for the failing backup job for review.  Also, is the Backup Exec Media Server backing up a remote Domain Controller or is the Backup Exec Media Server the Domain Controller backing up itself?  Thank you.

[ahazelwood]

I am trying to backup a remote Domain Controller to a NAS.  If I remove the System State from the job, then the backup runs fine.  But if I try to run the System State backup on its own, it fails. I tried working with a Symantec rep but they don't know what's going on either.  Any ideas?  Sorry I'm a little worried about posting the job log details for all to see....should I be?

[marcusolini]

Hi.   For the initial information, you can save the job log as a text file and replace the Media Server name with ‘BESERVER’, the remote Domain Controller with ‘REMOTEDC’ and IP address with ‘BESERVERIP’ and ‘REMOTEDCIP’; respectively.  For the subsequent information that I will need, we can identify an alternate mechanism.   When you spoke to a Symantec Rep did you get an escalation or incident number?  If so, we might be able to use the Symantec support secure file transfer facilities.  By the way, from my experience others do post the information that I request directly to this forum; almost all are unaltered.  Please review my activity for examples.  Thank you.

[ahazelwood]

Thanks marcusolini.  Attached is the text file.  The case number I had with the Symantec rep was #419074540, if needed.  Consequentely, I set up another backup job with our other domain controller, and it too failed due to admin priv. issues.  That leaves me with 3 servers I am backing up which include the system state - these 3 are working but none of them are domain controllers.  Hope this makes sense.  Thanks for your help!

[marcusolini]

Hi.  Thank you for the requested information.  This clarifies that the System State backup is reporting that the Logon Account is being interpreted as not having administrator rights.  To proceed with the investigation a Backup Exec Remote Agent debug log is needed from the remote Domain Controller.  When able, please collect and submit the debug log and information from the remote Domain Controller to Symantec using procedures that you are already familiar with or using the below procedures.  Please let me know once the information has been submitted.  Thank you.

Collecting the Remote Agent debug logs by using the Backup Exec Debug Monitor on the remote Domain Controller…

(1) Enable the Backup Exec Debug Monitor by executing the SGMON.EXE process from within the Backup Exec Remote Agent installation directory.  Example: ‘C:\Program Files\Symantec\Backup Exec\RAWS\Sgmon.exe’.

(2) Select ‘Job Engine, RAWS, Agent Browser’ from the ‘Capture’ section (Alt-j).

(3) Select ‘Capture to file’ from the ‘Capture to file:’ section (Alt-u).

(4) Use the Backup Exec Media Server to run the backup job that is failing with error: ‘To back up or restore System State, administrator privileges are required.’

Submitting the debug log output by using the Symantec Gather Utility on the remote Domain Controller…

(5) Utilize the Symantec Gather Utility by executing the VXGATHER.EXE process from within the Backup Exec Remote Agent installation directory.  Example: ‘C:\Program Files\Symantec\Backup Exec\RAWS\VxGather.exe’

(6) Enter this specific case number ‘419-074-540-NIC-828’ (Alt-c).

(7) Run the Gather process (Alt-g) (Alt-y).

(8) Submit the gathered information ‘Send Results via FTP’ (Alt-f) (Alt-y).

[ahazelwood]

Hi marcusolini,

I submitted the info as requested above.  However, too much info might have gone through, b/c when I left yesterday the original job still hadn't completed, so I'm afraid info from the jobs that ran overnight might have been sent as well.  Thanks for your help!

[marcusolini]

Hi.  Unfortunately, the System State backup is not contained within the debug log, which implies that the System State backup did not run.  Only Utility Partition, E:, ,D:, and C: were present.  When able, please follow the same procedures and ensure that step (4) for the System State backup job runs and also results in the failure.  For step (6) use new case number ‘419-074-540-NIC-829’.   Please also confirm that the remote Domain Controller is also a Backup Exec Media Server.  In other words, the Backup Exec Media Server is backing up the remote Domain Controller which a different Backup Exec Media Server.  Thank you.

[ahazelwood]

OK, I just sent the info again.  The job failed for the following reason:  "Access is denied.  To back up or restore System State, administrator privileges are required."

Sorry I don't understand what you wrote above:  "Please also confirm that the remote Domain Controller is also a Backup Exec Media Server.  In other words, the Backup Exec Media Server is backing up the remote Domain Controller which a different Backup Exec Media Server."

[marcusolini · Accepted solution]

Hi.  Thank you for the requested information.   Based on this information I was able to pinpoint and confirm that the specific logic to ensure that a Domain Administrator account is being used when backing up System State Active Directory on a Windows 2003 Domain Controller is reporting that the account is not a Domain Administrator account.  So basically as expected.  With that said, I understand that the account being used is a Domain Administrator account.  So we have a few diagnostics that can be performed.  First, it would be prudent to empirically confirm that the account is what it says it is and once that is confirmed then a different credential syntax can be used for the Backup Exec Logon Account which may provide a solution.  When able, please follow the below procedures (9) to (19) or similar procedures that you are already familiar.  When complete, please report the outcome.  Thank you.

Execute a command prompt on the remote Domain Controller with the same Logon Account used by Backup Exec for the remote Domain Controller System State backup that is failing, either by..

(9) (a) Ctrl-Alt-Del - Logging into the system directly with the same Domain Administrator account and executing a command prompt    -OR-

(9) (b) C:\>RUNAS /USER:<domain-admin-account> CMD.EXE   - Executing from an existing command prompt that is not the same Domain Administrator account.  Example: RUNAS /USER:MyDomain.com\MyDomainAccount CMD.EXE

From the Domain Administrator command prompt determine if the Logon Account is reported as a Domain Administrator account…

(10) C:\>WHOAI /ALL

(11) Confirm that a ‘Domain Admins’ entry is reported for the Group Information\Name.  Example: ‘MyDomain.com\Domain Admins’

From the Backup Exec Media Server, modify the Backup Exec Logon Account that is being used for the remote Domain Controller System State backup to use the NETBIOS credential syntax instead of the DNS\FQDN credential syntax…

(12) Click the Backup Exec icon near the left top of application window (Alt-a).

(13) Click on ‘Configuration and Settings’.

(14) Click on ‘Logon Accounts’.

(15) Click on ‘Manage Logon Accounts’.

(16) Select the logon account.

(17) Edit the logon account (Alt-e).

(18) Modify the Account credentials ‘User name’ and ‘Account name’ to use the NETBIOS credential syntax.  The exact syntax can be seen from the command prompt in step (10) by executing ’SET USERD’.  USERDOMAIN reports the NETBIOS syntax and USERDNSDOMAIN reports the DNS\FQDN syntax.  Example: ‘MyDomain\MyDomainAccount’ NETBIOS syntax instead of ‘MyDomain.com\MyDomainAccount’ DNS\FQDN syntax.   

(19) Use the Backup Exec Media Server to run the backup job that is failing with error: ‘To back up or restore System State, administrator privileges are required.’

[ahazelwood]

Well you are officially my new HERO!!!!!  Thanks so much!!!!!!!!!!!!!!!!  Finally, a resolution!  :)  Changing to the Net Bios syntax did the trick.  God bless and have a great weekend!  :)

[marcusolini]

Great news! Thank you for your patience and help during the investigation.  All the best!