Restore of Active Directory Group/Distribution List from AD backup on Windows Server 2008 R2 fails with the error "Unable to restore File Attributes Security or Directory Security information"

[Shashi_Shailaj]

Active Directory
=====================
Windows Server 2008 R2 SP1

Backup Exec 2010 R3
=====================
Version 13.0 Rev. 5024 (64-bit)
Administration Console. Version 13.0 Rev. 5204 (64-bit)
Desktop and Laptop Option Versin 3.1 Rev 3.46.06a

Please check the following Joblog.
=======================================================================================

Job ended: Thursday, September 22, 2011 at 6:40:40 PM
Completed status: Failed
Final error: 0xe000848e - Unable to restore File Attributes Security or Directory Security information.
Final error category: Security Errors

For additional information regarding this error refer to link V-79-57344-33934


Restore- \\WIN2008R2DC04\System?State \\WIN2008R2DC04\System?State

Access denied to file Active Directory\DC=Company\OU=India\OU=Distribution lists\OU=Kolkata\CN=DLKol002\member.
Error writing file data.

Access denied to file Active Directory\DC=Company\OU=India\OU=Distribution lists\OU=Kolkata\CN=DLKol002\sIDHistory.
Error writing file data.

=======================================================================================

When i try restoring the Distribution list with all the attributes selected i find that the job fails completely and the object is not restored. When the restore operation is run with member atribute unchecked we are able to get the DL/group back but member list deosnt get restored . And then if we just try to restore the member attribute only for that object it fails.

As per this article (http://www.symantec.com/docs/TECH135932) , this should not happen. However this does happen and we are unable to restore the members of the group or the group memberships of other objects.

The Sid history attribute for an object however does come back automatically when we uncheck it even though the restore job fails if we have sidhistory checked in the object restore option. But this is clearly explained in the article. ( http://www.symantec.com/docs/TECH55698 ) (This particular info is just FYI.)

The main issue is i am unable to get the group members in a distribution list if i restore them from backup. If its another group a secrity group or so i am able to get the member list back without an issue. The problem is only with DL. i.e distribution groups.


My question is

1) I want to be able to restore the members of the groups as well.
1) Do we have any fix for this in the form of patches or updates. (The article applies to old versions of the backup exec. )
2) Is this a RPoduct limitation from AD side or backup exec side..




Any help would be greatly appreciated. :)

[pkh]

1) Are you using a domain adminstrator to do the restore?

2) Are you restoring to the same DC that the object is backed up from?

3) Are you licenced for ADRA?

[Shashi_Shailaj]

Thanks for your reply . Its greatly appreaciated. 

Your answers.

1) Yes I am using the enterprise Administrator Credentials . And backup exec runs under the credentials of a service account. 

2) Yes the backup and restore opeations run on the same DC . We have backup exec also insstalled on the same DC . So everything is on one box only. 

3) Yes It shows that he product is licenced for ADRA .. But it was not installed. Primarily due to the reason  that we never required that and till a month ago we were on 2003 .. just migrated to 2008 R2 . I will run the restore  operation again. and then post the result. 

Do you have any insights right now. If any please post . I will post my results once i am done running another restore operation of any deleted DL. 

[pkh]

1) Is the AD backup that you are trying to restore done before or after installing ADRA?

2) Are you trying to restore an individual AD object or the entire AD?

3) Can you see the individual AD objects when you expand the system state of the DC?

[Shashi_Shailaj]

1) the AD backup was taken before installing ADRA

2) Yes An individual object .

3) Yes. The backup is fine .. i can see all the objects once i expand the system state. 

[pkh]

What is the AD object that you are trying to restore?

[Shashi_Shailaj]

It is a Distribution Group. I had mentioned it above. 

Sorry for late reply . Was out of town.