System State and Shadow Copy Components with Backup Operator rights

[DHR_VAN_LEEUWEN]

Hi,

I'm trying to make a service account for BackupExec to backup other servers in one single domain with. I've read the admin guide and applied all the rights described there. For the most part the backup works untill it has to backup the system state or the Shadow Copy components. As soon as it wants to envoke VSS it fails.

The event logs shows this: The COM+ Event System failed to fire the RequestWriterInfo method on subscription {E2028BE2-4C39-4DE9-9F90-197310645384}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}.  The subscriber returned HRESULT 80070005.

I've searched the web and found that 80070005 is an access rights issue. I've also seen some forum posts from Veritas describing this problem. It had a userbased workaround to make the service account either power user or administrator. But a real solution was never provided.

It seems to me the service account is trying to initialize the VSS to see what is available for the VSS writers, but it can't. Consequently it can't continue the backup.

Now I've used group policies to make this service account member of the local power users group on each server i want to backup, but for some servers this isn't enough and you need to make it administrator. This is across various Windows server operating systems (2003/2008 standard (full/core)). The only way so far is finding out by trial and error which servers need the service account in power users and which servers need it in administrators. That's really annoying.

It also seems to me that making the service account member of administrators or power users is a little elaborate just to overcome a security problem. Isn't there a better solution?

[DHR_VAN_LEEUWEN]

Bump... no-one has any ideas?

[DHR_VAN_LEEUWEN]

Adding rights to the Microsoft Shadow Copy Provider service for the backupoperator solves the event log problem, but doesn't help with the backup. The debug log for the agent shows there are still some rights needed to read the VSS GUI from the registry.
Log entries:

Error reading VSS provider GUID from registry:

Snapshot Error (3758130468) initializing VSS snapshot provider.

Anyone know a way to fix this?