05-29-2007 01:23 AM
06-04-2007 06:11 AM
Message Edited by Wkelley on 06-04-200706:21 AM
06-04-2007 06:22 AM
06-04-2007 06:23 AM
06-04-2007 06:33 AM
06-04-2007 06:42 AM
06-04-2007 07:28 AM
06-04-2007 07:36 AM
Message Edited by Wkelley on 06-04-200707:41 AM
06-05-2007 07:49 AM
06-05-2007 09:06 AM
Hello,
There seem to be a number of issues being discussed on this thread, so I am going to do my best to touch them all.
First, I have been working to try and reproduce the issues that most you are seeing and have been unable to do so. I’ve tried many combinations or installing, uninstalling, and reinstalling hot fixes and have had no luck in reproducing the issue.
The first thing that I need everyone to check is that we are not dealing with any disabled Active Directory accounts. There is a known issue with Exchange GRT backups and this error message when backing up directly to tape when disabled accounts are present in Exchage.
The following tech note explains in detail the reasons behind the failures, and how to identify which account is causing the failure, should this be the cause of the error:
http://support.veritas.com/docs/286144
I would like everyone who is getting this message to follow the steps in the tech note and see if there are any disabled accounts which show there.
The reason the error occurs is that we use the MAPI interface to populate the catalog restore selections, and when a disabled account has not been purged, MAPI still has that disabled account information. When we go to access the account, since MAPI tells us the account is present, we get denied by Exchange when we try to access the account since the account is disabled in Active Directory. This causes the ‘access is denied’ error.
In addition, I need everyone to run legacy mailbox backup and see if they are able to run a successful MAPI Mailbox backup that does not yield any errors.
As for the Exchange 2007 issue, the access is denied from that backup appears to be due to a permissions issue. Please verify that the account being used to backup the Information Store is a member of the Exchange Organization Administrators.
For all Exchange backups, regardless of Exchange version, we need verify that the accounts being used to perform the backups have the proper configurations and rights. More on this can be found here:
Backup Exec 11d Best Practices Guide: Agent for Microsoft Exchange Server
http://support.veritas.com/docs/285753
The following comes from the Best Practices Guide:
For Exchange data protection and recovery to work successfully the user logon for Backup Exec must have an equivalent Windows Domain account that has administrative rights to the Exchange Server both locally, through the domain and on the Exchange objects as well. The account used must have rights to the Exchange server registry and file system. The user account must also have a mailbox that has been successfully initialized using a MAPI client.
This needs to be verified for all whom experience this issue.
I have sent some of you on this thread a personal message requesting some more information. For everyone, here is a sort of check list that we all need to check:
1. Perform the steps from http://support.veritas.com/docs/286144 and verify there are no accounts disabled.
2. Verify the account has the proper rights as per http://support.veritas.com/docs/285753.
3. Can a successful Legacy MAPI maibox be completed with no errors?
I would also like everyone here to know that we are here to assist for this issue, and that we are going to work with you to get this resolved.
06-05-2007 09:49 AM
06-05-2007 10:01 AM
06-05-2007 01:05 PM
06-05-2007 01:28 PM
Dan,
This sounds like a permissions issue with the Backup Exec account and the public folders. If you log into Windows using the backup user, are you able to access the public folders and modify the backup folders
We’re logging to each store the same way. If we’re blocked from one store, but can access the other, then something is different with the store we cannot access. We’re not going to log into one store differently then we do the other.
Have you reviewed the Best Practices Guide for Exchange and verified that you have all of the correct permissions indicated in the article (domain admin, local admin, admin rights on all Exchange objects)?
06-06-2007 08:11 AM
06-06-2007 10:29 AM
06-06-2007 11:13 AM
Frank,
The account has to be located on the 2007 server.
Please see the resolution for the follow tech note:
Attempt to restore the individual items from the Granular Restore Technology (GRT) based backups of Exchange 2007 fails with the unable to attach error.
http://support.veritas.com/docs/288508
06-06-2007 12:10 PM
06-06-2007 12:25 PM
Legacy backups = mailbox backups.
To enable them, go to Tools > Options > Microsoft Exchange and select the ‘Enable legacy mailbox support).
You will then have to modify your selection list, and select the Microsoft Exchange Mailboxes and Public folders.
It’s very odd to hear that your backup works one day and not the next. Something has to be changing in the environment. We’re not going to backup one way one day, and then change our backup the next day. If something was configured incorrect, either on the Exchange or Backup Exec side, you would get this error 100% of the time.
Are you using LCR or CCR in Exchange?
I’d be interested to see what happens with a legacy mailbox backup when you get this error.
06-06-2007 01:28 PM
Message Edited by frnkblk on 06-06-200701:35 PM
06-07-2007 06:13 AM
Frank,
I understand that none of the errors mentioned in the tech notes were your particular error, however they were all caused by the same permissions issues. In all of these cases, yours included, Active Directory wasn’t allowing us stream the data from one store to another.
As for mixed environments, the user account should be backwards compatible. A 2007 account should be able to backup a 2003 or 2000 store, but the compatibility is not forward compatible.
As for the permissions for multiple Backup Exec installs, as long as the machines are attached to the domain you are going to need domain level rights. The local admin rights will not always have the proper permissions to backup certain Active Directory machines and components (Exchange included).
The following is from the Best Practices Guide (http://support.veritas.com/docs/285753:(
“For Exchange data protection and recovery to work successfully the user logon for Backup Exec must have an equivalent Windows Domain account that has administrative rights to the Exchange Server both locally, through the domain and on the Exchange objects as well. The account used must have rights to the Exchange server registry and file system. The user account must also have a mailbox that has been successfully initialized using a MAPI client.”
As long as all of these rights are set correctly in your environment, then the same user account should be able to backup every Exchange server in your environment. Since you use Exchange 2007 and 2000, the mailbox must reside in Exchange 2007. This holds true for any mixed environment with Exchange.
“I also want to recommend that TID 286144 be updated to include a reference that the Backup Account's mailbox must be on the local server.”
This does not hold true if the above permissions are set correctly.
Let me know if you have any questions.