V-79-57344-33928 - Access Denied. Cannot backup directory Mailbox Store and its subdirectories.

[Paulo]

Can anyone help me with this issue? Our Exchange Backup To Disk fails everynight with the above error. When I look at the job log it is saying that it backed up 40GB (which is correct), but the job status is 'Failed', and the backup set is unuseable for restore purposes.

The strange thing here is that the B2D job was working fine, until last week. The account that is running the job is both a Domain Admin and a local admin on the Exchange Server. We are runnning Exchange 2003 Standard, and BE 11d on Win 2003 x64 Storage Server R2.

Regards

Paul.

[frnkblk]

Collin:

Thanks for your response.  It would be nice if TID 286144 at least mentioned the possiblity of this Exchange 2007 versus old Exchange compatability.

It might be helpful, in future revisions, to include a wizard that checks all these permission things as part of the install process, without the need to run a full backup.  At the end of the wizard process the tool would provide the option to 'fix' things if needed.

Regards,

Frank

[thegoolsby]

Frank,

I’ll see what I can get done about the tech notes.

As for the wizard idea, please submit your thoughts to http://enhancement.symantec.com . Many of our enhancements to Backup Exec come from customer requests submitted to the site, so I encourage you to take advantage of it.  

Symantec Product Feedback

Help us improve Symantec products by providing us with your suggestions and ideas. Feedback will be reviewed by the appropriate product team to evaluate trends and to identify the most common suggestions across the entire customer base. Your ideas can impact Symantec products in many ways, and might even be incorporated into future product releases.

[rkneeshaw]

Whoever it was that posted the suggestion to uncheck the "Hide from Exchange address lists" property for the backup domain user account, they were right on.

I had the exact error origionally posted for all exchange databases on the exchange server and am running the 7170 build.  Tried just about everything, then found this thread and that suggestion and the backups are completing successfully now. 

I might add that only full backups were failing for me.  Differentials would complete ok.... but a full backup, due to this problem, had never been performed on the exchange databases so that could have something to do with it.

Additionally, you may wish to know that the Backup user account you use does not have to be a member of the "Exchange Organization Administrators" group, only the "Exchange View-Only Administrators" group.  This might be interesting to those security conscious admins.

I think this should either be corrected or pointed out as a solution in the tech documents.  If you really want my opinion, this should be fixed because I'm sure I'm not the only net admin that doesnt want a service account listed in the GAL.

[Dewser]

Glad that worked for you.  After I figured that out I did realize that this behavior was present in past versions of BE.  If you hide the backup account you will not be able to backup Exchange.  But hey that solved my problem :D

[thegoolsby]

I understand the concern with having the user account listed in the GAL. Trust us, if it were possible to not have this account in the GAL, then wouldn't make it a requirement.

There is a limitation with the MAPI interface that we use to populate the restore selections that require this address to not be hidden. MAPI will not work if the user is hidden. Since we are at the hands of MAPI, there is no way that we can work around that.

When the account is hidden from the GAL, the MAPI calls we attempt are blocked by Exchange, which is what generates the 'access is denied' error.

If you are not using a policy-based Exchange backup, this could explain why the failures only occurred on the full backups. GRT will only work with policy-based incremental and differential backups. Standard backups which perform incremental and differential backups of Exchange cannot use GRT, which in turn will not use MAPI.

Glad to hear that it is working for, and hopefully I've been able to explain why we make this a requirement.

Let us know if you need anything further.

[frnkblk]

For the record, this 'hidden' attribute is documented in more detail in 243328 .

Regards,

Frank

[The_Dude]

Thanks for the help - it does seem it was ensuring the backup exec account was mail enabled. I'm not sure why it was working before, but it is seems to be working constantly now.

[Larry_Jones]

I am having the same problem.  I am running Server 2003 x64 on the media server, but have Server 2003 x32 on all other servers.  I have worked with Symantec support (bad experience, long story).  I have tried everything I can think of and the job will just not reliably run.  It will generally run right after creating it, and maybe the next time, but it will eventually fail.  I did have hotfixes 3, 4, and 5 installed.  I uninstalled them and the job worked twice, but then failed on its regular schedule.  The following is what support reports regarding this issue:

"I have reviewed the logs and performed research with our Developers and found that they have seen this issue with Exchange and CPS when the Backup Exec server (Media server) is running Windows 2003 x64 in two other sites so far.  This particular issue has not been seen in Windows 2003 32bit.  There is a bug case already created for this issue, right now it still under investigation by our developers.  As it stand today the only work around this issue is to run the Exchange backup with the CPS option disabled." (sic).

A backline manager spoke with me.  He was nice.  He tells me the issue is actively being worked on, but other, more critical issues "are in the way."

They believe the problem is only manifested with Exchange 2003.

[Stephen_Drysdal]

Hi,

I am having a similiar problem to all of those mentioned above, in that I am getting access denied errors when running a backup. However my service mailboxes are being backed up yet no user mailboxes or mailboxes that are actually used are not.

I have checked that the backup account is not hidden as well as ensuring that the backup account has been give admin access on both the domain and locally as well as having full permission on users mailboxes.

Any help would be appreciated

[Dewser]

Hey Larry,

Did you have CPS installed and did you try disabling it?  I've not used CPS so I am not sure if it would cause a problem with that setup.  But x64 is a new beast for those of us who have been using x32 for the last few years and who knows what kind of bugs.  Do you have more detailed logs being generated to give you more specific information?

Hey Stephen,

Can you post a copy of the job log of what is being denied?  Did you enable the log reports to show more than just a summary?  Also make sure your backup account is a member of one of the new Exchange admin groups, I would go with Operations Administrators just to be safe.  Possibly read-only would work as well.

[paul_k]

Hi guys, I too have the same error after attempting to complete an exchange backup in Exchange 2003 running under Windows 2003 SBS. However the error started occuring directly after I configured the online/offline defrag of our mail store (which was forced because the 16gb limit was exceeded). Could this somehow have changed the exchange backup configuration (ie. no unique exchange mailbox for the BE administrator - could it have somehow been altered during the defrag?).

BTW, at the moment our SBS inbuilt system administrator account is configured to operate with Backup Exec. Should I specify another account to login to BE?

Also, would this error mean that if our exchange drive was somehow spontaneously corrupted, a full restore of the exchange drive would not be successful (without individually restoring mailboxes)?

Any help would be much appreciated.

Thanks,

Paul K

[Luxor_2]

Hi,

I am havuing the same issues

BackupExec 7170 all hotfixes applied on a Windows Server 2003 32bit.

I want to backup Exchange 2007 with all emails. This works on a backup-to-disk, so no access problem.

But it is telling me access denied on the storage groups when I am trying to backup to a tape libary.

Is there a solution. Last try befor moving on to another backup software.

Thanks in advance,

Jan Dorninger

[Dewser]

Hey Paul, if you are running Exchange 2003 w/ SP2 you should be able to increase your mailbox store to 75GB. 

http://support.microsoft.com/default.aspx/kb/912375

But it is possible that the offline defrag may not be completed by the time your backup runs.  If the mailbox store is not mounted then you can't back it up.  Confirm that it is or is not and then run the backups.  I would increase the store size first.  Then run your backups.  The size increase does not require a reboot.  Just a restart of the services.

Let us know how you do.

[Dewser]

Hey Luxor,

Do you have detailed logs being generated?  If not go to Tools - Options then Log Reports.  Make sure it is showing more than just a summaries.

If you can copy the log report that might be helpful.

[Luxor_2]

Hi Dewser,

I have detailed logs, but this does not help. There is only the Access denied on storage group error.

When I am using backup-to-disk there is no problem, so there is no access denied problem.

But when I am trying to backup to tape with the "single mailbox, mailmessage" option there is an access denied error. I can backup the mailboxstore without this option to the tape.

I am unable to backup a single mailbox to tape. I have to do a dual step, first to disk, then to tape which results in a very long backup time.

Best regards,

Jan

[emanuele_rossi]

Hi,

I am having the same issues.

One media server win2003 sp2 x86 backup exec 11d rev 7170 Hot fix installed: 3,5,1,4,6,7,8,9,10 --

One exchange server 2007  x64 remote agent installed.

I create an user account for backup services associated with mailbox on a exchange server i add a user on a administrator user of exchange server .

I'm unable to backup a single istance of mailbox directly to tape but if i make a disk backup everithing workrs...

SYMANTEC HEELPP US!!!!!!!!!!

thank's

emanuele

[Cardonet]

Same here....

BE Server running Win 2003 Std 32bit R2 sp2

Exchange server running Win 2003 Std 64bit R2 sp2 & Exchange 2007

Initially installed BE 11d b7170, first backup job on 12/09 (European date) all goes well including individual mailbox backup/restore.

I then used Live Update to patch-up BE11, and now I have under Installed Updates it says 'Service Pack 1'.

Since then, no more inividual mailbox backup  :(

Tried so far:

1. Installing the MAPI/DCO patch on Exchange

2. Installing the Exchange Admin Console 32bit on the BE11 server

3. Also, I use Administrator for BE11 services and it has a fully-functional mailbox.

Next step would have been to un-install BE11 and re-install it again without patching it up (there does not seem to be an option to uninstall sp1). However, BE is planned to be migrated to a dedicated server next week so might as well just do it then.

See below - on the first backup dated 12/09 individual mailboxes can be restored, but not the subsequent backups made after that :






Any suggestions would be greatly appreciated...
















Message Edited by Cardonet on 09-16-2007 02:06 PM

Message Edited by Cardonet on 09-16-2007 02:07 PM

Message Edited by Cardonet on 09-16-2007 02:08 PM

Message Edited by Cardonet on 09-16-2007 02:09 PM

Message Edited by Cardonet on 09-16-2007 02:14 PM

[Fabio_Pastorell]

Hi guys,

same problem....

Running BE11D Rev6235 with SP2 and HF27 installed.

System is a Windows 2003 Server SP1 and Exchange 2003 7638.2 SP2.

I can backup my exchange storage with "Enable the restore of individual mail messages and folders from Information Store backups" and "Enable single instance backup for message attachments" activated only to a backup-folder instead of tape.

If I try to backup to tape the system return the access denied message, so the problem is not on permission , if yes the backup to folder must fail too.

Hope Symantec fix as soon as possible this problem , because I have to backup some sites and not all the sites as a necessary space to backup to folder.

Thanks

Fabio

Message Edited by Fabio Pastorella on 09-17-2007 05:48 AM

Message Edited by Fabio Pastorella on 09-17-2007 05:49 AM

[Fabio_Pastorell]

Hi guys,

i have called Symantec and I've solved my problem gain "Exchange Full Administrator" to the user used by Backup Exec.

To do this go in Exchange System Manager and right click on organisation name , Delegate Control.

Hope this is usefull....

Bye and good luck

Fabio 

[Cardonet]

This does not seem to be an option for Exchange 2007...: