V-79-57344-766 - Cannot log on to MAPI with the specified credentials. Review the resource credentials for the job, and then run the job again.

[lalicea]

I have just recently upgraded from Backup Exec 12.5 to 2010 on a windows 2008 server.

Currently utilizing Exchange 2003.  When running a backup, I get the following error:

V-79-57344-766 - Cannot log on to MAPI with the specified credentials. Review the resource credentials for the job, and then run the job again.

I've scoured the Internet looking for a solution but haven't found one that fits my situation or that works.

When I test the credentials, they all work without issue.

Any help would be greatly appreciated.

[lalicea]

Here's the log file:

Server - mail.domain.com
 Network control connection is established between x.x.x.x:60116 <--> x.x.x.x:10000
 Network data connection is established between    x.x.x.x:60119 <--> x.x.x.x:17655

 Set Information - \\mail.domain.com\Microsoft Information Store\First Storage Group
  Backup Set Information

  Family Name: "Media created 7/28/2010 10:00:03 PM"
  Backup of "\\mail.domain.com\Microsoft Information Store\First Storage Group"
  Backup set #3 on storage media #1
  Backup set description: "Daily Incremental Backup"
  Backup Method: Full - Database & Logs (flush committed logs)
  Microsoft Exchange Server Agent: Started
  The option to enable the restore of individual items from the database backup was selected for this backup.
  
 Backup started on 7/28/2010 at 10:12:07 PM.

  Backup Set Detail Information
  V-79-57344-766 - Cannot log on to MAPI with the specified credentials. Review the resource credentials for the job, and then run the job again.
  V-79-57344-766 - Cannot log on to MAPI with the specified credentials. Review the resource credentials for the job, and then run the job again.

 Backup completed on 7/28/2010 at 10:27:43 PM.

  Backup Set Summary
  Backed up 2 Exchange Server stores
  Backed up 3 Exchange Server logs
  Processed 33,139,772,302 bytes in  15 minutes and  36 seconds.
  Throughput rate: 2026 MB/min
  Compression Type: Hardware

[tech29]

Hi There,

The account you are using for the exchange backup should have 5 righs:
1> the first five character of the account should be unique, example : if you have administrator and you are trying to use admin then it is not unique.
2> should have active mailbox
3> domain admin
4> unhidden from gal
5> should have full delegation.
Also make sure in the BE console click on Network - logon account and you should have the system logon account and you should have the correct credentials for the same.

Hope this helps.

Regards,
Tech29 

[lalicea]

1) This is definitely unique
2) This didn't have an active mailbox in 12.5.  Is this really a necessary step?
3.) It is not a domain admin, but it is a Backup Operator, so shouldn't those rights be enough?
4.) Obviously this isn't there because it didn't have an active mailbox to begin with.
5.) Isn't this a security risk since it's a static account?

The credentials do match up for the system logon account as you asked.

Just trying to understand more than question your suggestion.  I've recently been given charge of this server.

[CraigV]

Hi There,

Ideally the service account should be a domain admin, and have admin rights to Exchange too. This can be delegated through Exchange Administrator. It is also a requirement to have an email address assigned to the account, even if it is not used.
To make it less of a security risk, you can look at putting in a strong password and ensuring that you limit the number of people who have access to this account.
Have you patched BE 2010 with all the available patches after you upgraded?

Thanks!

[lalicea]

All LiveUpdate patches and Windows patches have been applied.  Are these new requirements for BE2010 to be a domain admin and have an active mailbox?

The reason for my concern is the possibility of SOX violations for having a static account with that much access.

[DunFraggin]

We recently went through an excersise to reduce the number of domain admin rights given to service accounts throughout our forest and one of the accounts we removed this from was the backup account for Exchange.  The results were a little muddled in that our mailbox cluster server performed all mailbox backups with GRT ok but when we tried to use this on the front end SMTP servers we got a similar issue to the one you are getting also.  We also had intermittent results on our public folder server during the testing so in the end we gave up on the idea.
We have now re-added this account to the domain admin group (even though full delegation wes given within Exchange 2003) and all exchange server backups are now working again...Our thoughts were that its just needed and we'd have to work around the domain admin rights issue.
On that note; I really do not like that so many vendors state domain admin rights for service accounts these days. It seems overly generous for most and makes a bit of a mockery of AD security too - But what can we do? :)

[lalicea]

But isn't that the whole purpose of the Backup Operators Membership?  So they have access to do what they need without being able to manipulate other users, etc.?

[CraigV]

Yes, but you will find that unless you add the Backup Operators group into an Exchange admin group, it won't have the necessary rights.
If you take a look at the BE 2010 Admin Guide (http://seer.entsupport.symantec.com/docs/338514.htm) on pg. 1071, it states that:

Symantec recommends that you use a Backup Exec services account that has domain and local administrator rights on the Exchange Server.

[pfr]

Hi,

If your service account doesn't have a mailbox, you can't use the GRT ( The option to enable the restore of individual items from the database backup).

Uncheck this option and your backup will be fine !

Regards

Philippe
Lyon (France)

[CraigV]

Hi lalicea,

Did you ever come right here? If you did, can you please close off with the solution?

Thanks!