Windows Backup fails after installing Symantec Endpoint Protection 12.1

Article:TECH168402  |  Created: 2011-08-30  |  Updated: 2014-09-22  |  Article URL
Article Type
Technical Solution


Scheduled or manual Windows Server Backups fail after installing Symantec Endpoint Protection (SEP) 12.1.


  • Windows Server Backup logs contain the following error:
    "The operation was stopped. Detailed error: The Process cannot access the file because it is being used by another process..."
  • The Application Event Log may show one or both of the following errors:
    • Event ID 517: "The backup operation that started at <time>' has failed with following error code '2155347997' (%2155347997155347997).
      Please review the event details for a solution, and then rerun the backup operation once the issue is resolved."
    • "Error in deletion of [<Volume>\System Volume Information\EfaData\SYMEFA.DB] while pruning the target VHD: Error [0x80070020] The process cannot access the file because it is being used by another process."
  • If Process Monitor is run during the Windows Server Backup failure, an ACCESS DENIED entry will be seen when wbengine.exe tries to access <Volume>\System Volume Information\EfaData\SYMEFA.DB.



The SEP client utilizes a Extended File Attribute (EFA) database stored on the \System Volume Information directory. Windows Server Backup attempts to access the SEP client's EFA database during the backup process fail as this file is locked.



This problem is fixed in Symantec Endpoint Protection (SEP) 12.1 Release Update 5 (RU5). For more information on obtaining the latest version of SEP, see Obtaining the latest version of Symantec Endpoint Protection or Symantec Network Access Control.

Supplemental Materials




Article URL

Terms of use for this information are found in Legal Notices