After changing the Backup Exec "service account" using the Services applet, the error message: "A required privilege is not held by the client" is displayed after clicking the "Backup" button.

Article:TECH23858  |  Created: 2008-01-11  |  Updated: 2010-11-09  |  Article URL http://www.symantec.com/docs/TECH23858
Article Type
Technical Solution

Product(s)

Environment

Issue



After changing the Backup Exec "service account" using the Services applet, the error message: "A required privilege is not held by the client" is displayed after clicking the "Backup" button.


Error



A required privilege is not held by the client.


Solution



This error can occur if the Backup Exec (tm) service account has not been granted the correct privileges (including privileges for group policies). If the Backup Exec services have been changed to use a new domain account specifically through the Services applet, and the Backup button is clicked, the error will occur (Figure 1).

Figure 1
 

This error will not occur if the Backup Exec services are changed to use a new account through the Backup Exec Services Manager (for detailed instructions, see the Related Documents section). This error can occur on a new or an upgraded installation of Backup Exec 11.x for Windows Servers.

To resolve this issue, attempt to update the Backup Exec service account information using the Backup Exec Services Manager (for more information, see the Related Documents section). If the error still occurs, do the following:

 
1. On the domain controller, click Start | Programs | Administrative Tools | Active Directory Users and Computers
 

 
2. From the left pane, expand the domain name, and right-click Domain Controllers Organizational Unit, and then select Properties
 

 
3. Select the Group Policy tab
 

 
4. Select the Default Domain Controllers Policy and then click Edit (Figure 2)
 

 
Figure 2
 
 
 

 
5. From the left pane, expand Computer Configuration and go to Windows Settings | Security Settings | Local Policies | User Rights Assignments (Figure 3)
 

 
Figure 3
 
 
 

 
6. From the right pane, double-click Act as Part of the Operating System
 

 
7. Click Add
 

 
8. For the user and group names, click Browse
 

 
9. Select the new desired user account, click Add, and then click OK (Figure 4)
 

 
Figure 4
 
 
 

 
10. Click OK, and then click OK again
 

 
11. Repeat steps 6 through10 for these policies:
 
Backup Files and Directories, Create a Token Object,Logon as a batch JobLogon as a service, Manage Auditing and Security Log, Restore Files and Directories, and Take ownership of files and other objects.
 

 

 
When the Backup Exec Service Account is changed on a Windows NT 4.0 server, the following rights need to be granted to the service account:
 
  • Authenticate as any user and gain access to resources under any user identity
  • Create a token object, which can be used to access any local resources
  • Log on as service
  • Administrative rights (complete and unrestricted rights to the computer)
  • Backup operator rights (provides rights to restore files and directories)
  • Manage auditing and security log
·
 
To grant the new Backup Exec Service Account on a Windows NT 4.0 server, do the following:
 
1. Select Network | Connect to Media Server in Backup Exec
 
2. Click Services
 
3. Click Services credentials
 
4. Select the Change service account information option
 
5. Type the new account information, and then click OK
 
6. Stop and then start all of the Backup Exec services
 

 



Legacy ID



254239


Article URL http://www.symantec.com/docs/TECH23858


Terms of use for this information are found in Legal Notices