The %windir%\registration folder on Windows 2003 clients is being omitted from backups performed by the Veritas NetBackup (tm) Server / Enterprise Server 5.1 and 6.0 releases, and therefore, will not be available for restore.

Article:TECH45130  |  Created: 2005-01-23  |  Updated: 2007-01-22  |  Article URL http://www.symantec.com/docs/TECH45130
Article Type
Technical Solution

Product(s)

Environment

Issue



The %windir%\registration folder on Windows 2003 clients is being omitted from backups performed by the Veritas NetBackup (tm) Server / Enterprise Server 5.1 and 6.0 releases, and therefore, will not be available for restore.

Solution



What is Affected

This issue is only known to affect backups of Windows 2003 clients, utilizing the following NetBackup Server / Enterprise Server or Bare Metal Restore releases:
  • NetBackup 5.1
  • NetBackup 5.1 Maintenance Pack 1 to Maintenance Pack 4 (MP4)
  • NetBackup 6.0
  • Bare Metal Restore for NBU 4.7 through 4.7 Maintenance Pack 3 (MP3)
Bare Metal Restore is not the cause of this issue and is only listed as an affected product since it relies on NetBackup performing a complete backup of the client in order to perform a complete restore of the client.  


Details of the Issue

Starting with NetBackup 5.1, NetBackup makes use of the Microsoft Volume Shadow Copy Service (VSS) writers to protect the System State files. When using VSS, each writer is able to give the backup application a list of files and directories that should not be backed up.  The %windir%\registration directory is being erroneously added to the list of files and directories that should not be backed up by NetBackup.  Therefore, when using NetBackup or Bare Metal Restore for NBU to restore the system, the %windir%\registration directory will not get restored and the permissions may not match what was actually on the directory at backup time.  This may cause problems for applications that rely on the correct permissions on the %windir%\registration directory and files within that directory.

This becomes especially important after the installation of the Microsoft Security Bulletin "MS05-051 for COM+ and MS DTC" (KB902400).  This patch has made the permissions of the %windir%\registration directory, including any COM+ catalog files (*.clb) in those directories, very significant. If these directories and their files do not have the expected permissions, then Active Directory and other applications will fail.  The System State files will not be backed up properly by NetBackup, whether or not the Microsoft Security Bulletin is installed.  This issue becomes more prevalent if MS05-051 is applied.

The only NetBackup versions that support backing up the System State via VSS writers are NetBackup 5.1 and NetBackup 6.0.  NetBackup 5.0 on Windows 2003 uses legacy methods to protect the System State and is not susceptible to this issue.


How to Determine if Affected

The following symptoms that may be seen with this issue, are provided on Microsoft's Web site:  
 http://support.microsoft.com/?kbid=909444

SYMPTOMS
On a computer that is running Microsoft Windows XP, Microsoft Windows 2000, or Windows Server 2003, one or more problems may occur after you install the critical update that is discussed in Microsoft Security Bulletin MS05-051. These problems include the following:
  • The Windows Installer service may not start.
  • The Windows Firewall Service may not start.
  • The Network Connections folder is empty.
  • The Windows Update Web site may incorrectly recommend that you change the Userdata persistence setting in Microsoft Internet Explorer.  
  • Active Server Pages (ASP) pages that are running on Microsoft Internet Information Services (IIS) return an "HTTP 500 - Internal Server Error" error message.  
  • The Microsoft COM+ EventSystem service will not start.
  • COM+ applications will not start.
  • The computers node in the Microsoft Component Services Microsoft Management Console (MMC) tree will not expand.
  • Authenticated users cannot log on, and a blank screen appears after the users apply the October Security Updates.
  • In a server cluster configuration, the cluster service may not start. The following event is logged in the cluster log file: ERR [NM] Couldn't establish connection point with Net Connection Manager, status 80070005. WARN [NM] Couldn't initialize Net Connection Manager advise sink, status 80070005 ERR [NM] Initialization failed -2147024891
  • An event that is similar to the following may be logged in the System log:
Event ID: 512
Source: CryptSvc
Description:
The Cryptographic Services service failed to initialize the VSS backup "System Writer" object.

Details:
System Writer object failed to subscribe to VSS.

System Error:
Catastrophic failure
  • An access denied error may occur when you try to connect to Windows Management Instrumentation (WMI) by using script, the WBEMTest.exe utility, or other utilities. The %windir%\system32\wbem\logs\wbemprox.log file contains errors that are similar to the following error at the time of the failure: ConnectViaDCOM, CoCreateInstanceEx resulted in hr = 0x80070005  

Formal Resolution

The formal resolution for this issue will appear in the following NetBackup Enterprise Server / Server releases.
  • NetBackup 6.0 Maintenance Pack 1, currently available on the Support Web site.
  • NetBackup 5.1 Maintenance Pack 5, currently available on the Support Web site.
 
These releases will properly backup the %windir%\registration folder.  After applying the formal resolution, Symantec strongly recommends performing a Full backup to properly backup the %windir%\registration folder.

To download NetBackup 6.0 Maintenance Pack 1, or to download NetBackup 5.1 Maintenance Pack 5, visit the Support Web site at:    http://www.symantec.com/enterprise/support/downloads.jsp?pid=15143

Please Note:  Bare Metal Restore will not need to be updated and will properly restore any Windows 2003 backup made after the Formal Resolution has been applied on the NetBackup servers and clients.

Workaround

For Windows 2003 systems that have been restored from backups that were missing the correct permissions for the %windir%\registration folder refer to Microsoft Knowledge base article 909444 at the following link.  
 http://support.microsoft.com/?kbid=909444

The "RESOLUTION" section of this document outlines how to restore the correct permissions for this folder.   Microsoft Knowledge base article 909444 contains additional information on the COM+ catalog files and directories.  This includes possible symptoms (also listed above) that will be seen when the permissions are not set properly.  If a Windows 2003 client with Microsoft Security Bulletin "MS05-051 for COM+ and MS DTC" (KB902400) installed has been restored using NetBackup or Bare Metal Restore then the steps listed in the "RESOLUTION" section of this article can be used to correct the permissions of the %windir%\registration folder.  

Prior to the targeted release of NetBackup 5.1 Maintenance Pack 5, binaries are available in the event the resolution documented in the Microsoft Knowledge base article 909444 is not acceptable.  These binaries will properly backup the %windir%\registration folder and can be requested via Symantec Enterprise Technical Support.  To make use of these binaries, the NetBackup environment must be running NetBackup 5.1 Maintenance Pack 4.  This binary fix will only be available until the release of NetBackup 5.1 Maintenance Pack 5.  After the release of NetBackup 5.1 MP5, it will be necessary to upgrade to NetBackup 5.1 MP5 to formally resolve this issue.

If you have not received this TechNote as a Software Alert from the Email Notification Service, please subscribe at the following link:    http://maillist.support.veritas.com/subscribe.asp


Supplemental Materials

SourceETrack
Value507275
DescriptionEtrack (NetBackup) 507275: BMR restores changes permission of some Shadow Copy components. (6.0 MP1 Approved)

SourceETrack
Value514080
DescriptionEtrack (NetBackup) 514080: BMR restores changes permission of some Shadow Copy components. (5.1 MP5 Approved)


Legacy ID



280511


Article URL http://www.symantec.com/docs/TECH45130


Terms of use for this information are found in Legal Notices