Attempt to browse a Windows 2008 server in Backup Selections, from Backup Exec installed on a Windows 2003 server, fails with the error "Access is Denied"

Article:TECH66221  |  Created: 2008-01-22  |  Updated: 2013-12-17  |  Article URL http://www.symantec.com/docs/TECH66221
Article Type
Technical Solution

Product(s)

Issue



Attempt to browse a Windows 2008 server in Backup Selections, from Backup Exec installed on a Windows 2003 server, fails with the error "Access is Denied".


Error



 Figure 1


Remote agent debug log from the Windows 2008 server shows following error:

**********************************************************************************************
[2056] 12/15/08 19:40:16 ndmpRun: Control connection accepted : connection established between end-points 192.168.1.33:10000 and 192.168.1.5:1476
[0832] 12/15/08 19:40:16 BELogonUser: beclass::IsThisMe() returned error: 87
[0832] 12/15/08 19:40:16 LogonType set = [LOGON32_LOGON_BATCH][0x4]
[0832] 12/15/08 19:40:16 LogonUser failed: Logon failure: the user has not been granted the requested logon type at this computer.
[0832] 12/15/08 19:40:16 LogonUser failed for user: DOMAINNAME\USERNAME
**********************************************************************************************


Cause



This issue may occur if Backup Exec logon account does not have "log on as a batch job" or "logon as service" rights in the Domain Security Policy or Domain Controller Security Policy.


Solution



To resolve the issue follow the steps given below:

1. On Domain Controller go to Administrative Tools - Domain Security Policy.

2. Browse to "Local Policies" > "User Rights Assignment", double click on "Log on as a batch job" user
    right and add Backup Exec logon Account.

3. Restart all Backup Exec services and browse to the Windows 2008 server in selection list.

Group Policy  Management Editor :

1.  On Windows Server 2008 machine, go to Administrative Tools > Group Policy Management.

2.  Expand Forest: DomainName > Domains > DomainName > Group Policy Objects.

 

3.  Right click "Default Domain Controllers Policy" in the right window and select "Edit"

 

4.  Expand Computer Configurations > Policies >  Windows Settings > Security Settings > Local Policies >User Rights Assignment.

 

5.  Double click on "Log on as a batch job" and add the BESLA (Backup Exec System Logon Account).
 
6. Double click on "Log on as a service" and add the BESLA (Backup Exec System Logon Account).

7. Make sure the account is NOT listed under the "Deny Logon as a batch" and "Deny Logon as a Service".

 
 
8. Update the Group Policy.
 

9.  Restart all Backup Exec services and browse to the Windows 2008 server in selection list.
  
Note:
 
1. If Windows 2008 server is a domain controller then the same right needs to be assigned to Backup Exec logon
    account under Domain Controller security policy.
 
2. If Windows 2008 server is not part of a domain then the logon account used in Backup Exec to backup the Windows 2008 server
    needs to be assigned the same right under Local Security policy on Windows 2008 server.
 

 


Supplemental Materials

SourceETrack
Value1701487
Description

Unable to browse to a Win 2008 domain controller



Legacy ID



316787


Article URL http://www.symantec.com/docs/TECH66221


Terms of use for this information are found in Legal Notices