Backup Exec for Windows Server 12.5 Services fail to start with error "0xffffffff: 0xffffffff" after applying Backup Exec for Windows 12.5 Service Pack 2 and Event ID 57806 is recorded in the Application Event logs.

Article:TECH70860  |  Created: 2009-01-22  |  Updated: 2012-03-15  |  Article URL http://www.symantec.com/docs/TECH70860
Article Type
Technical Solution


Environment

Issue



Backup Exec for Windows Server 12.5 Services fail to start with error "0xffffffff: 0xffffffff" after applying Backup Exec for Windows 12.5 Service Pack 2 and Event ID 57806 is recorded in the Application Event logs.


Error



After applying Backup Exec for Windows 12.5 Service Pack 2 the Backup Exec Device & Media Service will not start.  The following pop up alert is generated  :

Could not start the Backup Exec Device & Media Service service on Local Computer
Error 0xffffffff: 0xffffffff

Application Log Error:


Event Type: Error
Event Source: Backup Exec
Event Category: Devices
Event ID: 57806
Description:The Backup Exec service 'Backup Exec Device & Media Service' failed to start because it uses a Windows Server account that does not have the following necessary privileges:
Create a Token Object

Ensure that you are logged on with an account that has administrative privileges. Then, click Tools > Backup Exec Services > Services credentials. If you cannot access the Administration Console, on the Connect to Media Server screen, click Services > Services credentials.  Change the service account information so that it has administrative privileges, and then restart the Backup Exec service.

NOTE:  The privilege or right listed in the Event ID 57806 above can be any of the REQUIRED rights noted in the RESOLUTION section of this technote.

System Log Error:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Description:
The Backup Exec Device & Media Service service terminated with the following error:
%%4294967295


Cause



The above mentioned error may occur if the Backup Exec Service Account (BESA) does not have the appropriate rights assigned to it.

 


Solution



To determine if the correct set of rights have been assigned to the account please follow the below mentioned steps:
  1. Login on the Backup Exec server with the Backup Exec Service Account.
  2. Open a command prompt console and run the command:  gpresult /Z
  3. From the output of the command, confirm that the account is part of the Local Administrators group and the Domain Admins Group in case the server is in a domain 
  4. From the output of the command, confirm that the account has all the necessary rights assigned. It is recommended that the Backup Exec Services account (BESA) is have ALL of  the following rights. Backup Exec checks whether the Backup Exec Service Account has the following rights before it allows for the Backup Exec Services to start.
     
Act as part of the operating system (For Windows 2000 only)
Backup files and directories
Create a token object
Logon as a batch job (For Windows 2008 only)
Logon as a service
Manage auditing and security log
Restore files and directories
Take ownership of files and other objects

Also make sure the account is not added under :
-Deny logon as a service
-Deny logon as a batch

Note: This is important because the DENY takes precedence over allow.
To prevent Backup Exec from running the check on privileges assigned to the Backup Exec Service Account during services startup, the Backup Exec 12.5 HF 334841 should be applied on the Backup Exec server and the Remote Agent needs to be updated on the remote servers being backed up. Please refer the Related Documents section for more information about the hotfix.
 

Workaround:

 
  1.   If the account is missing any of the permissions/rights mentioned above, use the Group Policy Editor or the Local Policy Editor to grant the necessary rights to the account. Use the GPUPDATE /Force commands to update the policy. Log off and Log in again with the BESA. Rerun the gpresult /Z command to confirm that now the rights are assigned.
  2. Once it has been confirmed that the account has the required rights, use the Backup Exec Services Manager to setup the Backup Exec services to use this account. Please refer the Article TECH82969  under Related Documents section for more information.
  3. The BEWS services should be using the ID in "Domain\ID" format. If the ID is in "ID@Domain.com" format the error can still occur. Use the BEWS Services Credentials Article TECH82969  to change the ID to "Domain\ID" format.

 


Supplemental Materials

SourceEvent ID
Value57806
Description

The Backup Exec service 'Backup Exec Device & Media Service' failed to start because it uses a Windows Server account that does not have the following necessary privileges


SourceEvent ID
Value7023
Description

The Backup Exec Device & Media Service service terminated with the following error: %%4294967295


SourceETrack
Value1521243
Description

Services fail to start due to lack of rights


SourceETrack
Value1747176
Description

BEWS CORE Fix to disable check of user privileges when Services fail to start due to lack of rights



Legacy ID



325495


Article URL http://www.symantec.com/docs/TECH70860


Terms of use for this information are found in Legal Notices