Hello,

The jobs fails with the error "Access denied to database" due to the presence of one or more disabled Active Directory user accounts which still have mailboxes in the mailbox store.
This error does not occur if backing up to a B2d folder due to the fact that the Exchange database files are read dynamically after the backup when backing up to disk.


To resolve this issue, perform one of the following:

1. Assign "Full Mailbox Access" and "Associated External Account" rights to
SELF for the disabled mailbox (see Related Documents for additional details).
2. Reactivate the mailbox by reconnecting it to an active user account in the Active Directory.
3. Purge the mailbox from the Mailbox store.
4. Perform the backup to a B2d folder instead of a tape device.

To review which mailboxes Backup Exec was unable to obtain restore information for, in the Application Defaults set the "Job Logs / Information to include in log" setting to at least "Summary information and directories processed". Then, view the job log to see which mailboxes Backup Exec was unable to access AD data for.


Note: The inability of Backup Exec to log on to the mailbox of a disabled account and back it up is by design. Using the above workaround could cause security issues related to accessing the mailbox of the disabled account.
Please see Microsoft KB article 278966 for additional details


Regards,

Hi Ned,

This issue of GRT features and exchange backup is under research for the moment.

We do apologize for the inconvenience, but request you to take the backups by enabling legacy mailbox support.

Thanks

Thank you Swati. The backup does complete successfully with no errors. There are no disabled mailboxes. We only have 60 or so mailboxes. It's not a huge enterprise system, just a simple 1 Exchange server setup. I have enabled Legacy mailbox support, and will see what happens over the weekend.

So if this is a known issue then why is it not documented as such to avoid others running into a problem trying to backup and restore using this method?

FINALLY! Symantec has finally acknowledged that the Exchange CPS GRT does not work and has issues galore. It's about dam* time! We have been completely wasting our time trying to get this crap code to work and it never would have. I'm guessing that all of my wasted hours can just be billed back to Symantec becasue my clients certainly shouldn't have to pay for my time when it never would have worked.

Ken

It dosen't help either when is all these so called support personnel do is point you to KB articles, half of which are not even relavant to your question OR are for a different problem all together. Have you noticed they are almost all east indian...goes to show where Symantec places their tech support priorties, eh?!

Thats the true definition of 'monkeys', read from a precreated script and reference a knowledge base article. Takes a lot of intelligence and knowledge for that! Symantec's support has steadily declined over the past couple years and its to bad see Veritas' once excellent support clumpped and turned into this shoddy mess as well.

Been a Veritas customer for years and if we didnt have so much invested in this new version I would scrap it and go elsewhere. When there is a known WIDESCALE IMPORTANT issue and a company cant be bothered to acknowledge it publicly (a single thread on a forum of hundreds of threads is NOT public) then we know there are some serious problems.

Geee whizzz!

I couldn't agree more, Corey.

And yes, I have TOTALLY noticed that virtually all of the "support" techs are from the middle-east. Truthfully, I could care less where they're from as long as they solve the issues and not just point users to old KBs or ones that don't even relate to the issues at hand. But being an American and wishing to keep money and jobs in this country, I truly wish these companies would stop this nonsense of shifting jobs to the middle-east simply to save a buck. And Lord knows they CANNOT speak the English language so if you do get one on the phone, good luck. I've certainly respected Dell for its decision to bring back all of their server and enterprise support back to the States. I just wish more companies would do the same.

Just my two cents worth...

Ken

Mr. Sheppard,

This forum is meant for technical queries related to Backup Exec only.

Kindly, do not encourage and continue any non-technical discussions further.

We appreciate your co-operation on this.

Thanks,

Mr. Joshi,

Has Symantec fixed the issues with the GRT features? If not, do you have ANY type of ETA on when I might be able to advise my clients that the product that they spent thousands of dollars on will work as described in the Symantec BE 11d Admin Guide?

Thank you for resolving my issues and answering my question regarding the Exchange agent and GRT backup/restores.

Ken Sheppard

Hello Ned,



Could you please Update us on the issue...





Thank you,

Shweta

I have done a legacy mailbox backup, but the new method of being able to restore messages individually does not work, since nothing has changed. I still only see 2 mailboxes available when there should be 60. The backup exec account I use has access to all the mailboxes.

Ned, we appear to be making tons of progress on this whole GRT mailbox backup and restore method with 11d. Like you, I've completely scrapped the GRT backups because they're just not trustworthy for mailbox backups. I'm using the legacy method until Symantec posts some type of fix/update. And with Symantec stating publicly that GRT backup technology is under "review" I know I cannot advise my clients to use the software. They feel so very good about spending the money on the upgrade, too.

Ken

Swati -

If a meaningful and helpful TECHNICAL response to the original post (and many other similar posts) had been provided, Mr Sheppard would not be making the comments that he is.

Ned,
One of the other threads on the GRT issue mentioned the attribute legacyExchangeDN. I started digging and noticed that the only mailboxes that appear as restorable data all have the same value for the three attributes legacyExchangeDN, mail, and mailNickname. The mail value is the primary smtp address, the mailNickname value is the alias value on the Exchange General tab. I don't know where the legacyExchangeDN value appears other than viewing it using ADSIEdit. Using ADSIEdit, I changed a few test mailboxes and sure enough they showed up after the next full backup. I am continuing my tests and will post my results after tonights full backup.
I am using Backup Exec 11 (fully patched) to backup an Exchange 2003 SP2 server running on Windows 2003 SP1.

OK, I noticed the 2 mailboxes that work have the same name for mail and mailnickname in ADSIEdit. Our user accounts here are firstname+last initial, so in ADSIEdit for my account it shows nedcipollini@company.com for mail and nedc for mailnickname. What would be the consequences to change the nickname to nedcipollini? The legacyExchangeDN seems not to matter as much since it appears to be an X400 address.

Ned

You shouldn't have any issues changing the nickname to nedcipollini since this is a valid email alias. How does your legacyExchangeDN appear? Just want to know.

/o=Legere Group/ou=First Administrative Group/cn=Recipients/cn=nedc Should I change that as well to nedcipollini? Also what ill affects can this have? I suppose I can create a test account and check it in the morning after the backup. If this is the fix I'm glad we only have 65 mailboxes.

Not sure what the function or effects of changing legacyExchangeDN. I have been changing the primary email address by adding an alias to match the legacyExchangeDN and the mailNickname. Did this with some test accounts first. I am changing a few of my production accounts today.

legacyexchangedn will not have an impact if changed, it used for backwards compatibility with exchange 5.5 and x400 connector. it can be changed and will have no effect on your environment.

That is helpful information. Thanks. Honestly, I'm not having the problem of seeing all of my mailboxes. My problem occurs when restoing data that's backed up via the GRT method to tape, disk or with Continuous Backup enabled. The backups complete 100% successfully, but when you attempt to restore a single item, I always get blank messages. The header and subject restore correctly, but nothing in the body. I've had the belief that even more users would see the same results if they actually tried to restore a single item from a GRT backup. I've tested this on 4 different network installs and the behavior is the same with all. I'm using Windows 2003 Server SP1 and Exchange 2003 Server with SP2. Of course, I have BE 11d fully updated with HF2 and HF6.

For the time being, I've simply enabled the legacy backup method until someone posted a resolution.

Ken

I also am having the same issue. I can do a full backup with GRT and it shows every exchange email box i back up, however when i go to restore, it always ends after about 15 seconds with an access is denied message. if you look closer at the log, it says the information store is offline, or the specified email account is unaccessable or does not exist. i know this is not true, because it is my email box and it still works.

have you tried a redirected restore to a different database or the recovery database as a test to see whether or not the job will even run for you? maybe try restoring the entire mail store to the recovery store to whether it completes without error.

D Simmons,

How did the backup go last evening?

no, i am not. the exact error message i get is:

Restore- \\server\Microsoft Information Store\First Storage Group Unable to restore any content for because the Microsoft Exchange database that hosts that mailbox is offline or the mailbox doesn't exist.

the job completion status shows:

Job ended: Friday, December 29, 2006 at 11:26:26 AM
Completed status: Failed
Final error: 0xe0008488 - Access is denied.
Final error category: Security Errors

For additional information regarding this error refer to link V-79-57344-33928

To save you all editing this info on every mailbox, get ADModify.Net.
Select all of your users/mailboxes and then on the custom tab, you can manually enter mail or mailNickname, and set your whole organisation in one go, by using some variables.

Saved me a few hours !!