Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Backup-to-disk - Unable to create folder or specify user credentials.

Created: 16 May 2005 • Updated: 21 May 2010 | 17 comments

I have a dedicated backup exec server sitting on my domain.

I have 2 TB of disk space on a server in another domain that I don't have admin access to.

I have a username/password for a UNC share on the foriegn server.

I *CAN* backup this server as in backup selections I can set a username and password to connect to it as, however this isn't what I want to do with this space. I want to use it for backup-to-disk space.

When creating a backup-to-disk folder, there is no apparent method of setting which login credentials to use for this folder. Ideally I should be able to set different credentials for each folder, as each one might be on a different server, domain, etc, that I may or may not have full control of.

I can not set the backup exec service to run as an account in a foriegn domain, this bombs (expectedly).

I'm running Backup Exec on Windows 2000.

I do not know what OS the disks I"m connecting to are running on, but I can map \\ipaddress\sharename\ and create folders via explorer. However backupexec appears to try to authenticate as the account it is running as, which obviously will never have access to that folder.

Advise? Ideas? Is this supported in 10.x?

I'm stunned there isn't an option on the wizard to specify alternate credentials!!!Message was edited by:
Trey Rouse

Comments 17 CommentsJump to latest comment

Trey Rouse's picture

Well, I've found 4-5 other posts about roughly the same thing.

I assume since there is no reply to any of them, the answer is, no the support is missing in the software, its a known problem, and there isn't a sollution, have a nice day.

However, it would be nice to know thats the case rather than be ignored =)

Renuka -'s picture

Hello,



This problem occurs if the Backup-To-Disk folder has been created using a mapped drive instead of a universal naming convention (UNC) path




The problem can be resolved by creating the correct UNC path to the remote server. To do this, follow the instructions given below:



1. Select the Devices tab, right-click Backup-To-Disk Folders, and select New Backup Folder



2. The Backup-To-Disk Folder Warning dialog box may appear. Click OK



3. The Add New Backup to Disk Folder dialog box appears




Type a name in the Backup folder display name box if you do not want to use the default. The Backup folder display name defaults to Backup Folder n, where the number n is incremented for each new backup folder added. The name must be unique, and is limited to 32 characters.



4. Type a UNC path in the Path field or a locally attached physical drive path, and then click OK . The path must be unique. If the folder does not already exist on the disk, Backup Exec creates it. A changer.cfg file is created in the folder. This file stores information about backup files, and should not be edited or deleted.




Note: Any valid UNC path may be used. For example, \\ \ \ path (Figure 5). If a UNC path is used, the account used for Backup Exec services must have access to the destination folder, otherwise a prompt will appear asking for credentials to attach to the remote server.





5. Click OK. The backup folder is added to the device list and can be selected as a destination device.




NOTE : If we do not receive your reply within two business days, this post would be marked assumed answeredand would be moved toanswered questions pool.null

Trey Rouse's picture

------------------- Begin Quote -------------------------
Note: Any valid UNC path may be used. For example, \\ \ \ path (Figure 5). If a UNC path is used, the account used for Backup Exec services must have access to the destination folder, otherwise a prompt will appear asking for credentials to attach to the remote server.
------------------- End Quote ---------------------------
No, it does not in fact throw a prompt asking for credentials to attach to the remote server, it just fails with 'Unable to create new backup folder. Access Denied."

NO PROMPT appears asking for credentials to attach to the remote server. If it did, I wouldn't be here =)

I'm running 9.1 Rev. 4691

Was this functionality added in a later rev? Or?

Message was edited by:
Trey Rouse

Deepali Badave's picture

Hello,

'Unable to create new backup folder. Access Denied."

The above error message, like most of the access denied related error messages, is caused by the fact that the Backup Exec user account or the group to which it belongs does not have sufficient rights on the partition where the backup folder is being created.

Refer the following technote for more information:-

The error message "Unable to create new backup folder. Access denied" is returned when creating a backup-to-disk folder within VERITAS Backup Exec (tm) for Windows Servers.

http://support.veritas.com/docs/239499

NOTE : If we do not receive your reply within two business days, this post would be marked assumed answered and would be moved to answered questions pool.

Trey Rouse's picture

OMG...

Did you not read my orriginal post?

I'm mounting disk space on a foriegn domain that I do not have admin rights to. I can not have backup-exec run as the account in the foriegn domain.

I do have a username and credentials for backup-exec to use when connecting to this resource, however I've been unable to find a method of configuring the service to use these credentials.

A previous Veritas employee responded to this thread that after the backup-to-disk creation failed that the software would prompt you for credentials. In my experience this is not true, as if it did prompt me, I would have entered them and never posted here.

So BACK TO MY QUESTION.

How do I specify credentials (other than what the service is running as) to connect to backup-to-disk folders (like you can do for backup sellections)?

Is this just an oversite and the software doesn't allow for it? Was this added in a later release/version than I am currently using? Am I just out of luck and can't utilize the 2 TB of disk I have access to? Will I get an informed, straight answer to this question?

A van der Boom's picture

Seems to me you cannot do that. BE simply needs a way to authenticate itself and always seem to use its default backup account. What you might try is to contact the admin of the foreign domain and ask her/him to make a account for you with the same username/password as you BE account.

Regards
A vabn der Boom

Amruta Purandare's picture

Hello,

We hope this answers your question. Please revert f you have any more queries.

NOTE : If we do not receive your reply within two business days, this post would be marked assumed answered and would be moved to answered questions pool.

Trey Rouse's picture

We did just that, created a same namre account and password on the foriegn domain.

BE still does not authenticate properly with it and drops an access denied when it tries to create the folder.

I'm just stunned, that the product is sophisticated enough for me to provide credentials to run a backup of any data on this remote share, however to utilize it for backup-to-disk, there isn't any apparent similar mechanism.

Trey Rouse's picture

oh, back to part of my orriginal question...


If this indeed is not possible in 9.1, was this ability added in a later version?

Renuka -'s picture

Hello,

there must be a one-way trust in place where the target domain trusts the host domain(domain with Backup Exec). The backup account must also belong to the target domain's local Administrators group. To create a one-way trust where the target domain trusts the host domain

1. On the domain controller of the host domain, go to Start | Programs | Administrative Tools | Active Directory Domains and Trusts

2. Right-click on the host domain's name in the left window pane and click on Properties

3. Click on the Trusts tab

4. Click on the Add button next to the Domains that Trust this Domain box


5. Type in the name of the target domain in the Trusting Domain field, the administrator password (for the target domain) in the Initial Password and Confirm Password fields; click OK, and then click OK again (Repeat steps 3-4 for multiple target domains)


5a. After clicking OK, on the password screen, click yes to verify the trust. This will produce an Active Directory Message. This is because the target domain has not been configured to trust the host domain. Click OK


6. On the domain controller of all the target domains, go to Start | Programs | Administrative Tools | Active Directory Domains and Trusts

7. Click on the Add button next to the Domains Trusted by this Domain box


8. Type in the name of the host domain in the Trusted Domain field, the administrator password (for the host domain) in the Initial Password and Confirm Password fields; click OK, and then click OK again


To add the backup account to the target domain's local administrators group


NOTE : If we do not receive your reply within two business days, this post would be marked assumed answeredand would be moved toanswered questions pool.

Trey Rouse's picture

We've already been exploring this path, however our domain trust fails 80% of the time we try to use it. I realize this is a problem for another thread.

But, I would still like to know if upgrading solves this problem? Or is the mechanism still the same on the latest release?

Ken Putnam's picture

Try this. I know that it would work in v8.x, but have never tried explicitly in v9.x


Open the Backup Selections pane, browse to the server\share that you want to connect to, right click it and choose "Connect As"

Or Create a User Defined Share using the UNC name, and again give it the alternate connect info.

Once BackupExec has "connect info" stored for a share, it will alway use that info rather than using the BE Service Account.

If this response answers your concern, please mark it as a "solution"

Trey Rouse's picture

Ken,

This works for backing up sellections on remote servers, however the same functionality doesn't exist for chosing UNC's to mount for backup-to-disk folders.

So, I can backup data on this remote share, but BE can't write backups to it =/

Renuka -'s picture

Hello Trey;
Firstly you need to have a trust relationship betwen the two domains.
Then you need to share the folder with full controll to everyone.

Additional Information :
For information on the recent VERITAS Backup Exec security vulnerabilities, including links to the downloads for the necessary hotfixes, please refer to the following document:
Patch summary for Security Advisories VX05-001, VX05-002, VX05-003, VX05-005, VX05-006, VX05-007

http://seer.support.veritas.com/docs/277429.htm

NOTE : If we do not receive your reply within two business days, this post would be marked assumed answeredand would be moved toanswered questions pool.

donlassini's picture

Just FYI for everybody (though it's been some years):

I'm using BEWS 12, and this is still an issue - even though many users reported this since 8.x :-(

I tried using Pass Through-authentication (by creating an account with the same name and password as the Backup Exec service account, just as specified earlier in this post) and this didn't work.
I tried mapping a network drive - the problem is that the network drive won't be accessible from the service processes since network drives are not normally mapped for services.

I just can't help thinking: We have this great product, and they've really thought about many, many things, you can map to individual servers using different credentials when backing up - but the relatively simple task of providing credentials when accessing a datastore is not supported.

I am totally baffled. Many SAN's and NAS's are not members of a domain (and in hosted setups it's not an option at all), so the only way BTD is supported is if you're able to mount the SAN volume using iSCSI (which makes the final solution very inflexible).

*Sigh!*

mwhite412's picture

I have a NAS that does not attach to AD, here is what I did to connect BE to it:
1. Create local account on NAS
2. Create local account on server(this cannot be a DC) that matches the NAS account.
3. Make local server account a local administrator.
4. Set BE services to run under this account.
5. Attach BE back to disk folder to UNC path which if above steps were followed it will connect.