Video Screencast Help

Backup Exec Selection List Browse Error

Created: 27 Feb 2014 • Updated: 03 Mar 2014 | 5 comments
This issue has been solved. See solution.

Hello,

I am running Backup Exec 2012 as a trial in order to determine if it suitable for the purposes of backing up all of our servers.  It was going so well installing the agent until I get to one server which is reporting a 'Browse Failure' error message when I try to look at a selection list for the purpose of creating a new backup job.  All other servers added work, all servers are using a centralised domain service account which has the following group membership:

* Backup Operators

* Domain Admins

* Users

The server that the browse failure is failing on is a Windows Server 2003 Standard Edition SP2 (confirmed it is still supported).  I have tried to address the possible causes by updating the Local Security Policy on the affected server by assigning the following user rights:

- create a token object
- log on as a batch job
- log on as a service

Still no joy.  I have also removed the server from Backup Exec, added it again and applied any updates for the Remote Agent.  I have also performed a full uninstall and reinstall of the Remote Agent on the affected server.

Please could somebody take a look at the attached debug log file as I cannot identify what the underlying cause is through the log file?

Regards,

 

Gary Hall.

Operating Systems:

Comments 5 CommentsJump to latest comment

CraigV's picture

Hi,

 

Is the RAWS agent service running on the remote server, and if there is a firewall running, can you open port 10000?

THanks!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

Gary.D.Hall's picture

Hello,

Yes the RAWs agent service is running on the affected server, a traceroute shows that the two servers connect directly (no router or firewall inbetween).  Windows Firewall is disabled on both servers.  Netstat confirms that the beremote.exe process is listening on port 10000 on the affected server.

If it helps any further our subnet mask is 255.255.252.0 with the Backup Exec Server having an IP address of 10.44.203.1 and the affected server having an IP address of 10.44.202.125.  I have heard in the past problems with different networks but I believe both of these servers are in the same network due to the subnet mask.

Thanks.

Gary Hall.

lmosla's picture

Hello,

Please verify BE 2012 is fully patched with all the Live Updates and afterwards make sure the remote agent is repushed to the remote servers.

Add these User rights in group policy and group memberships:

•Manage auditing and security log.
•Backup files and directories.
•Restore files and directories.
 
and run the gpupdate command to refresh local and group policy settings 
Requirements for the Backup Exec Service Account (BESA): http://www.symantec.com/docs/TECH36718 
Gary.D.Hall's picture

Hello Imosla,

Yes Backup Exec 2012 is up to date and all servers have had the Update job applied which pushes any new agent to them as a result of any LiveUpdate changes to the remote agent installer.

Yes I have added the user rights assignments directly through Local Security Policy directly to the Backup Exec Service Account as I have read TECH36718 previously.  Although it seems odd to do this seeing as the service account is a member of the Backup Operators group which has also been given these rights....

Therefore I thought what if Symantec have missed something in this article and what do I have configured in Group Policy that imposes a restriction.  The only thing I could think of is that our Service Accounts are just that Service Accounts, you cannot log onto a server with them at the console or through RDP as we have locked the Service Accounts down through Group Policy.  Therefore I removed this restriction and sure enough I now get a selection list shown when creating a backup job.  I have confirmed that this is the cause of the problem by re-applying the Group Policy and the same error re-appears.

Through reducing the scope of the restriction I have identified if the Deny Logon Locally user right assignment applies to the Backup Exec Service Account then you cannot browse a Windows 2003 server to create a selection list without removing this user right assignment, it does not affect Windows Server 2008 (Windows Server 2012 has not been tested).  I am going to next try and create the selection list and then put the restriction back in place to determine if it has an impact on the actual backup job running or if it only applies to the browse server functionality when creating a selection list.

Thanks.

SOLUTION
Gary.D.Hall's picture

Hello,

Just an update on this issue.  Once Group Policy refreshed and reapplied the Deny Logon Locally user right assignment the backups for the server started to fail, the error identifies that an attempt to browse failed. 

In conclusion you cannot create a backup service account and prevent logon to a server console using the Deny Logon Locally user right assignment if you are using Backup Exec 2012 to backup any Windows 2003 server's.

Please could this be raised as a bug and/or please could you update all of your documentation to reflect this issue, especially TECH36718.

Thanks.