Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

BackupExec 2010R3: Hyper-v Windows 2012 DataCenter cluster backup failed with error 0x80070005 (Access Denied)

Created: 15 Dec 2012 • Updated: 29 Jan 2013 | 6 comments
This issue has been solved. See solution.

 

Hello!

I have Windows 2012Datacenter (Russian) Cluster with Cluster Shared Volumes (for VMs). when  I try to backup (Backupexec 2010 R3) VM from this cluster I have error:

Volume Shadow Copy Service error: Unexpected error query interface IVssWriterCallback. hr = 0x80070005, Access is denied.
. The most likely reason - incorrect security settings requesting process or recording process.
operation:
    Data collection by the writer
context:
    Class Code Writer: {e8132975-6f93-4464-a53e-1050253ae220}
    Name the writer: System Writer
    Writer Instance ID: {a5550c18-d3f0-4a2a-ab53-e908b8152a5d}

 

PS - i have same standalone 2012 server  - all backups VM from this server goes without any error!

PS2 - i try change DCOM security on some cluster hosts - but it did not help...

(...

Go to DCOM setup : dcomcnfg --> Expand Component Services, Computers --> Right-click My Computer --> Properties --> COM Security tab. 
Under Access Permission click Edit Default. --> add the "Network Service" account with Local Access allowed. 
Restart the computer ! 
no more 8194 error.

...)

PS3 all servers disks for all servers placed on  CX3-80 storage (Fiber).

PS4. if i try to backup CSV volume (with VM's folders) - all is OK! - without any error!

Comments 6 CommentsJump to latest comment

psj_symhelp's picture

There are two ways to clear the problem.

The first is to locate the VSS writers (Start | Run | services.msc) that are erring out and change the account they are running under from Network Service to Local System. Then, restart the service process (or reboot the computer) and the VSS Writer will run with max privileges - thereby eliminating the IVssWriter callback errors.

The possible security issue with this method is that the service will be running with a higher level of access than Microsoft intended. Should the VSS Writer process be "hacked", this could be a security weakness. But, if you're not overly concerned about that, repeat this process for each VSS Writer that generates an 8194 error and you should not experience any more error events in normal operation.

The second (preferred) way to work around the issue is to make an adjustment to the default COM service activation permissions - allowing Network Service (and possibly Local Service) user account(s) to activate the IVssWriter callback interface. This method has the benefit of permanently fixing the issue in one place and allowing the VSS Writer service(s) to run at the privilege level that Microsoft intended. Any COM object accessed (by a process running as Network Service) still has the ability to enforce security restrictions it so chooses.

Make this fix by doing the follow: Start | Run | dcomcnfg. This bring up the Component Services application. On the left pane navigate to Component Services | Computer | MyComputer. Right click on MyComputer and select properties. Select the COM Security tab and select the Edit Default button under Access Permissions. Use the Add... button to add the "Network Service" account to the permission list. Verify that ONLY the Local Access box is checked and click OK. Close out of Component Services. A reboot is then required to make the requested changes to COM Security.
 

pkh's picture

If you are going to quote extensively from a source, like

http://help.remote-backup.com/index.php?/Knowledge...

it would be better that you provide a link to the source.  Otherwise, people may think that you are plagarising.

bbash@mail.ru's picture

 

1) i change dcom security (second way) - grant NetwotkService Local Access permissions
 
when i try to backup VM i got new errors in winodws log(vss 12297,vss 12298):
 
Volume Shadow Copy Service error: Recording I / O can not be reset while creating the volume shadow copy \ \? \ Volume {f339624e-4416-11e2-93e7-806e6f6e6963} \. Index volume set of shadow copies is 0. Error details: Open [0x00000000, The operation completed successfully.
], Flush [0x80042313, shadow copy provider exceeded timeout resetting data Volume Shadow Copy. This may be due to the high volume of activity. Please try again later, when that will be used is not as active.
], Release [0x00000000, The operation completed successfully.
], OnRun [0x00000000, The operation completed successfully.
].
operation:    Asynchronous operation
context:    Current state: DoSnapshotSet
 
Volume Shadow Copy Service error: Recording I / O can not be used while creating the volume shadow copy \ \? \ Volume {69998e2e-89ca-4a29-8f6c-5018e442c07b} \. Index volume set of shadow copies is 1. Error details: Open [0x00000000, The operation completed successfully.
], Flush [0x00000000, The operation completed successfully.
], Release [0x80042314, shadow copy provider exceeded a timeout while waiting for records when the Volume Shadow Copy. This may be due to the high volume of activity caused by the application or system service. Please try again later, when the load on the volume will be reduced.
], OnRun [0x00000000, The operation completed successfully.
].
operation:    Asynchronous operation
ontext:    Current state: DoSnapshotSet
 
 
in backupexec - 
- AOFO: Initialization failure on: "VRTSRV::\\cluster_domain.local\Hyper-V?HA?VM\TechProgrammer". Advanced Open File Option used: Microsoft Volume Shadow Copy Service (VSS).
 
V-79-10000-11230 - VSS Snapshot error. Unable to get minimum quiet time for physical volumes. Reduce the activity on these volumes, or wait and run the backup when there is less activity on the volumes.
 
i try tu stop VM and retry backup without any disk activity - and have same error...
 
vssadmin say:
 
Writer name: 'Microsoft Hyper-V VSS Writer'
   Writer Id: {66841cd4-6ded-4f4b-8f17-fd23f8ddc3de}
   Writer Instance Id: {d64f4ac0-1ceb-4121-ac94-2f854a4cc8c9}
   State: [9] Failed
   Last error: Timed out
pkh's picture

If I understand you correctly, you are trying to backup a media server which is a VM.  Symantec does not recommend the use of a VM for a media server because you would probably encounter problems accessing physical devices.  You should always use a separate physical server for your media server.

bbash@mail.ru's picture

i have:

1) symantec backupexec 2010R3 - hardware server

2) some cluster nodes with VM's on CSV

3) some standalone server with VM's

 

(1) make backup of all VM's, placed on (3) without  errors.

(1) not make any VM's backups from (2)

 

PS/ ALL hardware in servers are identical - model DELL m600/

pkh's picture

I have Windows 2012Datacenter (Russian) Cluster

Windows 2012 is not supported.  See the SCL below

BE 2010|2010 R2|2010 R3 Software (SCL)

SOLUTION