Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

BESA has correct privileges but BE support tool dispays "Not Set."

Created: 26 Sep 2013 • Updated: 10 Oct 2013 | 4 comments
This issue has been solved. See solution.

Using Backup Exec 2012

Problem:  Unable to run a restore.  Receive the error:  "The logon account that was provded is not a member of the Administrators group.  Verify that the data that you selected was backed up.  Additional privileges may be required to access the data on the Windows computer.."

Troubleshooting I performed:

  • Ran the BE Support Tool to check service account credentials: The results:  Create Token Object = not set, Log on as a Batch Job = not set, and Log on as a Service = not set.
  • Verified the following  BESA rights are correct under Local policy on media server, and in GPO:
  •    -  Act as part of the os
  •    -  Backup files and directories
  •    -  Create a token object
  •    -  Log on as a batch job
  •    -  Log on as a service
  •    -  Manage autiting and security log
  •    -  Restore files and directories
  •    -  Take ownership of files and other objects.
  • Verified BESA is listed in AD Administratiors group.
  • Added BESA to the local Administrators group.
  • Ran  gpudate /force (even though I did not change a polcy setting).
  • Verified under Services.msc that the following are running and assigned to the BESA:
  •    - BE Device & Media Service
  •    - BE Server Service
  •    - BE Job Enginer
  • Verified under Services.msc that the other BE services are running..

Any help is much appreciated.

 
Operating Systems:

Comments 4 CommentsJump to latest comment

Donald Eady's picture

You stated that when you ran the support tool that the rights logon as a batch and logon as a service were not given to the BESA.. did you make this correction and also you may want to verify that DENY logon as a batch and DENY logon as a service wasnt selected by mistake as this is a common error. 

Also under services.msc verify that all services are configured as per the chart in this technote

additionally what is it that youre trying to restore?

I hope this posting was helpful

  

pkh's picture

Create Token Object = not set, Log on as a Batch Job = not set, and Log on as a Service = not set.

You need to give these privileges to the BESA.  See these documents

Requirements for the Backup Exec Service Account (BESA).

How to define/grant the required user rights/permissions for a Backup Exec Service Account ( BESA )

KD10's picture

Hi Donald & PKH,

Thanks for your responses.  Prior to my initial post I used the technotes you provided to confirm the privileges are set correctly in the GPO and local policy (both DENIES are not selected).  It was when I ran the support tool that the “not set” displayed for Create Token, Logon as Batch, and Log on as Service. 

Where I am confused is:

  1. Why the support tool displays “not set” when the user privileges are correctly set in the policies?
  2. Where do I make the change if the user privileges are correctly set in the policies?

I am trying to restore one user’s files from a particular subfolder on a file server.  However, when I couldn't perform this restore I tried test restores from other servers and received the same error msg listed in my original post.

Donald – I am unable to open your “this” technote link regarding services.msc.  I receive the error msg “IE cannot display the webpage.”  I checked the services again and they are running on the media server & are listed as follows:

  • BE Agent Browser = BSEA
  • BE Device & Media Service = BESA
  • BE Error Recording Service = local system
  • BE Job Engine = BESA
  • BE Management Service = BESA
  • BE Remote Agent = local system
  • BE Server = BESA

Regards,

KD10

KD10's picture

Hello,

Update….and closing this discussion thread.

Even though the BESA permission settings are correct, my inability to restore is a result of the permissions on a folder structure on the Win’2008 server where I am trying to place the files.  I couldn’t restore files from other servers because I was trying to restore the files to this same “problem” server. I incorrectly made the initial assumption the problem is with the “restore” function.

 The restore function works fine when restoring the files onto other servers (2003 and 2008). 

SOLUTION