System State Backup of Domain Controller fails with Access Denied error.

Issue

System State Backup of Domain Controller fails with Access Denied error , even if the logon account has all the required rights.

Error

Final error: 0xe000fe7d - Access is denied.
To back up or restore System State, administrator privileges are required.
Final error category: Security Errors.

Solution

Workaround:

 

Adding the following registry key to bypass the credential check on both the backup server and the remote server can resolve the issue.

To add the registry key, use the following procedure:

 

1. On the server receiving the error message, go to Start | Run

2. Type regedt32 and click OK

 

Warning: Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

 

3. Locate HKEY_LOCAL_MACHINE\Software\Symantec\Backup Exec for Windows\backup Exec\Engine\NTFS

4. On the right pane of the window, Right click in the empty space and click on Dword value

5. In the New Value dialog box, type useAdSSCheck

 

Note: Registry values are case-sensitive.

 

6. In the DWORD Editor dialog box, set the Data value to 0

 

7. Stop and restart all Backup Exec services 

 

After installing Symantec Endpoint Protection, Microsoft Outlook displays an add-in error dialog

Issue

Following the installation of the Symantec Endpoint Protection (SEP) client, launching Outlook results in an error dialog: "The Add-in 'Symantec Antivirus Outlook Protection' (C:\Program Files\Common Files\Symantec Shared\vpmsece.dll) cannot be loaded and has been disabled by Outlook.  Please contact the add-in manufacturer for an update.  If no update is available, please uninstall the add-in." How can this be resolved?

Cause

The optional Outlook plug-in was not uninstalled correctly during the SEP installation process, potentially due to install-time file locking issues.

Solution

For greatest compatibility, always be sure that the most recent release of SEP is being installed.  Also ensure that a supported release of Outlook is in use.
At least two potential solutions for this problem exist.

(1) Delete the file C:\Documents and Settings\%username%\Local Settings\Application Data\Microsoft\Outlook\extend.dat and allow the file to be re-created when Outlook is started.

(2) Disable the Symantec AntiVirus Outlook Protection component from within Outlook:

1. In Outlook click Tools > Trust Center...
2. Click Add-ins
3. Choose Exchange Client Extensions from the Manage: drop down menu and click Go...
4. Uncheck Symantec AntiVirus Outlook Protection
5. Click OK.

Additional information can be found in Outlook attachments are unavailable with the AntiVirus Outlo

Custom Report created using fields from Job History category shows duplicate entries.

Problem

Custom Report created using fields from Job History category shows duplicate entries.

Solution

This issue is solved in Backup Exec 2012

Please make sure to have "show distinct rows" specified

  

1) Click the "Backup Exec" button (i.e. yellow button on top left of console)

2) Select Configuration and Settings --> Backup Exec Settings

3) Click Reports section

4) Change report content from "Show all rows" to "Show distinct rows"

5) Click OK

6) Re-run report

How to specify a date range for Backup Exec Custom Reports

Problem

When creating a custom report within Backup Exec, it may appear that is there no way to specify a date range within the reports interface.

Solution

To create a report that is specific to a specific range of dates, the Filters will need to be used.

Select one or more filters that have date fields associated with them, such as the Job End Time and Job Start Time filters from the Job History Group.

You could then choose "=" as an operator and specify a date for each field, along with other information that is desired in each report.

Backup Exec cannot connect to the Remote Agent because a trust relationship was not established between the Remote Agent and the Media Server.

Problem

Backup Exec 2010 R3 job fails with the error: 0xe0009b86 - Backup Exec cannot connect to the remote agent because a trust relationship was not established between the remote agent and the media server. 

Error

0xe0009b86 / V-79-57344-39814 - Backup Exec cannot connect to the remote agent because a trust relationship was not established between the remote agent and the media server.  To establish a trust relationship, add the remote agent to the Favorite Resources in the backup selections tree.

 

Environment

Backup Exec 2010 R3 & Backup Exec 2012.

Cause

Backup Exec 2010 R3 and above now uses stronger network security protocols to secure communication between media servers and Remote Agents, reducing the possibility that backup or restore operations can be compromised.

When connecting to a remote computer from the media server, a trust relationship must be established between the media server and the remote computer.  In certain situations the trust must be established manually.

Examples:

1. If the Backup Exec 2010 R3 or above Remote agent for Windows (RAWS) is installed manually, the Trust must be established before selecting the remote computer for backup or an existing selection list / job can run.
2. An alternate or new media server is attempting to backup a remote computer where no trust is established.
3. A trust relationship for a remote Linux or UNIX computer must be established first before a backup. 

Note: This error also occurs if Backup Exec Server is trying to backup another media server with same version of RAWS. Ensure that BE is not installed on the target remote server. 

Solution

The trust relationship between the media server and a remote computer can be established manually in a number of ways:

A. Add the remote computer to Favorite Resources

1. Browse to the remote computer in backup selections from the Active Directory Domains orMicrosoft Windows Network domain

2. Browse to the remote computer after adding it to User‐defined Selections

3. Use the Remote Agent Utility on the remote computer to configure publishing option.

B. Manually establishing a trust relationship with a remote computer by adding to Favorite Resources:

1. On the navigation bar, click the arrow next to Backup.

2. Click New Backup Job.

3. On the View by Resource tab, right-click Favorite Resources and choose Add Windows System.

4. Enter the remote computer name in the System Name field.

5. Choose the option to Add a system that already has the Remote Agent installed.

6. Choose or create a Logon Account with appropriate credentials for the remote computer, then clickOK.

7. Click Yes at the prompt to establish the trust relationship.

8. Click OK at the message indicating the system was added successfully.

C. Manually establishing a trust relationship with one or more remote computers by browsing to the domain:

1. On the navigation bar, click the arrow next to Backup.

2. Click New Backup Job.

3. On the View by Resource tab, expand Domains.

4. Do one of the following:

• To select the remote computer from an Active Directory domain, expand Active Directory Domains, and then expand the Active Directory domain where the remote computer resides.
• To select the remote computer from a Microsoft Windows Network domain, expand Microsoft Windows Network, and then expand the domain where the remote computer resides.

5. Do one of the following:

To establish the trust relationship with a single remote computer:
a. Select or expand the remote computer.
b. Click Yes at the prompt to establish the trust relationship.

To establish a trust relationship with more than one remote computer in the same domain:
a. In the results pane on the right, click on the first remote computer to highlight it, but do not select the checkbox.
b. Use the or keys while you click on other remote computers that you want to select.
c. Right‐click the selected computers, and then click Establish trust relationship.

D. Manually establishing a trust relationship with one or more remote computers by adding to User-defined Selections:

1. On the navigation bar, click the arrow net to Backup.

2. Click New Backup Job.

3. On the View by Resource tab, right‐click User‐defined Selections, and then click Manage User‐defined Selections.

4. Type the name or IP address for the remote computer in the Name field and click Add

5. After adding remote computers to the list, click Close.

6. Expand User‐defined Selections in the tree.

7. Do one of the following:

To establish the trust relationship with a single remote computer:a. Select or expand the remote computer.
b. Click Yes at the prompt to establish the trust relationship.

To establish a trust relationship with more than one remote computer in the same domain:a. In the results pane on the right, click on the first remote computer to highlight it, but do not select the checkbox.
b. Use the or keys while you click on other remote computers that you want to select.
c. Right‐click the selected computers, and then click Establish trust relationship.

E. Manually establishing a trust relationship with a remote computer using the Remote Agent Utility:

1. Open the Backup Exec 2010 Remote Agent Utility from the program menu.

2. On the Publishing tab, click Change Settings.

3. After the utility closes and reopens, click the Publishing tab and click Add.

4. Type the name or IP address of the media server, user name, and password in the corresponding fields.
Note: The user must have administrative privileges on the specified media server.

5. Click OK.

6. Click the Security tab and verify that an entry appears for the specified media server.

7. Click OK to close the Remote Agent Utility.

F. Establishing a trust relationship while configuring a remote computer for deduplication

If a trust relationship with the remote computer has not already been established, establish it while configuring the remote computer for deduplication:

1. Open the Tools menu, then choose Configure Remote Agent for Deduplication... from theConfigure Devices submenu.

2. Type the name of the remote computer in the Server field.

3. Choose the port your remote computer is configured to use (default is 10000).

4. Type a description if one is desired.

5. Check or clear the Enable ICMP ping operations checkbox, depending on the network configuration.  If a firewall blocks ICMP, the checkbox will need to be cleared.

6. Choose or create a Logon account with the correct credentials for accessing the remote computer.

7. Click OK.

8. Click Yes at the prompt to establish the trust relationship.

9. Click Restart Now or Restart Later. 

Note: The Backup Exec services on the media server must be restarted before the remote computer can be used for client-side deduplication. 

Backup Exec 2010 R3 remote agent servers do not show up under Favorite resources in the backup selection list.

Problem

After push installing a remote agent the remote agent machine is missing or does not show under Favorite Resources.  The remote agent may show up under Domains or Active Directory selections.

Error

When Debugging the Backup Exec Remote Agent Service with SGMON on the remote machine, an SSL handshake error appears in the debug log. See Related Documents on how to run SGMON.

BEREMOTE DEBUG:

[nrds]               - ConnectToServerEndPoint: dest=SERVER.local, service=6101
[nrds]               - ConnectToServerEndPoint: Failed Client Side SSL handshake.
[BESocket]           - @@@@@@@MyCloseSocket called with sockfd = 1568(0x620) retval = 0
[ndmp\ndmpcomm]      - NrdsAdvertiserThread: connect to target=SERVER.local port=6101 failed
[ndmp\ndmpcomm]      - NrdsAdvertiserThread: Security is enabled!!!

Environment

Backup Exec 2010 R3

Cause

Remote agent is failing to advertise to Media server with "handshake" error.

Solution

This issue is fixed in Hotfix www.symantec.com/docs/TECH161270 (Click the link or See the Related Articles section) 

WORKAROUND:

Select the remote agent server through Active Directory or Domain Sections.