How to define/grant the required user rights/permissions for a Backup Exec Service Account (BESA)

Backup Selection browse fails with error "Failure to browse server"

Or

The backup selections show All Resources with nothing is available for selection beneath as shown in Figure 1.
 

Figure 1:

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers. By default, there are no users denied logon as a batch job.

 

[ D ] This issue may occur due to lack of permissions. If the Backup Exec Logon Account is not a member of local administrators or is a member of some group that has restrictions, a connection cannot be made to the resources available for selection.


[ E ] This issue may occurs if the Remote Agent for Windows Server (RAWS) service is stopped. As the Job engine service is dependent on RAWS, the Job Engine service will also be stopped.

[ A ] Reset the password for the Backup Exec System Logon Account (network > logon accounts) and/or the Backup Exec Service Account (Tools > Backup Exec services > Services Credentials) to match the password set in Active Directory or that of the Local Administrator user account.

 

[ B ] All Backup Exec (tm) Services on the media server, with the exception of the Backup Exec Remote Agent, run in the context of a user account configured for Backup Exec System Services. This account can be created during the Backup Exec installation, or an existing user account can be used. To create a service account for Backup Exec during installation, supply a user name and password when prompted. The account designated for Backup Exec services, whether it is a new account or an existing user account, will require the following rights:

For more information on any of the above User Rights Assignment please refer to : https://technet.microsoft.com/en-us/library/cc780182(WS.10).aspx.

Note: Due to security implementations in Microsoft Small Business Server, the service account must be "Administrator".
 

 

For Windows 2016 / 2019

For Windows 2008 / 2008 R2 / 2012 / 2012 R2

For Windows 2003 / 2003 R2

 

For Windows 2016 / 2019 :

1. Go to Start | Programs | Administrative Tools | Group Policy Management.

2. From the left pane, expand Domains | Domain_Name | Group Policy Objects.

3. Right click on Default Domain Controllers Policy and click on Edit.

Ensure that the group policy being edited is set to Enforced or else the changes would not apply.

4. From the left pane, expand Computer Configuration and go to  Policies | Windows Settings | Security Settings | Local Policies | User Rights Assignments.

5. From the right pane, right-click Log on as a batch Job --> Properties.

6. Click Add user or Group.

7. For the Add user or Group window, click Browse

8. Type the desired user account to act as your Backup Exec System Account, then click Browse and then click Ok.

9. Back in the "Group Policy Management Editor" note that your Backup Exec System Account now has "Log on as a batch Job" privilege.

10. Repeat steps 1 through 9 for any additional policies.
 

[ C ] Make sure the BESA is NOT included in the 'Deny Logon as a Batch' or 'Deny Logon as a service' because the deny supersedes the allow and even  adding the account under 'Logon as a Batch' or 'Logon as a service' would not resolve the issue.

Refresh the group policy

Click Start > Run and type gpupdate /target: computer /force (this will force update the Group Policy) 

 

For Windows 2008 / 2008 R2 / 2012 / 2012 R2 :

1. Go to Start | Programs | Administrative Tools | Group Policy Management.

2. From the left pane, expand Domains | Domain_Name | Group Policy Objects.

3. Right click on Default Domain Controllers Policy and click on Edit. 

Ensure that the group policy being edited is set to Enforced or else the changes would not apply.

4. From the left pane, expand Computer Configuration and go to  Windows Settings | Security Settings | Local Policies | User Rights Assignments.

5. From the right pane, right-click Create a token object.

6. Click "Add user or Group".

7. For the "Add user or Group" window, click Browse.

8. Type the desired user account to act as your Backup Exec System Account, then click Browse and then click Ok.

9. Back in the "Group Policy Management Editor" note that your Backup Exec System Account now has "Create a token object" privilege.

6. Repeat steps 1 through 9 for any additional policies.
 

[ C ] Make sure the BESA is NOT included in the 'Deny Logon as a Batch' or 'Deny Logon as a service' because the deny supersedes the allow and even  adding the account under 'Logon as a Batch' or 'Logon as a service' would not resolve the issue. (Figure 4)

For Windows 2003 / 2003 R2 :

1. On the domain controller, click Start | Programs | Administrative Tools | Active Directory Users and Computers.

2. From the left pane, expand the Domain name, and right-click Domain Controllers organizational unit, and then select Properties.

3. Select the Group Policy tab.

4. Select the Default Domain Controllers Policy and then click Edit (Figure 2).

Figure 2
 

5. From the left pane, expand Computer Configuration and go to Policies | Windows Settings | Security Settings | Local Policies | User Rights Assignments.