How to verify the nbwebsvc account has the proper permissions to install NetBackup 8.x

Description

Pre Install Steps

In preparation to install NetBackup 8.0 on Windows and Unix, it is necessary to create a custom User and a Group in advance of the installation.  These credentials are required in order to walk through the NetBackup 8.0 installation sequence and will ultimately be used by the NetBackup Web Management Console service.

For more information, see technical article: 100023872

As noted in technical article 100023872 on Windows hosts, the nbwebsvc account needs to be granted the " Log on as a service" permission so NetBackup can properly use the account.

For Windows systems that will be used as a NetBackup master server, to verify if the nbwebsvc account has the proper "Log on as a service" permissions, run these commands at an Administrator command prompt, then review the output files:

secedit /export /areas USER_RIGHTS /cfg C:\rights_list.txt
wmic useraccount get name,sid > C:\sid_list.txt

Within rights_list.txt, find the row that starts with "SeServiceLogonRight". This is the equivalent to “Log on as a service”.  This row will list all of the accounts which have been granted this permission.

Example:
SeServiceLogonRight = nbwebsvc,nbwebgrp,Administrator,*S-1-5-80-0
or
SeServiceLogonRight = *S-1-5-21-742326382-1242564143-4153653371-3603,*S-1-5-80-0

Note: Domain accounts will list themselves using their Security ID (SID), but Local accounts will display the username.  To discover the domain account that corresponds to a particular SID, find the SID in the  sid_list.txt file.

Post Install Review

The nbwmc service user account and group used during the install of NetBackup 8.0 can ONLY be changed by following specific steps.  If the service account is adjusted without following proper steps, the service will fail to run after the adjustment.  Refer to this document for steps on how to change the nbwmc service user or group, post-install: 100047147

The user account password can be changed on unix master servers without taking additional steps (beyond restarting nbwmc).

The user account password can be changed on Windows, the only additional step is to update the "NetBackup Web Management Console" service's user account password accordingly.

To verify which account and group were specified during the NetBackup 8.0 install sequence, locate the install log created when NetBackup 8.0 was installed.

Examples:
C:\ProgramData\Symantec\NetBackup\InstallLogs\NetBackup.Install.xxx.xxx.log
or
C:\ProgramData\Veritas\NetBackup\InstallLogs\NetBackup.Install.xxx.xxx.log

Within the log, look for the following lines:

Install Log Example of Domain Account and Group:
12-16-2016,10:15:19 :  property: WEBSVC_ACCOUNT_TYPE
12-16-2016,10:15:19 :       default....
12-16-2016,10:15:19 :       existing... Domain
12-16-2016,10:15:19 :       resolved...
12-16-2016,10:15:19 :       action.....no change
12-16-2016,10:15:19 :  property: WEBSVC_DOMAIN
12-16-2016,10:15:19 :       default....
12-16-2016,10:15:19 :       existing... vlab1
12-16-2016,10:15:19 :       resolved...
12-16-2016,10:15:19 :       action.....no change
12-16-2016,10:15:19 :  property: WEBSVC_GROUP
12-16-2016,10:15:19 :       default....
12-16-2016,10:15:19 :       existing... nbwebgrp
12-16-2016,10:15:19 :       resolved...
12-16-2016,10:15:19 :       action.....no change
12-16-2016,10:15:19 :  property: WEBSVC_USER
12-16-2016,10:15:19 :       default....
12-16-2016,10:15:20 :       existing... nbwebsvc
12-16-2016,10:15:20 :       resolved...
12-16-2016,10:15:20 :       action.....no change

In this example, the domain account specified during installation was vlab1\ nbwebsvc in the domain group nbwebgrp.

Install Log Example of Local Account and Group:
12-14-2016,08:22:11 :  property: WEBSVC_ACCOUNT_TYPE
12-14-2016,08:22:11 :       default....
12-14-2016,08:22:11 :       existing... Local
12-14-2016,08:22:11 :       resolved...
12-14-2016,08:22:11 :       action.....no change
12-14-2016,08:22:11 :  property: WEBSVC_DOMAIN
12-14-2016,08:22:11 :       default....
12-14-2016,08:22:11 :       existing... 
12-14-2016,08:22:11 :       resolved...
12-14-2016,08:22:11 :       action.....no change
12-14-2016,08:22:11 :  property: WEBSVC_GROUP
12-14-2016,08:22:11 :       default....
12-14-2016,08:22:11 :       existing... nbwebgrp
12-14-2016,08:22:11 :       resolved...
12-14-2016,08:22:11 :       action.....no change
12-14-2016,08:22:11 :  property: WEBSVC_USER
12-14-2016,08:22:11 :       default....
12-14-2016,08:22:11 :       existing... nbwebsvc
12-14-2016,08:22:11 :       resolved...
12-14-2016,08:22:11 :       action.....no change

This example shows the local account nbwebsvc in the local nbwebgrp.