BackupExec 11d and Exchange 2007 Problems

I am at a client right now and we are attempting to get BackupExec 11d working with their Storage Area Network (SAN) and a Quantam Scalar i500 tape library system. The issue we are having is that when we try to back up the Exchange Information Store, we are getting an Access Denied message. Naturally with this type of message, we figure that the account on Backup Exec does not have permission to the Information Store. This brings me to this article here. We have properly given the user account all permissions needed to the Information Store. We also tried using a different account that had the same permissions as the article I have just linked, but also ran a couple Exchange Management Shell (EMS) commands to give that user account access to the Exchange Information Stores as well as user’s individual e-mail boxes:

Get-MailboxDatabase | add-adpermission -User “BackupExecAccount” -ExtendedRights Receive-As
Get-MailboxDatabase | add-adpermission -User “BackupExecAccount” -ExtendedRights Send-As
Get-Mailbox | add-mailboxpermission -User “BackupExecAccount” -AccessRights FullAccess

We verified that the BackupExec account does have a mailbox on the Exchange 2007 server and it is not being hidden from the GAL. This user is a local administrator on our Exchange 2007 box due to the user being a Domain Administrator user as well as an Exchange Organization Administrator. I’m not really sure what else it needs access to in order to be able to back up Exchange. We have followed the BackupExec documentation precisely and when that didn’t work, we even tried giving that user account additional permissions to the stores and mailboxes. We even logged on as this BackupExec user and opened up other user’s mailboxes just fine.

So because of all our issues, we initially though we are doing something wrong. Before we began searching on the internet, we ran a few more tests. We found out that when we back up the Information Store to disk, it works fine and we can see navigate the backup granularly. When I say granularly, I mean that we can navigate all the way down to a user’s mailbox. When we attempt to back up to our Quantam Scalar i500, that is when we get our access denied. Because of this new discovery, we figured it was a driver issue. We tried using the generic Microsoft drivers, Symantec BackupExec drivers, as well as Quantam’s drivers. Much to our dismay, drivers did not fix the issue. In addition to this issue, even when we back up to disk, we cannot do any restores.

So this is when we began digging deeper online. I found the following articles:
https://forums.symantec.com/syment/board/message?board.id=115&message.id=7386
https://forums.symantec.com/syment/board/message?board.id=115&message.id=13559

These two links describe the issues we are having. So it looks as though we are not alone. Many other people are having these issues. What I don’t understand is, this is a very big thing. How can BackupExec be released and not have full functionality with backing up to disk? I could understand if it was a driver issue with the tape library system we are using, but it is ridiculous that so many people are having issues with backing up to tape library. Not to mention that when we do actually back up to disk and it works, we have problems restoring items.

So to conclude, I would just like to say that I am disgusted at Symantec for releasing a product with so many issues. Not too mention they were having many complaints regarding these issues and took them several months to acknowledge these issues according to other users. We can only hope now that Symantec will hastily fix their product, do adequate testing, and release a product that works as intended. I will post updates to this as we find out more information.

Update

I feel really bad about posting this blog entry, but we have made a mistake. Apparently the client we were working with applied a registry hack which prevents certain MAPI clients from accessing the Exchange Server. The client implemented this because they wanted only Outlook 2007 clients from connecting to Exchange. You can see the KB article on how to do this here. Since Backup Exec makes a MAPI connection to the Exchange Server, it gets denied since it’s not recognized as an Outlook 2007 MAPI connection. Once this registry modification was undone and the Exchange server rebooted, Backup Exec works completely as advertised. Backup Exec is an excellent product and we have been very satisfied with the product.