netplwiz hang / BackupAssist Exchange Server failed backup - fix for either will do!

[ianh64]

I am currently trialling BackupAssist on our Server 2008R2 system. I have a problem backing up our remote Exchange Server 2010 mailboxes.

 

I have been in contact with BackupAssist (BA) and they say that I need to create a local non domain dedicated account for BA on our BA host in addition to our domain dedicated BA account.

 

When I try and create this local account, the add user dialogue stops responding and the event logs indicate a netplwiz.exe application hang. Runnin netplwiz.exe and alternatives all result in the same non responsiveness. I left it running overnight and still the same. When the command was killed, no user was created.

 

Scouring the web, seems like I am not alone with this, but I have yet to find a solution. Seems like people get it even on a fresh install - some have hinted its AD related.

 

So I'm stuck between a rock and a hard place. I can't get BA Exchange Backup to work without adding the user.

 

If anyone has solutions for either, I'm all ears. In return, if anyone is having problems with SQL Server remote backup via BA, I fathomed that one out so can pass this knowledge on.

[ianh64]

BUMP

 

Can everyone else add local users to their AD server without netplwiz (no matter what method it is invoked, ie directly, via add user control panel etc) going non responsive then going into apphang state? Looking on the web, many other people have the same issue. But I cannot find a solution, although experts exchange looks like it may have one, but won't let me see the solution unless I provide CC details and risk a monthly charge, which I am not going to do.

[sukh]

1. Where are you trying to create the account?

2. Is that server a member server only?

3. Is BA your only option or can you use native Windows backup?

4. What's in the event log and can you post/upload the exact error?

[ianh64]

Thanks for assisting...

 

1. On the server - User accounts/Manage User Accounts/Add. It also does it when running netplwiz direct or via other means that ultimately invoke netplwiz. I have tried leaving domain blank and putting the host name in. It could be something silly like I am not putting the right info in add user dialog boxes.

2. Its a domain controller

3. We are using BA to backup user mailboxes on a remote exchange server via Exchange Mailbox add-on.. BA support say that we need to add an additional local user with administrator privs with exactly the same name as the domain user (domain admin) that we run BA with. I am sceptical but BA support wont progress unless we exhaust this avenue.

4. See below:

 

 

Log Name: Application

Source: Application Hang

Date: 13/01/2012 10:32:55

Event ID: 1002

Task Category: (101)

Level: Error

Keywords: Classic

User: N/A

Computer: griffin.xxx.school

Description:

The program NetplWiz.exe version 6.1.7600.16385 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 7398

Start Time: 01ccd1de4c931223

Termination Time: 15

Application Path: C:\Windows\system32\NetplWiz.exe

Report Id: ea482112-3dd1-11e1-bda6-0010186ba802

[sukh]

1. Just to clarify, is Exchange installed on a DC?

2. if yes, you can't have a local account on a DC, this wont work, it's a DC.

3. Where does it say that you need a local account for BA too?

4. I assume it's trying to use the same SAM name as the domain account.

[ianh64]

1. No. exchange is on a remote non DC server

2. ? I cannot have a local user on a DC or only if Exchange is installed?

3. BA technical support says so

4. ?

[Michael]

For your reference, you cannot create local accounts on a domain controller, but only on a member server. This is irrelevant whether Exchange or SQL is installed. It's by design.

 

Local accounts can only be setup on member servers and seeing as you have Exchange on a member server, you need to install BA on this server and setup a local account as BA support have recommended. Why they've recommended this is unclear however.

[sukh]

1. My last post never made it here, no you can't setup local accounts on a DC, local accounts before a dcpromo are turned into domain accounts.

2. It seems like you're trying to do it remotely which may not work on 2008 and you have to do a local install as per KB - http://www.backupassist.com/downloads/whitepapers/ExchangeBackupAndRestore_WP.pdf

3. I assume they mean create a local account on Exch and configure BA.

[ianh64]

Hi

 

Thanks for the link. The link is for the standard backup assist not the Exchange Mailbox add-on which is what we are using. The Exchange Mailbox add-in allows backing up of exchange mailboxes from a remote machine which is exactly what we want to do. However, the white paper you posted contained a link to the exchange mailbox add-on which I had not seen before. So I will go through this carefully and see if I am missing anything.

 

Personally I think the requirement for a local admin user is phooey and the fact that I can successfully perform the initial export but not the automated backups probably indicates something like permissions - I encountered similar with the SQL remote backup but thankfully the SQL logs were more helpful and I could track down the permissioning error - mainly due to SQL server running as a network service so I needed to make sure that there were suitable permissions setup for the network service to write to the relevant folders and shares that BA expects. If I was a betting man, I would bet on it being similar with Exchange 2010 - I just need to find what Exchange is running as and where it is trying to write to.

 

-Ian

[sukh]

1. What error are you exactly getting when you try?

[ianh64]

Hi

 

Thanks for the continuing assistance.

 

Backup Assist reports the following error for every Exchange user. I assume its an error initially reported by Exchange Server 2010.

 

Exchange Mailbox for LEO: January - March 2012	BA4320 Exbackup failed when preparing to backup one or more mailboxes
Help
Additional Information:	(E) [Folder ''] CreateMMAPIMailboxSession: MMAPICreateExchangeMailboxSession(LEO, "/o=xxx School/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=Alexander.C") failed * (E) [Folder ''] MutexedCreateServiceA: CreateMsgService(MSEMS) error -- Specified item not found* Completion code: 20

 

I am suspicious of the [Folder ''] bit which possibly indicates that some folder has not been correctly specified. But I cannot find any way of knowing what BA is actually trying to get Exchange to do. The Event log on the server is does not provide any more information. The only thing that I can find on the remote (LEO Exchange Server) machine is the BA backupdevice account successfully logging in (login type 3), then about 15 second later, logging out.

 

The initial manual export of mailboxes occurs correctly and the .pst folders are successfully created. This is run from the administrator account on the Backup Assist server (GRIFFIN), which is also a DC. The Exchange Server (LEO) is a hyper-V server. Both are running 2008R2.

 

However, when the backup itself starts, it runs under the (effectively non interactive) user account "backupdevice" which is in the Users OW, primary group Domain Users (tried also Domain Admins) and is as member of the following groups : Administrators, Backup Operators, Domain Admins, Domain Users, Organizational Management and Schema Admins. When the backup runs, it fails with the error above. I wonder if I need to additionally give it Enterprise Admins and Group Policy Creator Owners just to make it the same as the Administrator account.

[sukh]

That's seems to be more of an BA issue not Exchange.

 

If you were to backup using the native windows backups I'm sure that would work, if you want/can try this this will prove it's a config issue/setup issue with BA.

 

Something similar here - BackupAssist Support Forum • View topic - Exchange 2007 Issue

[Stuart_E]

Hi Ianh,

 

It's Stuart here and I'm a level 3 technician for BackupAssist. I came across this forum and thought I may be able to help contribute.

 

Looking over the details this is my current understanding of your configuration:

 

1 Server running Server 2008 R2 which has BackupAssist (unsure exact BA version).

1 Server running Exchange 2010

 

Both systems are running on the same domain (I'm not 100% sure on this however - can you confirm for me?).

 

 

If both systems are running on the same domain; then you don't need to create a 'local' user at all. By the sounds of it; you're able to detect the Exchange server through BackupAssist and select which mailboxes you wish to back up. If you required the local/domain matching accounts then you wouldn't have made it that far.

 

The reason for the local user and a domain user is when you're attempting to backup Exchange mailboxes from a Hyper-V Host (physical) machine while your Exchange server is within a Hyper-V guest (virtual). Microsoft recommended best practice is that the host machine should be on the separate work-group and not the same domain as the guest machines. MS MVP Philip Elder indicates this at social.technet.microsoft.com/Forums/en-US/winserverhyperv/thread/b69d782d-9dad-4168-b1af-2efb52629b6e/.

 

To be able to authenticate to the domain from the host we've found that creating a local/work-group account on the Host and a Domain account on the guests with exactly the same username and password allow for a pass-through effect.

 

Now I do notice that you said the manual export of the mailboxes worked; however the backup doesn't work when the scheduled backup runs.

 

Have you tried being logged in as the same user when a scheduled backup runs as you were when you ran the manual export?

It could be something to do with permissions on the account running the BackupAssist service. I've seen in the past that people have had successful scheduled backups when logged in as a user; however if they log out of Windows and leave the machine alone while the exact same backup runs and encounter errors.

 

This would indicate a permissions issue with the local system account (which by default is used to run the BackupAssist service). I'm not a permissions guru by any stretch; however I believe that sometimes the local system account binds itself to the user currently logged in - which maybe allowing greater access in your case.

 

Also make sure that you're running the latest update for the BackupAssist version your running (either v5.4.8 or v6.2.8). They're located on the BackupAssist website.

 

Apologies as well for not posting links - apparently I need to post a few more times before I can do this.

 

Give these suggestion a try Ian and let me know the result.

 

Thanks,

Stuart

[ianh64]

This is now resolved.

 

Michael at BA remotely investigated this and we found a working solution.

 

For future reference...

 

Basically I was not doing anything wrong but there is some anomaly with the BA software that I found. When performing a manual export, everything worked fine however when running as a job in conjunction with other file backup jobs, it failed.

 

The solution was to create a dedicated exchange backup job and not run with other file backup jobs. When this was done, the automated backups worked fine.

 

My initial reason for keeping Exchange backup as part of file backup was to resolve any scheduling issues with running two jobs close together. After learning a bit more about BA I now see this as a non issue as if BA handles all backup jobs it will queue jobs until late running backups complete.

 

All in all, BA is a pretty good product that I can recommend, especially with the educational discounts that they offer. As I found, it's not always quite as easy to configure things as maybe it should, but support is good and for very modest cost is a great time saver for some of the backup jobs that cannot be easily achieved with MS backup alone.