Upgrade to NetBackup 8.0 fails with "Unable to grant the log-on-as-service right to group"

Problem

The upgrade of NetBackup to 8.0 fails and rolls back to the previous version of NetBackup.



 

Error Message

The NetBackup install log (C:\ProgramData\Symantec\NetBackup\InstallLogs \NetBackup.Install.xxxxxxxx.xxxxxx. log) shows the following:

02-20-2017,14:48:59 :  Running command: "C:\Program Files\Veritas\NetBackup\wmc\bin\install\setupWmc.bat" -logFileName "C:\ProgramData\Symantec\NetBackup\InstallLogs\WMC_setupWmc_20170220_144859748.txt".
02-20-2017,14:48:59 :  Waiting for command: setupWmc.bat
02-20-2017,14:49:04 :  Command produced the following output (will display up to 8192 characters):
02-20-2017,14:49:04 :  -------------------------------------------------------------------------->
02-20-2017,14:49:04 :    Unable to grant the log-on-as-service right to group "nbwebgrp". Please refer C:\Program Files\Veritas\NetBackup\wmc\WEBSERVER\logs\ nbwmc_setupWmc.log for more details.
02-20-2017,14:49:04 :    Failed to restore the original security policies. You may reattempt using this command:
02-20-2017,14:49:04 :    secedit /configure /cfg "C:\Program Files\Veritas\NetBackup\wmc\bin\install\.\security_policy_config.db" /db "C:\Program Files\Veritas\NetBackup\wmc\bin\install\.\defltbase.sdb"
02-20-2017,14:49:04 :  --------------------------------------------------------------------------<
02-20-2017,14:49:04 :  Command returned status 4294967295.
02-20-2017,14:49:04 :  Configuration script setupWmc failed
02-20-2017,14:49:04 :  CustomAction Deferred_WebAdminConsoleOps returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
02-20-2017,14:49:04 :  Action ended 14:49:04: InstallFinalize. Return value 3.
02-20-2017,14:49:04 :  Action 14:49:04: Rollback. Rolling back action:


NOTE: This failure occurs regardless if the nbwebsvc account was already provided with the "Log on as a service" permission manually prior to starting the installation sequence.



The <installPath>NetBackup\wmc\WEBSERVER\logs\nbwmc_setupWmc.log log shows the following:

This script will grant "logon as a service right" to the <hostname>\nbwebgrp group and register NetBackup's Web Services to execute under that user's permission.  
Configuring the current system with this template in the /overwrite mode will result in losing the existing security records in the database specified.Do you want to continue this operation ? [y/n] Completed 6 percent (0/15)     Process Privilege Rights area        
Completed 13 percent (1/15)     Process Privilege Rights area        
... text removed for clarity ...
Completed 100 percent (15/15)     Process Privilege Rights area        
                                                                           
No mapping between account names and security IDs was done.

The task has completed with an error.
See log %windir%\security\logs\scesrv.log for detail info.
Restoring the original security policies ...  
                                                                           
An extended error has occurred.

The task has completed with an error.

Solution

This issue can be resolved by the following two-part instruction set:

Part 1:
1. Edit the security permissions of the folder C:\Program Files\Veritas\NetBackup\ wmc
2. Make sure the local Administrators group has Full Permissions to this object
3. Click Advanced, for Administrators, place a check next to "Replace all child object permission entries with inheritable permission entries from this object" and click OK.
Note: Step 3 makes sure that the Administrators group has full permissions to the entire directory structure under "wmc"

Part 2:
Restart the installation by re-launching browser.exe using " Run as Administrator".


The install sequence should be able to proceed beyond the previous failure point.