Catalog Backup completes partially due to Status Code: 2531

Problem

 A Catalog backup is completing partial successful with status 1 and status code 2531 in the detailed status.

Error Message

26.01.2021  05:00:02  -  Error bpdbm (pid=xxxx)  The disaster recovery package was successfully created.  However, one or more users who have permissions to the identity files from the package do not exist on  the  system (Status  Code:  2531).  Refer  to  the  NetBackup  Status  Codes  Reference  Guide  for  more  information  -  http://www.veritas.com/docs/DOC5332

26.01.2021  05:00:02 - Error  bpdbm  (pid=xxxx)  <install_path>\NetBackup\var\global\vxss\websvccreds\at\nbwebsvc\certstore\keystore\PubKeyFile.pem  :  [  S-1-5-21-xxxxxx-xxxxx-xxxxx-xxxx ]

There may be many such messages - each for a different file name.

Cause

The disaster recovery package contains one or more identity files that have permissions or ownership by usernames that have since been deleted.  Such users will display in the form of security identifier (SID). The username is not available after deletion of the user.

Solution

Identify the Access Control Lists (ACL) of the folder at the highest level listed in the error message and delete reference to the SID user listed in the job details.

For example, if all of the files are in a vxss subdirectory:

1. Browse to X:\Program Files\Veritas\NetBackup\var\global\vxss

2. Right click and go to Properties

3. Go to the Security tab

4. Locate the SID listed in the job details and delete it:

The image below shows the Security tab from the Properties of the respective file or folder:

Note that in some cases it may be necessary to browse to deeper subdirectories before the problematic SID is visible.  For example

X:\Program Files\Veritas\NetBackup\var\global\vxss\websvccreds\at\nbwebsvc\certstore\keystore
X:\Program Files\Veritas\NetBackup\var\global\vxss\nbcertservice\nbwebsvc\systruststore

For further instruction consult Windows documentation. It is a Windows best practice to suspend an account, rather than delete it.

A reboot may also be required to clear the cache memory and to reflect change on the next catalog backup.