Attempted install of NetBackup 8.0 fails the pre-install check

Problem

When installing NetBackup Master Server on a Windows host, you may encounter a failure of the pre-install check tool when supplying domain based credentials for the NetBackup Web Services account information.

Example 1:


Example 2:



The error messages read:
Critical error found during pre-install check, please review output from preinstall check in NetBackup Installation Summary screen and resolve issue before restarting install.

Could not communicate with domain controller [\\hostname] for domain [domain]. Please confirm that this host is configured to communicate with domain [domain].

Cause

The pre-install check attempts to contact the Domain Controller via TCP ping.  Usually Windows Firewalls will block a ping using the TCP protocol.

This issue has been observed when the Domain Controller is actively running the "Windows Firewall" service, specifically, when the "Public Profile" is in the " on" state.




 

Solution

There are two possible solutions:

Option 1. For the duration of the install, on the Domain Controller, stop and disable the service called " Windows Firewall".
Note: Caution should be used when stopping the Windows Firewall service.  This can cause a disruption in network connectivity to the Domain Controller.


Option 2. For the duration of the install, on the Domain Controller, turn the three Windows Firewall Profiles to the " off" state.
Note: On a Domain Controller, Windows Firewall Profile states are often controlled by a Group Policy called "Default Domain Controllers Policy". 

To modify Window Firewall Profile states controlled by Group Policy, follow these instructions:

To launch Group Policy Management Editor:
1. Launch Group Policy Management
2. Drill into Group Policy Management > Forest:xxx > Domains > <domain> > Group Policy Objects
3. Rt-click "Default Domain Controllers Policy" select Edit... to launch the Group Policy Management Editor

Within Group Policy Management Editor, navigate to:
1. Default Domain Controllers Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security
2. Select Windows Firewall with Advanced Security - LDAP:xxxx
3. Click Windows Firewall Properties
4. Click the Domain Profile tab - if "on" change Firewall state = off
5. Click the Private Profile tab - if "on" change Firewall state = off
6. Click the Public Profile tab - if "on" change Firewall state = off
7. Click OK to save the change
8. Open a command prompt using "Run as administrator"
9. Within the prompt, type: gpupdate /force

Note: Once the install of NetBackup 8.0 is complete, revert the above Windows Firewall Profiles back to 'on' as necessary.

Option 3. Contact Veritas Technical Support and ask to be supplied with EEB eebinstaller_3917066_3_AMD64.exe.  This binary provides a new 8.0 install msi which switches the Domain Controller ping inquiry from using TCP to ICMP which is more commonly allowed to pass through firewall filters.