The user name for the Backup Exec service account does not have administrator rights on the central administration server when attempting to join a Standalone media server to a CASO server.

Problem

The user name for the Backup Exec service account does not have administrator rights on the central administration server appears in the installation/maintenance wizard when attempting to join a Standalone media server to a CAS server.  (Figure 1)

Figure 1

 

Error Message

The user name for the Backup Exec service account does not have administrator rights on the central administration server <CAS Server Name>. Check the credentials and try again.




Backup Exec temporary install log (bkuptemp.log) 

C:\ProgramData\Veritas\Backup Exec\Logs  or  C:\ProgramData\Symantec \Backup Exec\Logs


    <logdata>
         <caller>0</caller> 
         <type>0</type> 
         <datetime> </datetime> 
         <msg>CAS HostName resolved to : <CAS Server Name></msg>
    </logdata>
    <logdata>
         <caller>0</caller> 
         <type>1</type> 
         <datetime> </datetime> 
         <msg>The user name <Domain>\Administrator for the Backup Exec service account does not have administrator rights on the central administration server <CAS Server Name>.  Check the credentials and try again.</msg>
    </logdata>




Backup Exec Installation Log (BKUPINSTxx.HTM)
C:\ProgramData\Veritas\Backup Exec\Logs   or C:\ProgramData\Symantec \Backup Exec\Logs


Saving the edition switch.
CAS HostName resolved to : <CAS Server Name>
CAS HostName resolved to : <CAS Server Name>
+ The user name <Domain>\Administrator for the Backup Exec service account does not have administrator rights on the central administration server <CAS Server Name>. Check the credentials and try again.
: CAS HostName resolved to : <CAS Server Name>
The return code is: 1602





 

Cause

Backup Exec Service Account (BESA) user rights/permissions.

DNS or host name resolution issues between the Standalone media server and CAS server.

Windows firewall or 3rd Party firewall/applications blocking Windows Management Instrumentation (WMI) port or WMI processes.

Windows Management Instrumentation (WMI) or DCOM remote connectivity issues between the Standalone media server and CAS server.



 

Solution

The following steps should be confirmed in order:

1) Ensure the Backup Exec Service Account (BESA) used to join the Standalone media server has appropriate permissions to access the CAS server.  

How to setup user rights/permissions for Backup Exec Service Account (BESA)
https://www.veritas.com/docs/000085119

Requirements for installing CASO
https://www.veritas.com/docs/000108709

2) The Standalone media server must be able to resolve to the the CAS server Netbios name and FQDN  with the correct IP address. Use ping and TRACERT (Trace Route) commands to confirm DNS and host name resolution.Check or edit Windows host file for incorrect entries.

3) Confirm that Windows Management Instrumentation (WMI) is enabled/not blocked by a firewall on the Standalone media AND CASO server.

Windows Firewall settings the following rules must be set to Allow:

    Remote Service Management (RPC-EPMAP)
    Windows Management Instrumentation (WMI-In)

Note: The Backup Exec installation automatically adds exceptions to the Windows Firewall if enabled. Local Windows Firewall policies may override the settings.

4)Confirm remote Windows Management Instrumentation (WMI) connectivity between or FROM the Standalone media server and TO the CAS server.  

The Standalone media server must be able to connect to the CAS using remote WMI calls and successfully query the CAS server values and registry using WMI queries.

On the Standalone media server logon as the Backup Exec Service Account (BESA).
Open an administrator command prompt and run WBEMTEST.

1. Click on Connect

2. Under Namespace Enter:   \\<CAS Server Name>\root\cimv2
Where <CAS Server Name> = CAS server Netbios or FQND name.

Example (Figure 2) :  \\BE-CAS\\root\cimv2 

3 . Click on Connect

Figure 2




Note: If WBEMTEST fails to connect to the CAS server from the Standalone media server check the Event Logs on the Standalone media server and CAS server for any WMI or DCOM errors. WBEMTEST will generate an error or error code.  Example (Figure 3)

Figure 3



4. Once connected to the CAS server WMI namespace run the following query and click Apply (Figure 4 and Figure 5).

WMI Query : SELECT * FROM Win32_ComputerSystem

Figure 4



Figure 5



The above query should return the CAS server name or  Win32_ComputerSystenName="<CAS Server Name>" (Figure 6).




NOTE: If WBEMTEST fails to query or execute SELECT * FROM Win32_ComputerSystem from the Standalone media server to the CAS server check the Event Logs on the Standalone media server and CAS server for any WMI or DCOM errors.  

WBEMTEST will generate an error or error codes.  Example (Figure 3).

0x800706BA (RPC_S_SERVER_UNAVAILABLE)
0x80070005 (E_ACCESS_DENIED)