bptestbpcd returns "failed: 7647" when attempting to talk to a media server

Problem

In NetBackup 8.1, upon running bptestbpcd from a Master Server to a Media Server, the on-screen response ends with the following (or similar):

Example on-screen output:
bptestbpcd -client My-Media-Server -verbose
<16> bptestbpcd main: Function ConnectToBPCD(My-Media-Server) failed: 7647
<16> bptestbpcd main: Proxy peer does not conform to proxy protocol
<2> bptestbpcd: Proxy peer does not conform to proxy protocol
<2> bptestbpcd: EXIT status = 7647

Error Message

Within the bpcd log on the target Media Server, similar messages are observed every time "bpcd.exe -standalone" is initiated:

<2> logparams: D:\Veritas\NetBackup\bin\bpcd.exe -standalone
<2> setWebAPICallback: setting curl callback
<2> init_nbcurllib: Performing nbopenssl_init() before initGlobalCurl()
<4> NBClientCURL::initGlobalCurl: Performing NB_curl_global_init() ONLY ONCE per process
<2> vnet_proxy_get_peer_sock_names: setting connection_info json as json_null
<2> daemon_proxy_proto: Preparing to do daemon protocol for (xxx.xxx.xxx.xx:1556 <- xxx.xxx.xxx.xxx:64289)
<2> vnet_proxy_get_peer_sock_names: setting connection_info json as json_null
<2> vnet_proxy_get_peer_sock_names: setting connection_info json as json_null
<2> is_connection_INBOUND: non-proxy, localhost connection
<2> is_connection_INBOUND: Connection-Is-INBOUND:[FALSE]
<2> init_resilient_cache: [vnet_nbrntd.c:1383] Initialize resilient cache. 0 0x0
<2> vnet_pcache_init_table: [vnet_private.c:217] starting cache size 200 0xc8
<2> check_vnetd_process_dup_permission: OpenProcessToken() failed: 5
... (content removed for clarity) ...
<16> process_requests: access protocol error

Cause

The above has been observed when the NetBackup Client Service on the problem host, has been changed to start with an account other than LocalSystem (which is the default).

In this case, the account did not have the proper permissions to allow for process token management.

Note: NetBackup uses the NetBackup Client Service and the NetBackup Legacy Network Service to access the SQL Server when it performs backups and restores. With the proper configuration, these services can log on with the Local System account or another account that has the necessary privileges.

For more details, see the section on Configuring the NetBackup services for SQL Server backups and restores (legacy SQL Server policies) in the Veritas NetBackup™ for Microsoft SQL Server Administrator's Guide.

Solution

It is recommended to change the Log On associated with the NetBackup Client Service back to LocalSystem - an account which has the needed permissions.

Once the NetBackup Client Service account has been changed and restarted, communication with the host is successful.