Exchange 2010 GRT restore of individual emails fails with error "The resource credentials for the restore job were unable to create a role assignment for ApplicationImpersonation"


Granular Recovery Technology (GRT) based restore of Exchange 2010 data from Remote agent (RAWS) backup set fails with the error mentioned below:

Error Message

Final error: 0xe0000389 - The resource credentials for the restore job were unable to create a role assignment for ApplicationImpersonation. Review the credentials to ensure that it has the rights that are required for ApplicationImpersonation.
Final error category: Resource Errors

For additional information regarding this error refer to link V-79-57344-905

Beremote log from Client Access Server shows the following errors:

[10164]  [fsys\shared]        - EnsureEwsPermissions returned e00003c3
[10164]  [fsys\mb2]            - FATAL: failed to aquire EWS ApplicationImpersonation rights
[10164]  [fsys\shared]        - GetMailboxInfo returned e00003c3 ->
[10164]  [fsys\shared]        - GetMailboxInfo returned e00003c3 ->
[10164]  [fsys\mb2]            - EWS::GetMailboxTable(/o=/ou=/cn=servers/cn=<DAG Name> <BESA account> [<BESA ACCOUNT>]) Failed ... 0x80131600
[10164]  [ndmp\loops]         - Error: CreateObj returns extended error e0000389


Restore the database to Recovery Database and extract individual emails required.


Symantec Corporation has acknowledged that the above-mentioned issue is present in the current version(s) of the product(s) mentioned at the end of this article. Symantec Corporation is committed to product quality and satisfied customers. This issue is currently under investigation by Symantec Corporation. Pending the outcome of the investigation, this issue may be resolved by way of a patch or hotfix in current or future revisions of the software. However, this particular issue is not currently scheduled for any release.  If you feel this issue has a direct business impact for you and your continued use of the product, please contact your Symantec Sales representative or the Symantec Sales group to discuss these concerns.  For information on how to contact Symantec Sales, please see Please be sure to refer back to this document periodically as any changes to the status of the issue will be reflected here.

Customers experiencing this issue are encouraged to contact Symantec Technical Support as data is still being collected to assist in resolving this issue.


Applies To

BE 2012 and Exchange 2010 having software NLB configured for Client Access Server(s)

Terms of use for this information are found in Legal Notices.



Did this article answer your question or resolve your issue?


Did this article save you the trouble of contacting technical support?


How can we make this article more helpful?

Email Address (Optional)