Attempting to add a SharePoint Farm in backup selections or the Servers list gives an Access Denied error or Backup Exec cannot confirm the Share Point Topology

Problem

Attempting to add a SharePoint Farm in backup selections gives an "Access Denied error or Backup Exec cannot confirm the Share Point Topology".

Error Message

Access Denied.

OR

An error was encountered while attempting to browse the contents of Server Farm.
Although the specified server is a SharePoint resource,Backup Exec cannot confirm the topology.
Review your sharepoint credentials and ensure services are running on the Web servers. 


FIG. 1
  

Cause

When attempting to add a Microsoft Sharepoint Farm to backup selections under the 'Microsoft Share Point Server Farms' icon (Backup Exec 2010 R3 and prior) or in the Servers list (Backup Exec 2012 and later) by adding the web server name, an Access Denied error is returned after about 30 seconds. This may occur because one of the Remote Agent processes that Backup Exec relies on to communicate with Sharepoint, SPSWrapper.exe, does not start. In order to determine whether this issue is being encountered, the SharePoint server Backup Exec Remote Agent debug must be reviewed. See Related Documents for information on creating debug logs for the Backup Exec SharePoint Agent. The excerpt below from the Remote Agent (beremote.exe) debug shows initiating the SPSWrapper process with the 'process ready?' entry. In the case where the SPSWrapper process does not start, 30 seconds later the debug log shows 'process not ready!': 
 
[4276] 11/28/07 16:47:15 process ready?
[4276] 11/28/07 16:47:45 process NOT ready! 

The SPSWrapper (or SPSWrapperV3, SPSWrapperV4, or SPSWrapperV5) process is allowed 30 seconds to start up by the Remote Agent. If this time elapses before the SPSWrapper process starts and responds to the Remote Agent, the Remote Agent debug will show 'process NOT ready!', and the Access Denied error will be received. This condition can be caused by the fact that the SPSWrapper managed applications are digitally signed, and something in the environment is preventing the signature from being verified.  It may also be caused by a delay in SPSWrapper startup that prevents timely communication back to the BERemote process.

Solution

1) This issue commonly occurs because of a network block or restriction on connecting with the Certification Revocation List(CRL) server to verify the certification for the SPSWrapper process has not been revoked.  The first way to resolve this issue is to remove any restriction in place preventing the internet connection to a CRL Authority server like CRL.Verisign.com.

2) In some cases, allowing extra time for SPSWrapper to respond to the BERemote process will allow successful communication.  Increasing the timeout can be accompliished with the addition of a registry setting per below instructions and FIG 2.  This registry change should be made to the Sharepoint Web server.

Warning : Incorrect use of the Windows registry editor may prevent the operating system from functioning properly. Great care should be taken when making changes to a Windows registry. Registry modifications should only be carried-out by persons experienced in the use of the registry editor application. It is recommended that a complete backup of the registry and workstation be made prior to making any registry changes.

      A) Navigate to HKLM\Software\Symantec\Backup Exec for Windows\Backup Exec\Engine\Sharepoint
      B) Right click on 'Sharepoint' and select 'New' and 'Key'
      C) Name the key Timeout
      D) With the new key Timeout highlighted, right click in the right side pane and select 'New' and 'DWORD (32-bit) Value'
      E) Name the new value  Gettopology  then hit Enter.
      F) Double click on the newly created Gettopology value and change the base to Decimal and the data value from 0 to 300.  This will increase the timeout from the default 30 seconds to 300 seconds or 5 minutes.
      G) Click OK
      H) Close the Windows registry

FIG 2.


3) In other cases, no communication is possible with the internet because of firewall rules or proxy.  In those situations, the CRL authentication process can be turned off.  It is important to note that the setting used to disable this connection is global on the Sharepoint Web server so that no digitally signed processes will be authenticated for the specified logon.

       A) Log on to the Sharepoint Web server as the account that Backup Exec will be using to back up the Sharepoint resources.
       B) Open Internet Explorer and go to 'Tools' and then 'Internet Options'.
       C) Click the 'Advanced' tab then scroll down the settings list to the 'Security' section.
       D) Uncheck the setting 'Check for publisher's certificate revocation' per FIG. 3 below.
       E) Click 'OK' then Internet Explorer may be closed.

FIG. 3
 


 F) On the Backup Exec media server, the Sharepoint farm should now be possible to add in backup selections.
 

Applies To

This issue is applicable to all supported versions of Sharepoint.

Terms of use for this information are found in Legal Notices.

Search

Survey

Did this article answer your question or resolve your issue?

No
Yes

Did this article save you the trouble of contacting technical support?

No
Yes

How can we make this article more helpful?

Email Address (Optional)