How to configure Microsoft Exchange Server 2007 backups in Backup Exec
11d and above
This document discusses four phases to configuring Exchange 2007 backups
using Backup Exec for Windows Servers:
1. The logon account
2. Software Pre-requisites
3. Testing the Messaging API (MAPI - a Microsoft-supplied dependency)
For an overview of the protection for Exchange offered by Backup Exec please
Symantec Backup Exec 11d/12 for Windows Servers Sets the Standard for
Exchange 2007 Server Data Protection ( http://support.veritas.com/docs/287804 ).
1) Configuring the Backup Exec Logon Account
1. Verify that the Backup Exec logon account (specified in Resource Credentials
for the various Storage Groups) is assigned a mailbox and is unhidden from the
Global Address List.
2. Verify that the logon account corresponds to a uniquely named mailbox (this is
discussed in the related document http://support.veritas.com/docs/256537 ).
3. Verify that the Backup Exec logon account has Domain Administrator and
Local Administrator rights on the Exchange Server. Explicitly add the account to
the local Administrators group on the Exchange server rather than relying on
group membership to imply permissions.
4. Verify that the Backup Exec service account has Organizational Admin or
Server Admin role in the Exchange Management Console.
5. Verify that mail can be sent to and from the Backup Exec logon account
2) Configuration of the Backup Exec Server and the Exchange Server
1. Ensure the Backup Exec Media Server is updated with all patches and hotfixes
by running Live Update (available from the Tools menu in the Backup Exec
2. Once the Media Server is updated, push install the latest Remote Agent to all
remote servers, including the Exchange servers (this is discussed in the related
document http://support.veritas.com/docs/299159 ).
3. Download and install Microsoft MAPI/CDO package on the Exchange 2007
server. Also ensue that Microsoft Office 2007 is not installed on the Exchange
Server as it causes conflicts with the version of MAPI.
Microsoft Exchange Server MAPI Client and Collaboration Data Objects
(MAPI/CDO) needs to be updated to support backup of Exchange 2007 with
Backup Exec 11.0 for Windows Servers build 7170 and above (
3. Install Exchange Management tools (same Service Pack as on the Exchange
server) on the Backup Exec server.
Attempt to backup Exchange 2007 fails with the error "V-79-57344-65286 -
To back up Microsoft Exchange Server 2007, you must install the Exchange
Management Tools for Microsoft Exchange Server 2007 on the media
server. The Management Tools can be installed during a custom install of
Microsoft Exchange Server 2007" ( http://support.veritas.com/docs/292480 ).
4. Confirm the following after performing the above mentioned steps -
Version of beclass.dll should be 11.0.7170.30 and above for Backup Exec 11d
Version of beclass.dll should be 12.0.1364.0 and above for Backup Exec 12
Version of ese.dll should be 8.0.xx on both the Backup Exec Server as well as
Exchange Server (without Service Packs)
Version of ese.dll should be 8.1.xx on both the Backup Exec Server as well as
Exchange Server (with Service Pack 1 for Exchange)
5. If Exchange Server is installed on Windows Server 2008 check the below
An attempt to a restore Mailbox/Public Folder on an Exchange 2007 server
running on a Windows 2008 from a Granular Recovery Technology (GRT)
enabled Backup-To-Disk set fails with the error "Unable to attach to a
resource" ( http://support.veritas.com/docs/306689 ).
3) Configuring a MAPI Exchange Backup Job
Before starting a backup job, enable legacy mailbox support so that MAPI
authentication can be checked. If the GRT information is not visible from a GRT-
enabled Information store backup then this is a very important test. This should
only be used as part of troubleshooting and testing: MAPI backups should not be
used to protect your Exchange servers.
Ensure that this backup job is created while logged in as the Backup Exec
service account, as well as when creating GRT backup jobs.
1. To do this add DWORD Value "e2k7_mbox" with value 1, under
HKLM\Software\Symantec\Backup Exec for Windows\Backup
Exec\Engine\ESE on the Exchange 2007 machine
2. Restart the Backup Exec Remote Agent Service on the Exchange Server.
3. Enable Legacy Support for Exchange under Tools > Options > Microsoft
Exchange in Backup Exec Console.
4. We should now be able to see a new section "Microsoft Exchange Mailboxes"
as shown in the figure below. Try expanding this using the account created with
the credentials as mentioned initially in part 1 of this TechNote.
5. If the mailboxes can be expanded, this means that the GRT view of the
mailboxes will not fail due to MAPI. Once mailboxes can be expanded, re-open
the registry and delete the DWord e2k7_mbox under
HKLM\SOFTWARE\Symantec\Backup Exec for Windows\Backup
Exec\Engine\ESE on the Exchange 2007 server, and from the Backup Exec
console on the media server, disable Legacy Support for Exchange under Tools
> Options > Microsoft Exchange.
4) Additional Troubleshooting
1. If backups fail, enable debugging will help Technical Support to assist further.
How to enable or disable "debug logging" in Backup Exec for Windows Servers:
2. Check for Events in Application Log for any Antivirus Scan related Information
/ Warning / Error on the Backup Exec Server or the B2D Location.
3. Because of differences in MAPI functionality, Outlook cannot be concurrently
installed on the Exchange server:
An attempt to run a Granular Recovery Technology (GRT) backup of the
Information Store to tape for Exchange 2007 running on a Windows 2008
server fails with an "Access Denied" error.
Exact Error Message
Backup- \\Exchange2007\Microsoft Information
Store\First Storage Group
V-79-57344-33928 - Access Denied. Cannot backup
directory ?Mailbox Database and its subdirectories.
When attempting to run a GRT backup of the Information Store to tape for
Exchange 2007 running on a Windows 2008 server the job fails with the above
The same job when targeted to backup to disk completes successfully but when
trying to run a GRT restore from the successful backup set the job fails with the
Unable to attach to a resource. Make sure that all selected resources exist
and are online, and then try again
The above problem primarily occurs as a result of Windows 2008 using Internet
Protocol version 6 (IPv6) as a preferred protocol over Internet Protocol version4
The Exchange 2007 application while running on a Windows 2008 machine
listens on the usual ports 6001, 6002 and 6004 on the IPv4 address, but listens
only on ports 6001 and 6002 on its IPv6 address. The DSProxy service (port
6004) is NOT listening on the IPv6 stack.
Because Windows 2008 prefers IPv6 over IPv4, it talks to itself over IPv6. So
when the RPC-over-HTTP Proxy tries to connect a user session to port 6004 on
the same server, it tries to connect to :::1:6004 and NOT to 127.0.0.1:6004.
Because the server is not listening to port 6004 on the IPv6 stack, the connection
For more information about this problem please refer the following article:
To resolve the issue, perform one of the following procedures on the Client
Access server. The procedure to implement the workaround depends on whether
the Exchange topology is running the Client Access server role and Mailbox
server role on the same Exchange server or on different Exchange servers.
For a single-server topology where the Client Access server role is running on
the same Exchange server as the Mailbox server role.
1. Open the hosts file located at %SystemRoot%\system32\drivers\etc\ by using
an editor such as Notepad.
%SystemRoot% refers to the drive where the Windows system files are located.
2. Comment out the line that references the IPv6 address.
# :::1 localhost
3. Add the following lines into the file:
127.0.0.1 hostname of the computer
127.0.0.1 FQDN of the computer
actual IPv4 address hostname of the computer
actual IPv4 address FQDN of the computer
3. Save the changes made to the file and restart the Backup Exec services on
the Exchange server.
4. Run an Information Store backup/restore and verify the results.
For a multiple-server topology where the Client Access server role is not running
on the same Exchange server as the Mailbox server role
The following changes need to be made on the Client Access server in the
multiple server topology:
1. Under Network Connections, select the network adapter, and then click
2. In the properties window, uncheck the check box for Internet Protocol Version
Clearing this check box causes the RPCProxy component on the Client Access
server to use TCP/IPv4 to talk to the DSProxy component on the Mailbox server.
3. Click on the Start menu, and then click Run. Type regedit in the Open box.
4. Using Registry Editor, locate the following registry key:
Warning: Incorrect use of the Windows registry editor may prevent the operating
system from functioning properly. Great care should be taken when making
changes to a Windows registry. Registry modifications should only be carried-out
by persons experienced in the use of the registry editor application. It is
recommended that a complete backup of the registry and workstation be made
prior to making any registry changes.
5. Right-click the Parameters key, click New, and then click DWORD (32-bit)
Value. For the key, add the following values:
6. Restart the Client Access server.
7. Run an Information Store backup/restore and verify the results.
The above error message may continue to occur even after having made the
changes mentioned above if :
A.) Exchange 2007 is installed on a Windows 2008 machine
B) In the resource order for the backup selection list Information Store is not the
first resource to be backed up
C) Backup job is targeted to tape device
To resolve the issue edit the backup selection list such that the Microsoft
Information Store is the first resource to be backed up followed by the other local
resources on the server.