information security, the outdoors and me RSS 2.0
# Thursday, May 19, 2005

In case you haven't learned your lesson yet --  BACKUP YOUR DATA!  I had a recent scare (failed sound card install) that cost me 2 nights of agony.  I did manage to "repair" the system, but I was literally on the verge of reinstalling XP; thus agreeing to flush lots of my data.  Yes, that means my EFS cert, my encrypted files and lots of app configs that weren't backed up in the past 4 months!

(I think my repaired system is almost 100%; Likely only small sound issues remain due to the failed sound card install)

My ideal goal was to get an automated backup solution that would work in case I had to totally rebuild the system.  XP provides NTBackup.  There is even a nice feature called an ASR backup.  Along with a floppy you can rebuild your system.  The problem is you can't automate an ASR backup.  So I had to settle on regular backups of the System State and weekly C drive backups.

I've finally learned how to deal with DCOM permissions.  With SP1/SP2 they've apparently changed enough to cause lots of trouble with Scheduled Tasks on XP.

I've always had issues running Backups via Scheduled Tasks.  The latest issue was that my "Backup Operator" account could manually run (by right clicking) a NTBackup scheduled task (via Control Panel), but the scheduled task would not execute (properly) when run by anyone else with "permisisons" to run the scheduled task.

I received errors like the following.  Note the CLSID mentioned in each.

Event Type: Error
Event Source: DCOM
Event ID: 10016
User:  COMPUTERNAME\backupuser
Computer: COMPUTERNAME
Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{0022DFD7-0469-49FF-BDD4-192CB402F5C6}
 to the user COMPUTERNAME\backupuser SID (ENTER YOUR SID HERE).  This security permission can be modified using the Component Services administrative tool.

AND

Event Type: Error
Event Source: DCOM
Event ID: 10016
User:  COMPUTERNAME\backupuser
Computer: COMPUTERNAME
Description:
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}
 to the user COMPUTERNAME\backupuser SID (ENTER YOUR SID HERE).  This security permission can be modified using the Component Services administrative tool.

These indicate that you need to grant associated DCOM permisisons to the user account (or simply the Backup Operators group) used for running the Scheduled Task.


How to fix NTBackup DCOM Permissions

  1. Run dcomcnfg.exe as an administrator on the PC.
  2. Double click "Component Services".
  3. Double click "Computers".
  4. Double click "My Computer".
  5. Double click "DCOM Config".
  6. Select "View/Detail" to display all the items in a single column format.
  7. On the right side, scroll down until you locate "Removable Storage Manager".
  8. Right click "Volume Shadow Copy Service" and click on "Properties".
  9. Click on the "Security" tab across the top of the new window.
  10. Under the first section "Launch and Activation Permissions", click "Customize".  This "un-grays" the "Edit" button to the right.
  11. Click the "Edit" button to the right of this.
  12. In the new window which appears, click "Add...".
  13. Another windows pops up.  Click "Advanced".
  14. Click "Find Now".
  15. Scroll until you locate the user account (or group) that you want to run the NTBackup Scheduled Task as.  Click once on that user or group.
  16. Click OK twice.
  17. Notice at the top of the current window, this user or group is selected.
  18. In the bottom half, check the box in the "Allow column" that is directly to the right of "Local Activation".  Leave the "Local Launch" checkbox checked.
  19. Click OK twice.
  20. Repeat steps 7 - 19 for "Volume Shadow Copy Service"
  21. Try to run the Scheduled Task via the "Scheduled Tasks" Control Panel entry as another administrative account.
  22. If it fails, reboot and try again.
  23. If it works, you too now now the power of DCOM permissions.
Thursday, May 19, 2005 7:56:34 PM (Eastern Standard Time, UTC-05:00)  #    Comments [0] -
General
Categories
Archive
<May 2005>
SunMonTueWedThuFriSat
24252627282930
1234567
891011121314
15161718192021
22232425262728
2930311234
Blogroll
About the author/Disclaimer

Disclaimer
The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.

© Copyright 2009
ydns
Sign In
Statistics
Total Posts: 68
This Year: 1
This Month: 0
This Week: 0
Comments: 3
Themes
Pick a theme:
All Content © 2009, ydns
DasBlog theme 'Business' created by Christoph De Baene (delarou)