Credential check may log an authentication failure audit event for servers listed in the backup selections.

book

Article ID: 100059074

calendar_today

Updated On:

Description

Error Message

An auditing software like Quest auditing server may pick up these failed login attempts - 

User from computer BEServer failed to authenticate to server DC20.lab.dom through NTLM on domain controller DC20. Failure: Invalid password (0xc000006a)

Cause


Note: A periodic credentials check is setup in Backup Exec (BE) to identify logon account issues for resources before the jobs actually run.

This credential check when attempts to do a check with another account that does not have rights to access the servers, will fail and an auditing software may pick these up as failed logon attempts..

Example : Backup job is setup with VMware VMs selected in it. This account is a domain admin and has VSphere administrator role assigned to it. So all VM credential checks pass when tested with this account.
Let's say there is another account setup in Backup Exec, which is a local administrator, and if this account is used in the check for the same resource, it will fail. If a failed login attempt is monitored, then it will log an event into that audit logging system.

The design should be to only use the selected logon account for the specified backup selection. The other logon account in Backup Exec should not be used for credential checking of the resource if it is not mapped to that selection or backup job. 

 

Resolution

Workaround: 
Deselect the credential check from BE global settings or ignore the audit failure if it is established that the event is due to the credential check in BE and not a real authentication failure.


There are currently no plans to address this issue by way of a patch or hotfix in the current or previous versions of the software at the present time. While this issue may be resolved in a future major revision of the software at a later time, it is not currently scheduled for any release.  If you feel this issue has a direct business impact for you and your continued use of the product, please contact your Veritas Sales representative or the Veritas Sales group to discuss these concerns.

Issue/Introduction

Credential check may log a failure audit event for servers listed in the backup selections even when the job has the correct account specified. The credential check failure audit event can occur for other Backup Exec logon accounts which may not have rights to access those servers.

Additional Information

ETrack: 4124997