FR 36 Active Directory Backup Completes with Error Code: [28:548] Description: Failed to process group policy object.

Feature Release 36 for the Active Directory iDA introduces backups and restores for Group Policy Objects (GPOs). This new feature requires a permissions change that was not needed in previous versions.

Symptoms

Often the job will complete with errors such as the following:

Error Code: [28:548] Description: Failed to process group policy object. Please verify following: (1) User account configured in Active Directory connection settings is member of Remote Management Users group or has administrator permissions. (2) User account configured in Active Directory connection settings has read and write permission to job results directory.

If you encounter issues with GPO backups, you may see the following errors in the adBackup.log:

11008 1348  03/01 13:05:22 3655964 adBackupClass::backupSingleEntry(4128) - Failed to remove backup dump [], error: [0x80070057:{CQiDirectory::Remove(461)} + {CQiDirectory::Remove(471)/W32.87.(The parameter is incorrect. (ERROR_INVALID_PARAMETER.87))-Folder is empty}]
11008 1348  03/01 13:05:22 3655964 adBackupClass::backupSingleEntry(4220) - Failed to backup GPO for [CN={GUID},CN=Policies,CN=System,DC=NAME,DC=NAME], error: 0x80070306:{adBackupClass::BackupGPO(6611)/Failed to create backup dump for gpo [GUID]} + {adBackupClass::CreateGPOBackupDump(6767)/Failed to get backup dump for GPO

Causes

This new feature, GPO Backups, requires a permissions change that was not needed in previous versions.

Resolution

1. Install FR36.49 or higher - Included in FR 36.49+, is hotfix 9663, which addresses a permissions issue that can cause Active Directory backups to fail when attempting to back up Group Policy Objects.
2. Update Service Account Permissions - Ensure the service account is a member of the "Backup Operators" group. or at least one of the groups defined here: Allow log on locally - security policy setting
3. Create Additional Setting - From the Active Directory's client properties page or at any CommVault group level where the AD iDA is a member, create the following additional setting:

Name: ShorterPathForGPODump
Catgry: Active Directory
Type: String
Value: C:\CVGPO