Cannot Back Up a Domain Controller by Using Windows Backup over a Terminal Services Session (821886)

SYMPTOMS

When you try to back up the System State files on a Windows 2000 domain controller, you may experience one of the following symptoms:

You receive the following error message in the Backup Progress dialog box:

The backup could not be completed due to an error.

To see detailed information, click Report.

The Status box displays a status of Failed. When you click Report, the following information is displayed:

Backup started on 5/15/2003 at 2:33 PM.
Folder System State\Active Directory
The 'Active Directory' returned 'The parameter is incorrect.
' from a call to 'BackupReadFile' additional data '-'
The operation was ended.
Backup completed on 5/15/2003 at 2:33 PM.
Directories: 0
Files: 0
Bytes: 0
Time: 1 second

----------------------

The operation did not successfully complete.

----------------------

-or-

The following information appears in the Backup Progress dialog box:The backup is complete.

To see a report with detailed information about the backup, click Report. The Status box displays a status of "Completed with Skipped Files." When you click Report, the following information is displayed:
```
Backup started on 5/28/2003 at 4:50 AM.
WARNING: Portions of "\Active Directory" cannot be read. The backed up data is corrupt or incomplete.
This file will not restore correctly.
Backup completed on 5/28/2003 at 5:01 AM.
```

RESOLUTION

Hotfix Information

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that are experiencing this specific problem.

To resolve this problem, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

Windows 2000 SP4 is required to install this hotfix.

For additional information about how to obtain the latest service pack for Windows 2000, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

Restart Requirement

You must restart your computer after you install this hotfix to enable the functionality that this hotfix provides. However, you do not have to restart your computer immediately after you install this hotfix.

Hotfix Replacement Information

This hotfix does not replace any other hotfixes.

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.

Date         Time   Version            Size    File name
-----------------------------------------------------------
02-Jun-2003  16:41  5.0.2195.6751      28,944  Ntdsbcli.dll
02-Jun-2003  16:41  5.0.2195.6751      30,992  Ntdsbsrv.dll

WORKAROUND

To work around this problem, assign the "Create global objects" right to the Backup Operators security group. To do so:

Log on to the domain controller.
Click Start, point to Programs, point to Administrative Tools, and then click Domain Controller Security Policy.
Expand Security Settings, expand Local Policies, and then click User Rights Assignment.
In the right pane, double-click Create global objects.
Click to select the Define these policy settings check box, and then click Add.
Add the Backup Operators security group, add Administrator, and then click OK.
In the Security Policy Setting dialog box, click OK, and then quit the Domain Controller Security Policy utility.
Restart the server.