Backups fail with STC 401 or job (500) was unable to be assigned errors.
- Datto ALTO
- Datto SIRIS
This article explains how to fix a specific permissions-based issue on Windows Server 2012 R2, which causes backups to fail with a 401 or 500 error, after a random amount of days following an uninstall and reinstall of the ShadowSnap application.
Windows server will start failing backups with a STC 401 or 500 error after an uninstall and reinstall of the Shadow Snap agent on the server. After the error, if the agent is uninstalled and reinstalled again, backups will work for a few days before the error returns.
Figure 1 shows a version of the 500 as seen from the command line of the Datto appliance. It is viewable through the web UI by going to the Protect tab and selecting Backup Logs for the agent having trouble pairing, then selecting Agent Logs.
Figure 1: 500 error as seen on the back end
Multiple Datto appliances protecting a single server
If agents are taking constant full backups or differential merges at random intervals, or are encountering intermittent 401, 500, or VSS writer errors, there may be more than one Datto appliance on the network trying to back up the same protected machine.
Datto does not recommend protecting a production system with more than one Datto appliance at the same time. Even if the appliances have different scheduled backup times, both systems cannot work in tandem with each other. Both store information in the same location on the protected server with the same naming schemes, and will overwrite each others' changes to those files.
Group Policy issues
This is caused by a group policy applied to the server which limits the Local System User permissions, so the services started as the Local System User do not have full access to the Program Files directory as they did on initial installation.
A list of the symptoms for this specific group policy issue follows:
- Machine is a Windows Server 2012 / R2 and commonly is the environment's Domain Controller, but this has been observed on Exchange machines as well.
- The backups start to fail with an STC error 401 or 500
- The ShadowSnap application is able to be uninstalled and reinstalled and the backups will continue to work for a limited amount of time
- The agent logs read three 500 errors followed by three 401 errors as displayed in the screenshot above.
- VSS Errors in the registry (typically) with event ID 8193 "Access is denied"
If all of these symptoms are being observed the following steps have had a very high resolution rate.
Stop the four services that get installed upon ShadowSnap agent installation, then restart them under a domain administrator account.
- Repair Agent Communications to re-pair the agent with your Datto appliance. The ShadowProtect software automatically attempts to reprovision its license during this process.
- Open the services window by opening a run command and then typing: services.msc.
- Stop the following services:
- ShadowProtect Service Properties
- StorageCraft Image Ready (if this service is running, change its startup type to manual after stopping it)
- StorageCraft Raw Agent
- StorageCraft Shadow Copy Provider
Figure 2: ShadowProtect service properties
- After all of the services have had the domain account inserted to the log on pages, kill all related services through task manager, and start the services in the following sequence:
StorageCraft Shadow Copy Provider
StorageCraft Raw Agent
tact Datto Technical Support.