An “authentication failed” backup can still browse a server, and a successful credential test can still lead to a failed job. Different stages may use different stored accounts, logon types, agents and resource permissions. Recreating the job throws away configuration evidence without proving which credential failed.
Capture the exact boundary
Record product/version, job and time, failing resource, operation (browse, snapshot, read, target write, catalogue or restore), exact error and recent password/account/policy/agent changes. Preserve job and agent logs securely; they may contain infrastructure names and credential hints.
Determine whether one resource, all resources using one account, or every job is affected. A broad pattern points to a service/system account or infrastructure change; one object may be a resource-specific mapping.
Map every identity used by the job
List:
- backup-server service identity;
- product system/default logon account;
- resource/job-specific stored credential;
- remote agent trust/identity;
- application credential for SQL, Exchange, VMware or another workload;
- repository/cloud/NAS credential; and
- human operator initiating a restore.
Backup Exec stores logon-account records separately from Windows accounts, and jobs/resources can inherit or override them. A password changed in Active Directory does not automatically update the stored Backup Exec entry.
Test stages separately
Account validity
Confirm the authoritative account exists, is enabled/unlocked, uses the expected domain or local namespace and has not expired. Check time and domain/DC connectivity. Do not type passwords into command history or logs.
Product credential mapping
Use the backup product’s supported credential test against the exact resource. In Backup Exec, test the selected logon account and server, then verify which job/selection actually references it. A green test proves access at that moment, not the complete job.
Network and agent trust
Verify name resolution, ports, TLS/certificate trust, agent version and direction of connection. Some products wrap unreachable or untrusted agents in security errors. Do not weaken certificate validation merely because credentials are correct.
Resource rights
Test the operation the job needs, not interactive login. Backup and restore can require different user rights and application permissions. A NAS may interpret DOMAIN\user, local user and UPN differently. Avoid granting broad administrator rights until current vendor documentation requires them.
Application consistency
Database/virtualisation agents may authenticate to the host yet fail inside the application API. Verify the application role, instance/database selection and writer/provider result separately.
Target and catalogue
A job can read the source but fail authenticating to its repository, object store, deduplication service or catalogue database. Restore browsing can use another stored account again.
Correct one dependency
Update the actual operating-system identity and the product’s stored credential reference through supported controls. If rotating an account, reconcile services, system/default account, jobs and resource overrides without exposing the secret.
Apply the minimum vendor-supported rights for the selected workload and scope them where possible. If current product requirements are highly privileged, compensate with a dedicated account, vaulting, monitoring and no human reuse.
Do not delete and recreate a job unless its configuration is corrupt and exported/recorded. Otherwise the new job may succeed only because it silently selected a broader default account.
Prove backup and restore
After correction:
- credential test passes for the exact resource;
- intended selections can be enumerated;
- the job reads the source and writes the intended target;
- VSS/application consistency succeeds;
- byte count/catalogue/retention are plausible;
- representative data restores to an alternate controlled location;
- restored application data is validated; and
- an unauthorised operator/account remains unable to browse or restore sensitive data.
Observe the next scheduled run and password-rotation event. Record account ownership and expiry without recording the password.
Authentication is repaired when the correct dedicated identity can complete backup and restore through every required boundary—not when one test button turns green.