smbclient NT_STATUS_ACCESS_DENIED on directories when Windows doesn't

Question

I'm setting up BackupPC on a server and it uses smbclient to backup Windows 7 workstations.

smbclient logs in correctly to \\TESTHOST\C$ as TESTDOMAIN\backupoperator (Which is also a domain admin and a "Backup Operator" on the TESTHOST) but returns NT_STATUS_ACCESS_DENIED on directories within user home directories such as "My Documents" and "Desktop" etc. despite being able to list, read/open said directories and it's contents using an actual Windows client logged in with the same credentials. Everything else appears accessible.

Extract of BackupPC log:

NT_STATUS_ACCESS_DENIED listing \Users\testuser\Local Settings\*
NT_STATUS_ACCESS_DENIED listing \Users\testuser\My Documents\*
NT_STATUS_ACCESS_DENIED listing \Users\testuser\NetHood\*
NT_STATUS_ACCESS_DENIED listing \Users\testuser\PrintHood\*
NT_STATUS_ACCESS_DENIED listing \Users\testuser\Recent\*
NT_STATUS_ACCESS_DENIED listing \Users\testuser\SendTo\*
NT_STATUS_ACCESS_DENIED listing \Users\testuser\Start Menu\*
NT_STATUS_ACCESS_DENIED listing \Users\testuser\Templates\*

Same issue occurs when I just use smbclient straight from a shell and access it myself. Why is this happening? How can I fix this? Is this smbclient issue or a configuration issue on the Windows workstation?

Surely someone knows something, everyone else is able to do it. — damien79, Feb 11 '12 at 01:21
All the folders listed there as errors are junction points and will need to be excluded for the backup to continue. I'm working on the same problem at the moment and will post my solution if I find one. — AgentK, May 14 '12 at 00:48

score 2 · Answer 1 · answered May 14 '12 at 03:17

You are going to need to exclude each of the folders that are giving you errors. You need to do this as the files you getting errors on are junction points (like symlinks) and smbclient cannot handle accessing them in samba-3.6.* (from what I can tell).

I only want a limited backup of user data. So, the directive I am using in my [host].pl file is:

$Conf{BackupFilesExclude} = {
  '*' => [
    '\\\\$Recycle.Bin',
    '\\\\Documents and Settings',
    '\\\\MSOCache',
    '\\\\pagefile.sys',
    '\\\\PerfLogs',
    '\\\\Program Files (x86)',
    '\\\\Program Files',
    '\\\\ProgramData',
    '\\\\Recovery',
    '\\\\System Volume Information',
    '\\\\Windows',
    '\\Users\\\\All Users',
    '\\Users\\\\Default User',
    '\\Users*AppData',
    '\\Users*Application Data',
    '\\Users*Cookies',
    '\\Users*Documents\\\\My Music',
    '\\Users*Documents\\\\My Pictures',
    '\\Users*Documents\\\\My Videos',
    '\\Users*Local Settings',
    '\\Users*My Documents',
    '\\Users*NetHood',
    '\\Users*PrintHood',
    '\\Users*Recent',
    '\\Users*SendTo',
    '\\Users*Start Menu',
    '\\Users*Templates',
    '*NTUSER.DAT',
    '*ntuser.dat.LOG1',
    '*ntuser.dat.LOG2'
  ]
};

Also note that because of the file globbing certain directories listed above WILL NOT BE BACKED UP! This is not a problem for me as those directories do not contain any data I want included in my backup.

If I could work out a better way I would be much happier.

score 0 · Answer 2 · answered Feb 02 '12 at 10:48

http://sourceforge.net/apps/mediawiki/backuppc/index.php?title=Troubleshooting

Also "Backup Operators" don't have permission to read the user folders inside "Documents and Settings". If you made the BackupPC account a Backup Operator instead of an Administrator and want to back up those folders add a Backup Operators (RIA\Backup Operators) entry with the permissions to Read & Execute, List Folder Contents, Read.

So removing your "backupoperator" user from the "Backup Operators" group should do the trick.

I tried without it originally, adding it was my attempt to try to get it to work. — damien79, Feb 02 '12 at 11:29

smbclient NT_STATUS_ACCESS_DENIED on directories when Windows doesn't

2 Answers2

Linked