Skype for Business Backup Service Fail to Start

This will only take a second. While reinstalling my lab on CU4 I couldn’t start the Skype for Business Backup Service. Deployment logs showed successful deployment but when the service attempted to start I received an Error 4006 on the LS Backup Service.

The full error was:

Skype for Business Server 2015, Backup Service service could not be started.

Exception information: System.ServiceModel.AddressAccessDeniedException: HTTP could not register URL https://+:443/BackupService/mex/. Your process does not have access rights to this namespace (see http://go.microsoft.com/fwlink/?LinkId=70353 for details). —> System.Net.HttpListenerException: Access is denied
at System.Net.HttpListener.AddAllPrefixes()
at System.Net.HttpListener.Start()
at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen()
— End of inner exception stack trace —
at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen()
at System.ServiceModel.Channels.TransportManager.Open(TransportChannelListener channelListener)
at System.ServiceModel.Channels.TransportManagerContainer.Open(SelectTransportManagersCallback selectTransportManagerCallback)
at System.ServiceModel.Channels.HttpChannelListener`1.OnOpen(TimeSpan timeout)
at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
at System.ServiceModel.Dispatcher.ChannelDispatcher.OnOpen(TimeSpan timeout)
at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
at System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout)
at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
at Microsoft.Rtc.BackupService.BackupServiceWorker.StartWcfHost()
at Microsoft.Rtc.BackupService.BackupServiceWorker.StartServer().
Cause: Startup errors.
Resolution:
Check the events prior to this to resolve the service startup issue.

So this is a ACL issue on a listener.

Using netsh we can pull the reservation list for the backup service URL using the following command

netsh http show urlacl url=https://+:443/BackupService.mex/

The command showed that no reservations had been set

The service is run using the NETWORK SERVICE account, and the acl needs to be set with this account to work.

To do this run the following command

netsh http add urlacl=https://+:443/BackupService.mex/ user=”NETWORK SERVICE”

Repeat the show command to view the new ACL

Now start the backup service and all should be fine

Running Get-CsBackupServiceStatus –PoolFQDN <fe1.domain.com> returns normal state

and the same for the backup server

Final test to Invoke-CsBackupServiceSync –PoolFqdn fe1.domain.com

All good from Primary

And from Secondary

Mark Vale

Mark is an Independent Microsoft Teams Consultant with over 15 years experience in Microsoft Technology. Mark is the founder of Commsverse, a dedicated Microsoft Teams conference and former MVP. You can follow him on twitter @UnifiedVale

www.valeconsulting.co.uk