Domain Controller SystemState backup failing on 3 servers

Question

Hi,
I've been puzzling over this for a few weeks - getting a bit desperate now... Seen a few similar issues on the forums, but no definitive answer that works...
I have 3 2012R2 domain controllers - 2 are new, clean build, no AV installed, built in the last month and have latest updates installed.
Windows Server backup installed on all 3 and is failing with same error on all 3 when attempting to do a system state backup.
This is what I'm running from an elevated command prompt...
C:\Windows\system32>wbadmin start systemstatebackup -backuptarget:e:
Also fails exactly the same from the GUI.
Windows Server Backup Log has this error:
Error in backup of C:\Windows\WinSxS\amd64_microsoft-windows-alttab_31bf3856ad364e35_6.3.9600.16384_none_599bb25393087eb6\AltTab.ptxml during read: Error [0x80070005] Access is denied.
I haven't changed any permissions, they are default...
>cacls AltTab.ptxml
...\AltTab.ptxml NT SERVICE\TrustedInstaller:F
              BUILTIN\Administrators:R
              NT AUTHORITY\SYSTEM:R
              BUILTIN\Users:R
              APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:R
In the Event Log I have:
Event 517
The backup operation that started at '‎2015‎-‎01‎-‎05T07:30:13.107907800Z' has failed with following error code '0x80780049' (None of the items included in backup were backed up.). Please review the event details for a solution, and then rerun the backup
operation once the issue is resolved.
Same error is present on all DC's, all 3 are failing on files in the winsxs folder - different files on each.
As per a previous article I read, on one of the servers I have re-applied permissions to the WinSxS folder, which didn't make any difference.
I cannot see any locks on the winsxs files using sys internals process explorer.
Interestingly though, system state backup did work before windows update applied huge amount of updates straight after the build.
At this point, I have no good backups of AD - I have run out of options - all assistance appreciated.
Thanks,
Charles.

Answer 1

OK, this is getting ridiculous.
Built another clean server from latest 2012 R2 iso... en_windows_server_2012_r2_with_update_x64_dvd_6052708.iso
joined domain, backups work, windows update works and installs 24 updates
Promoted to DC, then Windows update and backups fail with 
WU...
2015-01-09
14:30:38:735
836
d6c
AU
>>##  RESUMED  ## AU: Search for updates [CallId = {6DD3D371-4F02-4D34-95FE-B04899E14E92} ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}]
2015-01-09 14:30:38:735
836 d6c
AU  # 4 updates detected
2015-01-09 14:30:38:735
836 d6c
AU #########
2015-01-09 14:30:38:735
836 d6c
AU ##  END  ##  AU: Search for updates  [CallId = {6DD3D371-4F02-4D34-95FE-B04899E14E92} ServiceId = {7971F918-A847-4430-9279-4A52D1EFE18D}]
2015-01-09 14:30:38:735
836 d6c
AU #############
2015-01-09 14:30:38:735
836 d6c
AU All AU searches complete.
2015-01-09 14:30:38:735
836 d6c
AU  # WARNING: Failed to find updates with error code 80070005
2015-01-09 14:30:38:735
836 d6c
AU AU setting next detection timeout to 2015-01-09 19:30:38
2015-01-09 14:30:38:735
836 d6c
AU Adding timer: 
2015-01-09 14:30:38:735
836 d6c
AU    Timer: 31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2015-01-09 19:30:38, not idle-only, not network-only
2015-01-09 14:30:38:735
836 d6c
AU WARNING: ISusInternal::CanInstallNow failed, error = 0x80070005
Backups failing with:
Error in backup of C:\Windows\WinSxS\amd64_microsoft-windows-alttab_31bf3856ad364e35_6.3.9600.16384_none_599bb25393087eb6\AltTab.ptxml during read: Error [0x80070005] Access is denied.
Any suggestions?
Thanks.