Windows Server Backup scheduled task run successfully but backup do not start (not running) on Windows Server 2012

Question

Hi,
A backup job has been setup on Windows Server 2012 (Platform: Win32NT; ServicePack: ; Version: 6.2.9200.0; VersionString : Microsoft Windows NT 6.2.9200.0) via Windows Backup Software UI (Local Backup 1.0).
It is appearing as a scheduled task "\Microsoft\Windows\Backup\Microsoft-Windows-WindowsBackup" belonging to user 'nt authority\system' in task scheduler.
The problem is that the Backup job never start despite the scheduled task running and completing successfully (when run automatically or manually)!
Would you be able to explain why and assist in resolving that issue?
Here is what we know:
When the backup is run manually via the Windows Backup Software UI, it works fine.
When the backup is run via command line (as set in schedule task) in a cmd command prompt (as local/domain 'administrator' or as 'nt authority\system' which is possible by running command prompt via 'PsExec.exe -i -s cmd'), something like "%windir%\System32\wbadmin.exe
start backup -templateId:{f11eb3aa-74e7-4ff4-a57b-d8d567ee3f77} -quiet", it works fine.
If you manually run the preset scheduled task while logged in as administrator, the task run and complete successfully but the backup job does not start.
Idem if you schedule task is run automatically at scheduled time.
The schedule task run and complete successfully but the backup job does not start.
It is confirmed by running the following in a command prompt as 'nt authority\system':
schtasks /run /tn "\Microsoft\Windows\Backup\Microsoft-Windows-WindowsBackup"
SUCCESS: Attempted to run the scheduled task "\Microsoft\Windows\Backup\Microsoft-Windows-WindowsBackup".
Despite success result, the Backup job does not start running...
No errors or warning appears anywhere in Event Logs (Microsoft > Windows > Backup or Task Scheduler) nor in the scheduled task History tab. The schedule task complete successfully but no Backup job is run...
If scheduled task automatically set by Windows Backup software is duplicated (copied) and set manually it runs fine as 'administrator' and as 'nt authority\system' (subject that 'nt authority\system' is added to the 'Backup Operators' AD group).
Here is an export of the current pre-set schedule task, is there any settings that need to be changed to make it works?
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Author>MYDOMAIN\SERVER1</Author>
    <SecurityDescriptor>D:AR(A;OICI;GA;;;BA)(A;OICI;GR;;;BO)</SecurityDescriptor>
  </RegistrationInfo>
  <Triggers>
    <CalendarTrigger id="Trigger 1">
      <StartBoundary>2014-07-14T21:00:00</StartBoundary>
      <Enabled>true</Enabled>
      <ScheduleByDay>
        <DaysInterval>1</DaysInterval>
      </ScheduleByDay>
    </CalendarTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-18</UserId>
      <RunLevel>HighestAvailable</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>true</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>false</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
    <UseUnifiedSchedulingEngine>false</UseUnifiedSchedulingEngine>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>%windir%\System32\wbadmin.exe</Command>
      <Arguments>start backup -templateId:{f11eb3aa-74e7-4ff4-a57b-d8d567ee3f77} -quiet</Arguments>
    </Exec>
  </Actions>
</Task>
Thank you in advance for your feedback.

Answer 1

Once again, the issue is not to run the backup manually from the command line but to have it run via the scheduled task setup by the Windows Backup software.
By default, the schedule task is to be run as NT Authority\System, and when run under this account, the backup does not start (even though account is member of Backup Operators) and job can manually be run via elevated command prompt. This is not a normal
behavior and constitute a major bug in Windows Server 2012.
From my understanding the NT Authority\System account is a built-in account from Windows that should by default be part of the Administrators group (built-in) even though it does not explicitly appears like it in AD by default.
This account shall have by default Administrators rights and Backup Operators rights (via the Administrators group) without being explicitly added to those groups (http://msdn.microsoft.com/en-gb/library/windows/desktop/ms684190%28v=vs.85%29.aspx). By design
it is supposed to be the most powerful account which has unrestricted access to all local system resources. If that is not the case (as it seems) then this would constitute a major bug in Windows Server 2012 edition.
As said previously and as you confirmed, currently by default NT Authority\System on Windows 2012 server cannot start backup manually via an elevated command prompt unless it is manually added to Backup Operators (or Administrators) group. But wouldn't that
constitute a bug of Windows Server 2012?
Our server has not yet been restarted since I added NT Authority\System account to the Administrators group explicitly manually so I cannot yet confirmed it would sort the issue. Indeed it is heavily in use so cannot easily be restarted. Will confirm when
done.
We also have an additional problem where after a while of last reboot, part of the Exchange ECP can no longer be properly loaded in the web browser due to compilation error (compilation is done via NT Authority\System account which seems to no longer have
sufficient right to compile .NET code). What is strange is that it works at first and then stop working at some point... I am hopeful that adding NT Authority\System to the Administrators group would sort this issue as well but once again, that shall not be
needed!!!
Could a Windows Server 2012 update introduced some security policy changes or else that prevent NT Authority\System to have full power?