About using a self-protect backup job to protect server metadata

Last published : Apr 02, 2026
Backup Exec metadata contains information about backups and media server configuration. This metadata includes records of the files that are backed up, the media on which the files are stored, all media, and storage devices information. If the metadata is not protected, you may lose information on the media server.
Backup Exec has now introduced a self-protect backup job that is automatically created when Backup Exec is installed and performs backup of the metadata on the media server. The format of the job is as follows: <media-server-name> Backup Exec Self Protect Job.
The backup selection list cannot be edited as the list is pre-defined. By default, this job is targeted to the Any Storage option and it is recommended to configure a dedicated storage for the backup job. You can update the backup job target storage and schedule based on your preference.
The self-protect backup sets contain components such as catalog files, database, database encryption keys, job logs and so on, which can be restored to any existing media server. It is recommended to enable encryption to protect backup data from any unauthorized access.
The job cannot be deleted because it protects the essential metadata of a server. It can be put on hold if you are performing a media server backup through other jobs. If any metadata paths are updated, a self-protect incremental backup is converted to a full backup For example, the catalog or job log path is updated.
In a CAS-MBES scenario, the job is automatically created on each media server and backs up metadata specific to that media server. If you want to restore from self-protect backup sets, you must perform the restore on each media server separately.
Prerequisites for self-service restore
Before you start restore from self-protect backup sets, ensure that the following requirements and prerequisites are met:
  • Ensure that you have details of the current media server hostname, data path, catalog path, and job log path.
  • Ensure that the new media server name (NetBIOS) and domain same are same as the source server because self-protect backup sets restore database and catalogs to the original server name path.
  • Ensure that the catalog and job log path are same as the source server during Backup Exec installation on the new server because self-protect backup sets restore data, catalog and job logs files to its original server path.
  • Ensure that you import the devices to the destination server (new media server) if the source media server has a deduplication storage or a cloud storage device configured.
  • Ensure that you attach the same disks to the new media server. If the source media server has disks configured on the physical volume and cannot be moved, copy the BEData and the BEControl folder at the root of the volume on the target server.
Restoring Backup Exec from the self-protect backup set
To restore metadata from the self-protect backup set
  1. Install Backup Exec with the same server name, data, catalog path, and job log path as the source server.
  2. Import the existing storage containing self-protect backup sets to the new Backup Exec server.
See Importing media to Backup Exec.
  1. Right-click the disk storage device, and then click Inventory and Catalog.
See Inventorying and cataloging a storage device.
The self-protect backup sets are now available for restore.
  1. On the Backup and Restore tab, right-click the media server, and then click Restore.
  2. Select Files, folders, or volumes, and then click Next.
  3. Select File and folder backups to a point-in-time, and then clickNext.
  4. Select the self-protect backup set.
  5. Follow the Restore Wizard prompts to restore the data.
After the restore job is completed, you must restore the Backup Exec database using BEUtility.
To restore the database using BEUtility
  1. From the Backup Exec installation directory, in <Backup Exec install path>\Backup Exec, double-click BEUtility.
  2. On the Backup Exec Utility, click All Backup Exec Servers> right-click the media server name > clickRestore Database from BE Self Protect Backup.
  3. Review the information and click OK.
  4. Enter the credentials that you provided when you installed Backup Exec.
These credentials are later used as Backup Exec Service Account, System Logon Account, and Owner of System Logon Account credentials.
  1. Complete the restore process and then click Close.
The new Backup Exec server is now ready to use and in the same state as the original server.
The role-based access feature is disabled. Go to Backup Exec settings to enable the feature.
If any errors are observed during service start, open the service manager and restart all Backup Exec and Deduplication services.
In a CAS-MBES scenario, you must perform all the earlier steps for each Backup Exec server separately using the self-protect backup set.
Related information