Scheduled or manual Windows Server Backups fail after installing Symantec Endpoint Protection 12.1.
Windows Server Backup logs contain the following error:
"The operation was stopped. Detailed error: The Process cannot access the file because it is being used by another process..."
The Application Event Log may show one or both of the following errors:
Event ID 517: "The backup operation that started at <time>' has failed with following error code '2155347997' (%2155347997155347997).
Please review the event details for a solution, and then rerun the backup operation once the issue is resolved."
"Error in deletion of [<Volume>\System Volume Information\EfaData\SYMEFA.DB] while pruning the target VHD: Error [0x80070020] The process cannot access the file because it is being used by another process."
If Process Monitor is run during the Windows Server Backup failure, an ACCESS DENIED entry will be seen when wbengine.exe tries to access <Volume>\System Volume Information\EfaData\SYMEFA.DB.
The SEP client utilizes a Extended File Attribute (EFA) database stored on the \System Volume Information directory. Windows Server Backup attempts to access the SEP client's EFA database during the backup process fail as this file is locked.