Avamar: Exchange Backups Failing due to Active Directory Time Mismatch

The Exchange server time clock becomes out of sync with the domain controller (DC) or network time protocol (NTP) server.

Exchange backups fail with errors similar to the following:

avexvss Error <0000>: Error [avamar.dellemc.com] Connecting to remote server failed with the following error message : Access is denied. For more information, see the about_Remote_Troubleshooting Help topic.  
avexvss Error <16954>: Unable to initialize Powershell interface process -- cannot continue.  
avexvss Error <13077>: Unable to complete backup.

You might also see the first error when opening the Exchange Management Shell on the Exchange server.

The Exchange server’s system time is not synchronized with the Active Directory domain controller or the network time protocol (NTP) server. When the time difference exceeds the Kerberos tolerance (typically five minutes), Kerberos authentication fails, preventing the Avamar backup agent from establishing a trusted connection.

• Clock drift on the Exchange server.
• Incorrect or missing NTP configuration.
• Domain controller clock skew.

1. Resynchronize the time between the Exchange server and the domain controller. Refer to Microsoft documentation for the required commands:
   Windows Time Service Tools and Settings (External Link)
2. Restart the Backup Agent service so that the avagent protocol recognizes the corrected system time.