Backup fails with error sbrun.exe exited with unknown error 128(0x80)




ShadowProtect backup fails with the following error.

sptask 516 sbrun.exe exited with unknown error 128(0x80)


Symantec Endpoint Protection has certain applications and functions which actively intrude on processes to look for damaging activity.  This behavior automatically triggers sbhard’s “hardening” (Security) features.  This can also break other ShadowProtect processes.


If you are running Symantec Endpoint Protection version 11.0.5,  then uninstall it, then REBOOT your system, or revert back to a previous version, for example, version 11.0.1.   The REBOOT is required. Just uninstalling Endpoint Protection will not allow the ShadowProtect backups to resume.

UPDATE: On further testing, it was found that the basic Antivirus component that comes with version 11.0.5 will let ShadowProtect backups perform as normal.  If you install the components “Proactive Threat Protection”, or “Network Threat Protection”, the backups will fail. At this stage, we do not know which or if both of these cause the issue.

This solution was detected by looking through the windows application event log and checking what events have happened since the last successful ShadowProtect backup.   Of course, most system engineers will say that nothing has changed since it was the last working.  The entry in the event log looks like this.

Source: MsiInstaller
Event ID: 11728
General: Product: Symantec Endpoint Protection — Configuration completed successfully.

The ShadowProtect backups were working successfully with version 11.0.1 of Symantec Endpoint Protection.  All backups after the installation of VERSION 11.0.5 failed with the same error. Trying to configure Endpoint Protection to exclude the ShadowProtect files, did not resolve the issue.
After un-installing Symantec Endpoint Protection, the ShadowProtect backs resummed normal successful operation.

Instead of removing SEP, another solution to this issue may be to update the version of SEP that is installed on the server. Check for any SEP updates or install the latest version.

Another issue was located with an application called DeviceLock, which utilizes a policy manager to restrict access to devices. Disabling the DeviceLock application resulted in backups successfully occurring.


Written by Shihan Suhail


  • Was this Helpful ?
  • yes   no
1 Star2 Stars3 Stars4 Stars5 Stars (21 votes, average: 0.95 out of 5)