2.

Check all the basic Backup Exec permissions, this can be done with Group Policy
Management Console on a domain controller
or Local Security Policy on the Media server. If the Local Policies are locked out
by a Group Policy, the permissions will need
to be added with the Group Policy Management Console at the domain controller.

Act as part of the operating system

Backup files and directories
Create a token object
Log on as a batch job
Log on as a service
Manage auditing and security log (BE 2010 R3 and later)for exchange 2016 dont put
it
Restore files and directories
Take ownership of files and other objects
Directions:

Local policy:
On the local machine Press the Windows logo key + R to open the RUN dialogue
Type gpedit.msc in the text box, and then click OK or press ENTER
Browse to "\Computer Configuration\Windows Settings\Security Settings\Local
Policies\User Rights Assignment" and add the user to each policy listed above
Group Policy Manager:
On the Domain controller Press the Windows logo key + R to open the RUN dialogue
Type gpmc.msc in the text box, and then click OK or press ENTER
Right click and select Edit... for the group policy the machine is in.
Browse to \Computer Configuration\Windows Settings\Security Settings\Local
Policies\User Rights Assignment and add the user to each policy listed above

Group Memberships or equivalent access:

Domain Admins or Administrators.
Backup Operators.