1173159 - BR*Tools errors occur when accessing "database" directory

Symptom

The following errors occur in Oracle 10g or higher:

Symptom 1
---------
When you access the directory %ORACLE_HOME%\database, the system displays the following warnings of BR*Tools on Windows platforms, for example:
BR0252W Function remove() failed for 'D:\oracle\SID\102\database\sapSID.ora' at location BrInitOraCreate-1
BR0253W errno 13: Permission denied
BR0252W Function remove() failed for 'D:\oracle\SID\102\database\sapSID.ora' at location BrInitOraCopy-7
BR0253W errno 13: Permission denied

Symptom 2
---------
After you use the Database Upgrade Assistant (DBUA) to apply Oracle patch set 10.2.0.4, BRBACKUP and BRCONNECT fail and the system issues error messages such as:
BR0252E Function CreateFile() failed for 'E:\oracle\SID\102\database\spfileSID.ora' at location BrFileStatGet-2
BR0253E errno 5: Access is denied.
BR0273E Determination of file status for E:\oracle\SID\102\database\spfileSID.ora failed

Other Terms

BR*Tools, BRBACKUP, BRCONNECT

Reason and Prerequisites

1173159 - BR*Tools errors occur when accessing "database" directory

These problems occur only if you use the SAP system (transaction DB13) to start BRBACKUP or BRCONNECT.
Symptom 1 occurs if the Oracle software was not installed in an SAPinst operation in which the access authorizations are automatically adjusted to the database directory.
Symptom 2 does not occur if you applied patch set 10.2.0.4 manually (not using DBUA).

Solution

For symptom 1:
Under user <SID>ADM in a command prompt window, change the access authorizations on the database directory using the following commands:
cacls %ORACLE_HOME%\database /E /G ORA_OPER:F
cacls %ORACLE_HOME%\database /E /G ORA_%ORACLE_SID%_OPER:F
cacls %ORACLE_HOME%\database /E /G ORA_DBA:F
cacls %ORACLE_HOME%\database /E /G ORA_%ORACLE_SID%_DBA:F
For symptom 2:
To eliminate symptom 2, you must change the access authorizations so that they do not apply only to the database directory, but to all database files and the spfile. To avoid a large amount of manual steps, in BRCONNECT 7.00 Patch 39 and BRCONNECT 7.10 Patch 19, the workaround option "-SFP" (set file permissions) is provided for the "check" function. You can use this to perform a BRCONNECT call under the user <SID>ADM to set all of the required access authorizations, for example:
brconnect -u / -c -f check -SFP
In the process, the access authorizations to the following directories and the subdirectories and files under them are modified:
%ORACLE_HOME%\database,
<X>:\oracle\<DBDID>\origlog
<X>:\oracle\<DBDID>\mirrlog
<X>:\oracle\<DBDID>\sapdata<N>
If the system issues any warnings about Windows groups that do not exist (for example, ora_oper), you can ignore these.