How to resolve SQL Server “Unable to check backup media” alarms with Access Denied errors (4380885)

A “Unable to check backup media” alarm was fired in Foglight while monitoring SQL Server backup locations on a network share.  
The alarm was triggered by the following error:

Failed to get free space of disk [\\SERVER\BACKUPSHARE\] . Reason: Access is denied.
java.lang.Exception: Access is denied.

This error means Foglight cannot access the backup location to check disk space, which prevents successful monitoring and triggers the alarm.

Foglight’s Agent Manager (FglAM) service runs OS-level commands (like checking free disk space) to monitor backup shares.  
The Windows account running the FglAM service is the one used for all file system and network share access.  
If this account does not have proper permissions to the backup folder (both Share and NTFS), Foglight cannot check the media and will trigger the alarm.

Note:

• The credentials configured for your Foglight agent are only used for database and remote OS monitoring, not for accessing network shares.
• The FglAM service may run under a named user, built-in account (`Local System`, `Network Service`), or managed service identity.
• Even if you can check the backup location interactively using your own account, Foglight will fail unless the FglAM service account has direct access.

If you’re not using a named user:

• For `Network Service` or `Local System`, permissions must be granted to the computer account (e.g., `DOMAIN\HOSTNAME$`) on the file server.
• For a managed service identity (gMSA/MSI), grant permissions to that identity.

1. Identify the FglAM Service Account
   1. On the FglAM host, run `services.msc`.
   2. Find “Foglight Agent Manager” and note its “Log On As” user.
   3. If the account is `Network Service` or `Local System`, note the machine name for permissions (e.g., `DOMAIN\SERVERNAME$`).
2. Test Permissions Using the FglAM Account
   1. Log in to the FglAM machine as the same Windows user running FglAM.
   2. Open Command Prompt and run:
      dir \\SERVER\BACKUPSHARE\
   3. If you get "Access is denied", the FglAM service account lacks permission.
3. Grant Proper Permissions
   1. On the file server, right-click the backup folder.
   2. Go to Properties -> Sharing -> Advanced Sharing -> Permissions.
   3. Add the FglAM service account, computer account (`DOMAIN\SERVERNAME$`), or managed identity., and grant "Read" permission.
   4. Repeat for Properties -> Security (NTFS permissions).
   5. Both Share and NTFS permissions must be set.
4. Restart Services and Verify
   1. Restart the Foglight Agent Manager service.
   2. Confirm the alarm clears and Foglight shows backup location status.

Troubleshooting Tip:

If you’re using a mapped drive (e.g., Z:\), always test with the UNC path (`\\SERVER\SHARE`). Services like FglAM cannot access mapped drives defined for user sessions.

If you change the FglAM service account:

If you change the FglAM service account, always update permissions on all relevant backup shares and folders, and coordinate with IT if managed service identities or group policies are involved.