Case #07200595 — MS SQL restore failed in SQL Plug-in with access denied error code 0x80070005, failed to start VDI

[Noushad]

we have installed SQL Plugin and configured plugin to connect VBR server using a service account bkadmin, this service account also has local administrator permission on SQL server and all permission on DB also, later when we access the option to backup SQL as administrator,we cant see any DBs, but when we access it using service account, we can see all DBs to backup, and was able to complete backup job successfully for the SQL server. However when we access the restore button and provide target details and new DB name, later it fails with "access denied error code 0x80070005, you must be logged in as windows administrator to create virtual device , failed to start VDI restore", as shown in case. all logs attached in case.

later we ran the restore icon in desktop as administrator, but this time, we are not able to mention or select target DB instance. When we give new name to target DB, it causes error 'wrong' path for the SQL files.

someone please help with a resolution.

[HannesK]

Hello,

you must be logged in as windows administrator to create virtual device

this sounds like the service account is not a local admin. Can you confirm my guess?

If not, then I suggest to continue with support.

Best regards,
Hannes

[Noushad]

Hi Hannes,

thank you for the response.

we configured the SQL plugin to use the service account "bkadmin" to connect to Veeam B&R server, in SQL server. This same service account is " Veeam backup administrator " in Veeam B&R server, so it has complete permission in Veeam server and backup repository. Also we logged into SQL server using same service account "bkadmin" and logged into SQL Server Management Studio as same user (By using windows authentication). So please explain why ONLY backup works fine using the SQL PlugIn and why SQL PlugIn restore fails?
because service account "bkadmin" has all the permissions in SQL Server and in Veeam B&R server and this service account is also part of local Administrators group in SQL server and has roles public, sysadmin.

we have gone through all permissions described in documentation and all are there .

in below permssions link, i see "If the account is not a member of the local Administrators group, you must enable the Create Global Objects security policy setting.", what does this mean ? is this applicable to windows 10,11 ? when i click on microsoft article link mentioned in document, microsoft document says its only applicable to windows 10,11. So i hope "Global Objects security policy setting" is not for Microsoft window server , please clarify ?

https://helpcenter.veeam.com/docs/backu ... ml?ver=120

[PetrM]

Hello,

In fact, it's quite challenging to get an idea of the problem over the forum posts. You should continue working with our support engineers, I'm sure that they will find out the root cause soon. Nevertheless, I asked our support leaders to pay attention to this case and probably escalate it.

Thanks!