Hyper-v Cluster 2022 issues Veeam 12.1 [#07084245]

[pmfna]

Hi,

opened a support case [#03023835]

Experience several issues with veeam 12.1 and hyper-v cluster 2022.

Added firewall rules exceptions as per veeam documentation, still the issue is random and on every time the job gets executed(also tried to disable firewall and same issue still).

":: Error: Failed to connect to host NAME__OF_THE HOST : check managed server settings and verify network connectivity. "

":: Error: Access is denied. RPC function call failed. Function name: [InvokerTestConnection]. Target machine: [HOST_IP_ADDRESS:6163]."

":: Error: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) "

":: Error: Access is denied. RPC function call failed. Function name: [GetSvcVersion]. Target machine: [HOST_IP_ADDRESS:6160].

The user used to integrate the cluster has Cluster Administrator privileges, and the same user was added to the local administrator of all nodes of the cluster.


The firewall logs don't show any drop from veeam to hosts.

any help is welcome

regards

[Gostev]

Hi, 03023835 is not a valid support case number. Please provide a valid support case ID for the issue above. Thank you

[pmfna]

Veeam Support - Case # 07084245

[Gostev]

Thank you. I see you have literally just opened a support case. Please, give our support engineers to review your issue and respond.

In future, kindly don't cross-post your support cases immediately after opening them, as requested in the forum rules displayed when you click New Topic. As explained there, this is not a support forum for environment-specific issues; the purpose of this community is completely different. Thank you for understanding.

[karsten123]

there were no errors while adding the cluster to the inventory, right?
did you set the av excludes from kb1999?
is your access account a active directory user?
is your Veeam server a cluster VM or separate?

[pmfna]

Hi,

No errors adding cluster to inventory.

No Antivirus is setup in this environment yet

Access acount is active directory user with privileges to cluster as cluster administrator, and local administrator of the hosts of the cluster.

Veeam server is a physycal machine


regards

[scottupham]

Did you manage to resolve this? I am just opening a case with very similar messages so would be good to hear if you resolved this and how.

Thanks

[PerHolm]

I am also interested if there is a solution to this problem.

Regards

[pmfna]

Hi yes,

this case had to be escalated.

Veeam level 2 support managed to identify the issue, this was related to Credential Guard.

This was a fresh instalation of Windows Server 2022, not sure why, but it seems that Credential Guard was configured out of the box.

Veeam support statement:

"We’ve had a few cases until now in which Credentials Guard created random, intermittent “Access Denied” errors in jobs in Hyper-V environments, without any apparent pattern.
The solution was to disable it and keep it disabled on the Veeam server."

So the solution was to disable Credential Guard.

I've used the Device Guard and Credential Guard hardware readiness tool to disable it (Only from Veeam Server itself)

https://www.microsoft.com/en-us/downloa ... x?id=53337


Veeam should update the official documentation refering this possible issue

this kind of posts can be misleading and get to this kind of situation, so it should be refered as a requirement to disable the credential guard from veeam server

https://community.veeam.com/cyber-secur ... urity-3490

[scottupham]

Thank you for the reply and detailed post.

I have disabled Credential Guard now and backups seem a lot happier so far!

Hopefully Veeam are working on supporting Credential Guard.

Scott

[KSCSIT]

Has this been looked at in 12.2?
We recently switched to Hyper-V and had this issue - Disabling Credential guard on the Veeam server fixed it, but leaving it off goes against best practise so ideally want it back on.

[Gostev]

Yes, support for Credentials Guard didn't survive the regression testing cycle and was postponed literally a few days before 12.2 was shipped.