VEEAM CBT driver will not install on manually added server

[ccone@vascorltd.com]

Getting this error after updating to VEEAM B&R 9.5 U4:
[SERVER01] CBT driver installation completed with error: Unable to install Veeam change block tracking driver: Microsoft Windows Security Update KB3033929 is missing.

The error seem simple enough to fix, until I login to that server and see that KB3033929 is already installed. Is this something that someone else has already encountered and fix? Or is this a new case for VEEAM support?

Thanks!
Clint

[Dima P.]

Hello Clint,

Try to reboot the host and then manually Rescan it. Once done - try to perfrom the driver installation again. Cheers!

[mccabejr]

Did the "try and reboot the host and then manually rescan it" work for others?

I'm running into the same situation as the original poster, with Windows Server 2008 R2 end points, and this has not resolved my issue.

I CAN "rescan" the individual end-point in the Backup & Replication Console just fine. This completes successfully.

However, when I attempt to manually kick off the "Driver installation" option to install the CBT driver, we're still presented with the following:

"CBT driver installation completed with error: Unable to install Veeam change block tracking driver: Microsoft Windows Security Update KB3033929 is missing."

In my specific instance, when you check the installed Hotfixes on the Windows Server 2008 R2 end-points, the Hotfix for KB3033929 is *not* listed specifically.

However, when you attempt to manually install KB3033929, you are presented a Windows Update Standalone Installer dialogue window that states: "Security Update for Windows (KB3033929) is already installed on this computer.

Reviewing the local system’s CBS log (%systemroot%\Logs\CBS\CBS.log) reflects the following:

Code: Select all

Appl: Evaluating package applicability for package Package_54_for_KB3033929~31bf3856ad364e35~amd64~~6.1.1.1, applicable state: Staged
Appl: Evaluating package applicability for package Package_55_for_KB3033929~31bf3856ad364e35~amd64~~6.1.1.1, applicable state: Absent
Appl: Evaluating package applicability for package Package_56_for_KB3033929~31bf3856ad364e35~amd64~~6.1.1.1, applicable state: Staged
Appl: Evaluating package applicability for package Package_57_for_KB3033929~31bf3856ad364e35~amd64~~6.1.1.1, applicable state: Installed
Appl: Evaluating package applicability for package Package_for_KB3033929_RTM~31bf3856ad364e35~amd64~~6.1.1.1, applicable state: Absent
Appl: Evaluating package applicability for package Package_for_KB3033929_SP1~31bf3856ad364e35~amd64~~6.1.1.1, applicable state: Installed
Appl: Evaluating package applicability for package Package_for_KB3033929~31bf3856ad364e35~amd64~~6.1.1.1, applicable state: Installed

Starting October 2016, Microsoft started releasing "Security Monthly Quality Rollup" cumulative updates. If you look up KB 3033929 in the Microsoft Update Catalog (link: https://www.catalog.update.microsoft.co ... ?q=3033929), you see that it has been superseded by the following:

Overview Language Selection Package Details Install Resources
This update has been replaced by the following updates:
2017-05 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4019264)
2017-06 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4022719)
2017-07 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4025341)
2017-08 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4034664)
2017-09 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4038777)
2017-10 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4041681)
2018-08 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4343900)
2018-09 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4457144)
2018-10 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4462923)
2018-11 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4467107)
2018-12 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4471318)
2019-01 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4480970)
2019-02 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4486563)
2019-03 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4489878)
2019-03 Security Update for Windows Server 2008 R2 for x64-based Systems (KB4474419)
April, 2017 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB4015549)
November, 2016 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB3197868)
October, 2016 Security Monthly Quality Rollup for Windows Server 2008 R2 for x64-based Systems (KB3185330)

[wishr]

Hi James,

Have you had a chance to discuss this situation with our technical support? If not, I would suggest following this way.

Thanks,
Fedor

[mccabejr]

Hi Fedor,

I submitted case #03475989 to Support this morning with my findings. I'm still waiting on initial contact to be engaged - standing by to share my findings and support troubleshooting further in any way I can!

[wishr]

Hi James,

Thanks for letting us know!

To anyone curious, as far as I see it has been resolved by disabling the "KB installation status check" using a reg. key - of course, it's a workaround, but it does the trick. The reg. key is available by request - please reach out to our tech. support team if you are experiencing the same issue.

Regards,
Fedor

[mccabejr]

Good morning, Fedor, et. al.

Yes - that is correct. After applying the Registry Key 'workaround,' provided by Support, everything installed and functioned as expected. Simple enough.

[TACHC_TECH]

Hi all,
We're new to Veeam and just getting started. However, right out of the gate we're having issues with the requirement for Veeam to note the presence of the years-old Microsoft KB3033929 update. We keep our boxes updated monthly and this updated has been superseded multiple times since 2016. To meet the requirement, I had to manually uninstall a number of security rollups to get to a point where Windows would allow me to install 3033929 from the standalone installer. This isn't cool for production boxes because these reboots can take hours. After finally getting KB3033929 and the CBT driver installed, we're left with a incompletely patched servers! Not thrilled about letting WSUS replace the security rollups for fear that the CBT driver will fail or we'll get stuck in the dreaded reboot loops. Anyone have experience they can share? Thanks in advance!

[veremin]

The issue has been discussed previously. Kindly, refer to the answers provided above for more information and potential workaround. Thanks!

[TACHC_TECH]

Hello V.Eremin,
Thank you for your reply. Do I understand that with this registry key workaround, my fully patched servers will be able to install the CBT driver without fear of reboot loops?
Cheers!

[wishr]

Hi,

Yep, your understanding is correct.

[TACHC_TECH]

Thanks Wishr,
If this is the case, then why isn't the client install simply checking for any of the many security rollups that contain the KB3033929 patch function? This issue has created a big headache for our Association and we haven't even taken a backup yet. :/

[wishr]

Hello,

The workaround implies the disabling of the "KB installation check" if the KB3033929 has been already installed by applying a reg. key obtainable from our support team. Of course, we'll see what can be improved in later versions if not done yet. I'll share more information in this thread once have it.

Regards,
F

[TACHC_TECH]

Thanks F,
We're in good shape now.
L

[powersjo]

Just to wrap this up nicely, Veeam posted a solution for this. They provided the location, name and value of the reg key.
https://www.veeam.com/kb2931

Name:DisableCBTKBCheck
Type:REG_DWORD
Path:HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Endpoint Backup
Value:1

NOTE! Make sure that you have at least KB3033929 installed in your system. Installing a CBT driver on a Windows Server without any updates will cause boot issues.