Win SRV 2019, application-aware doesn't work

[lazman]

Hi, my support case is 03587895.

I'm trying to make a consistent backup on esxi 6.7 and vcenter 6.7u2. The VM has Windows Server 2019 with the latest updates, installed this morning. I installed the vmware tools 10.3.10 (vcenter show version: 10346).
The problem is that if I try to take a consistent snapshot, it fails. Flag: quiesce guest file system (Needs VMWare Tools installed).
All this in vcenter.

If I'm not mistaken, veeam B&R has its own agent that should make a consistent backup but it's not clear to me how to activate it.

In the backup job -> Storage -> Advanced -> vSphere, I find an entry without flag called "enable VMware Tools quiescence" I have to activate it only if I don't enable the application-aware?

If I go into Guest Processing and activate "Enable appplication-aware processing" and as Guest OS credentials, I try to insert: domain name domain amin, or: hostname administrator, the connection TEST fails when VEEAM tries to connect via RPC.
I tried to disable the Windows 2019 firewall and the problem is solved.
Is the solution to open doors? If yes, which ones should I open?

I also contacted vmware support 2 times for the "quiesce guest file system" problem and they made me uninstall the VSS support of the vmware tools. But this way I don't get more consistent backups.

Thank you.

[veremin]

And just to be sure - what product version you're currently at? Thanks!

[lazman]

Veeam Backup & Replication 9.5 update 4 ver. 9.5.4.2753

[skrause]

Do you have the proper firewall ports open on the guest OS for "guest interaction proxy"?

If the network path top the guest OS is not available for guest interaction, the process will fail over to trying to use VIX mode (which requires VMTools.)

[lazman]

I didn't open any doors. I limited myself to installing windows server 2019, making updates and installing the latest version of vmware tools.
If there are doors to open, can you tell me which ones are they please?
Can I use my domai admin account to use the application-aware on all Microsoft servers in the domain?

Thank you.

[lazman]

I tried to open the traffic coming from the gates: 135, 137, 139, 445, 6190, 6290 from the IPs of the VEEAM servers.
Now it's working.

Say it's all and can we close the case?

[lazman]

I can't get the backup-aware to work with the domain admin's credentials. The domain admins group is inserted by default in the local administrator group once the machine join in the domain.
Do I also need to open ports on the VEEAM server?
I didn't open the RPC 49152 to 65535 ports on the client.

Should all these doors be opened too?

[veremin]

Are you sure all ports are opened in accordance with this table? Thanks!

[lazman]

I don't know, the table has too many names and ports, I didn't take courses to install VEEAM, I don't have any certification. Reading the table I realized that the ports 135, 137, 139, 445, 6190, 6290 must be open.
It is not clear to me if I should also open from 49152 to 65535.
The test with a local administrator user succeeds by opening these ports 135, 137, 139, 445, 6190, 6290. It is not clear to me if I can open the traffic coming from the veeam server ports or if I have to open some other IP ( vCenter for example?).

I still have the following problems:

1. The domain admin user fails the application-aware test.
(only works with the local administrator user)

2. If I restore a backup of a VM made with application-aware,
when I turn on the restored VM, Windows shows the message that the computer shut down unexpectedly.
(Is it then a consistent backup of Active Directory? Can I trust it?)

When it was still working and I was able to do "Quiesce guest file system (Needs VMWare Tools installed)" and I tried to do a snapshot restore I didn't get the message that the computer shut down unexpectedly, so I trusted a consistent backup for AD.

I do not understand anything anymore!!! Help!

[skrause]

You need the RPC (by default 49152 to 65535) ports open in both directions between whatever system is working as your Guest Interaction Proxy and your Guest VMs per the chart.

(First column on the chart is the source system, second is the target. So if you look at the chart, there are 3 "Guest Interaction Proxy to Windows VM" and 1 "Windows VM to Guest Interaction Proxy.")

[lazman]

So starting from a client with newly installed Windows Server 2019, with default Windows firewall configuration and a VEEAM server with Windows Server 2016 (veeam has installed the Guest Interaction Proxy on this server by default), I have to create a client rule for open traffic coming from the 2016 server on ports: 135, 137, 139, 445 (6190, 6290 are not necessary).

I think I don't need to open the 443 in my vcenter if I understand correct.

I did not understand if the dynamic RPC ports 49152 to 65535 open automatically if necessary or if I have to open them in the clients (SRV 2019) and in the server (SRV 2016).

I still have the 2 problems I described even if I disable the firewall both in the client and in the server.

[foggy]

Make sure the backup is actually application-aware (for that, configure the job to require success in application-aware processing options).

[lazman]

I'm sure it is. So do you confirm that I shouldn't get the message that Windows has been turned off unexpectedly?
It is not a production machine, it is a windwos 2019 installed just for testing. I created a dedicated job, selecting appliaction -aware and set the credentials of the local user.

[Andreas Neufert]

This is the default state that microsoft has defined if you restore a server and we follow this. The normal operation was disrupted so windows ask for the reason to document this.

[Andreas Neufert]

If you do not trust our statistic view in case of guest processing, you can check windows event log on the VM and dependent on the installed applications you can see VSS processing entries there.

[lazman]

My doubt remains with Active Directory, I want to be sure that my DCs are saved correctly.
The doubt came to me because, on win srv 2016, if I take a snapshot putting the flag on: Flag: quiesce guest file system (Needs VMWare Tools installed), when I restore the snapshot I don't get the message that windows was turned off unexpectedly.
But if you say that everything is ok, as the assistance confirms, I trust.

For the domain administrator user, performing the test, he gives me a yellow triangle saying that RPC is ok, but VIX no, doing a test that contains many VMs is a real mess, I would have preferred to see everything green in the test. I think I will create local administrator users and put server credentials per server. So that when I do a test I can see everything green and not try to understand if there are problems.
Thank you

[Andreas Neufert]

VMware own processing performs only limited guest processing. You can think about it to prepare a clone... Veeam own guest processing performs much more things and treat applications differently to avoid issues at restore. And this include to let the VM know that something happened after restore.

Our DataLabs SureBackup can give you a restore test environment and a ondemand lab were you can try restored out and see how it goes.

Regarding the test... RPC is processing over network... VIX is processing through ESXi and VMware tools.

One need to work and this is indicated by the warning instead of failed. The reason why it is not green is that we do not know what is normal for your environment. For a hoster network mode through VIX is the standard but for many regular customers it is RPC... but for the DMZ it is networkless VIX...

VIX has several pre requirements around used user and windows UAC, so it is normal that it is not working in your environment.

This should give you a good overview...
https://bp.veeam.expert/job_configurati ... processing

[lazman]

Thank you for the link!