License Expired and then Access Denied

[daesiku]

Lab environment using the Veeam B&R Community Edition and Veeam Agent for Windows and Linux. After finalizing the new setup (pointing the VAW and VAL at the new B&R server) backups functioned for a week or so, then started throwing a license expired on all machines, (Windows and Linux alike).

When I checked the licenses in B&R Console, it said 10(0 used) which lead me to believe the agents for some reason weren't pulling a license (perhaps because the agent was installed stand-alone first?)

The VAW and VAL began reporting it was "Workstation" instead of the free version. Clearly we have a miscommunication somewhere.

Linux Agent:
Created a protection group, and performed a rescan. The agent consumed a license. Created a job and the job was pushed down to the agent without issue. Logged into the Linux machine and kicked off the newly created backup.

Windows Agent:
Tried to create a protection group in B&R and received the following during rescan:

Code: Select all

11/19/2019 8:23:26 PM :: Unable to install backup agent: cannot connect to {IP} Error: Access is denied.

Removed the agent and tried a re-install from the B&R console, no change. VAW target was a Windows 10 non-domain joined machine.

In the security log, I could see the successful login, and I had disabled firewalls on both the B&R server and the target host. I'd disabled UAC on the destination host as a test, so based on various other articles, I suspected this was the lack of the admin share (since this is not a domain joined machine).

Solution:
Create Registry DWORD Value

Code: Select all

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
   LocalAccountTokenFilterPolicy (Value:1)

This created the admin share, which allowed the install to succeed.

Still uncertain why the agent version switched to Workstation, but I suspect it's related to the way Community Edition is licensed. I did attempt to untick Allow unlicensed agents to consume instances in hopes that the VAW would revert back to free, however that box seems to be greyed out in Community Edition. After deployment of the agent, I removed the registry key, enabled UAC, and re-enabled the firewalls without issue.

Lessons Learned:

• The Veeam Agent for Windows deployment seems to require the $admin share be available (I have seen this referenced elsewhere, but this is a first hand account).
• Veeam Agent for Windows Licenses in Free Mode pointed at Community Edition after Install will stop working and report expired licenses

Hope this saves someone else some time.

[HannesK]

Hello,
and welcome to the forums.

the admin$ requirement is listed here: https://helpcenter.veeam.com/docs/backu ... l?ver=95u4

Just a few notes:
- admin$ also exists on standalone Windows per default
- everything managed from VBR consumes a license
- for unmanaged agents there is a checkbox in the main menu -> licenses -> instances -> "allow unlicensed agents to consume instances"
- your reg key makes computers vulnerable to pass-the-hash attacks (well, maybe not standalone systems)

Best regards,
Hannes

[daesiku]

Thanks Hannes, I was looking for the reference in the documentation, so I appreciate you pointing it out.

admin$ also exists on standalone Windows per default

Correction: This is disabled by default for local accounts (per the Microsoft article referenced in the doc you linked to).

for unmanaged agents there is a checkbox in the main menu -> licenses -> instances -> "allow unlicensed agents to consume instances"

In my UI, this option is greyed out. That is where I looked immediately when I ran into the license problem. I couldn't find a reference to this being a Community Edition specific thing.

your reg key makes computers vulnerable to pass-the-hash attacks (well, maybe not standalone systems)

The security implication is why I immediately removed the key once the install went through. I couldn't think of another method to get the agent to a functional state since I couldn't uncheck the "Allow unlicensed agents to consume instances"

[HannesK]

hah, thanks for pointing to the article - I have to admit, that I only searched for admin$ (which is obviously not possible for someone who does not know about admin$ - agree) - sorry for that one.