Error during config backup import (VBR migration out of domain) Case #06167404

[tinto1970]

Good day all,

I and the customer I am supporting took the decision to move VBR in a windows server out of the production Active Directory.
We followed usual procedure (install a fresh new VBR in a server in workgroup, stop/disable all jobs/backup configuration/import configuration on the new machine).

Everything went apparently fine until the last step, we got the error "Failed to launch the application. Account not found"
we had to click "cancel" and we have seen that it's impossible to launch VBR.

I think my fault is: in "Users & Roles" of the old VBR server I can see a lot of domain users, and one local user (oldvbrserver\user_1).
The restore process restores these settings too and so it's impossible for the new VBR to start

What is the correct (if exists) procedure to be followed in such case? Should I add in the old VBR at least one group like "local administrators" and/or have I to remove all the active directory users?

I have opened a SR too, but I think that this issue we have had could be interesting for the veeam community.

[Mildur]

Hello Alessandro

The correct procedure is documented in our user guide:
https://helpcenter.veeam.com/docs/backu ... ml?ver=120

Those additional users in "Users&Roles" are not responsible for a backup server to start it's processes. But they may be used to connect to components on additional managed servers. If you removed those managed servers from the AD too, you have to provide new local credentials for each managed server.

I recommend to keep working with your support engineer. Please share the solution after they had the chance to analyze the debug logs.

Best,
Fabian

[tinto1970]

Thanks Fabian, at the moment we removed only the VBR Server from AD.

We updated the case with requested logs yesterday at 8 UTC and still waiting for a feedback. I will share the solution when we find it.
best regards

[Mildur]

Hello Alessandro

You may use the Talk to a manager button if you find the case not going forward:
https://www.veeam.com/kb2320

Best,
Fabian

[tinto1970]

I had a call with the support engineer. MFA is supposed to be the cause of the failed import. I'll update the thread asap.

[LickABrick]

@tinto1970, any updates on this? I have just migrated a VBR server to a new server (both out of domain, but with a different hostname) and can't login to the new VBR server with message 'Account not found'. The import of the backup config went OK though.

MFA was enabled on the old VBR install.

[Mildur]

Hi Lick

The last status from the case was using the following procedure:
1. Disable MFA and create a new Configuration Backup.
2. Restore it on the new Server again.

If you don't have the old server anymore, you may open a case with our customer support.
They have procedures to disable MFA. Then you should be able to login again.

Best,
Fabian

[LickABrick]

Hi Mildur,

Thanks for the response. Disabling MFA before making the configuration backup worked.

[mdiver]

Also had to do that in a VBR migration now. (Customers are leveraging 2FA, which is nice.)

But what about an unplanned config restore because of a loss of the VBR with 2FA enabled?
As 2FA will be active during automatic config backups, one would not be able to import the config to a new VBR.

[y2953]

I've been following this thread with great interest. My concern is related to potential unplanned outages of the source Veeam server. If such an outage occurs and we're relying on a config backup that has MFA enabled, it seems like we might be stuck without a way to use this backup effectively on a new server. This scenario worries me quite a bit.
I'm wondering if there's any kind of advisory or warning from Veeam when enabling such features, highlighting these potential risks and how to mitigate them. Is anyone aware if Veeam is working on a solution or workaround for this? It would be reassuring to know there are steps we can take or that there's guidance available to prevent getting caught in a situation where we can't recover due to MFA constraints.
Thanks in advance for any insights or updates you might have.

[Mildur]

Hi Tom

May I ask, what sort of repository you use for the configuration backup?
We have a limitation with MFA if you use a repository which requires a gateway (Shared Folder, StoreOnce, Data Domain, Object Storage). For such repositories MFA will be an issue. Workaround: Copy the configuration backup file to a local disk and restore the configuration from there.

For all other repositories, configuration restore should work with MFA as well.

Best,
Fabian

[Mildur]

Hello all

I just run a configuration restore from a MFA enabled backup server (version 12.1.1.56). Configuration backup was on a windows ReFS repository.
Because MFA was enabled on my backup server I got the following warning to disable MFA or stop the backup service manually with the windows service console. After stopping the backup service, configuration restore finished successfully.



MFA gets disabled during the configuration restore and must be manually re-enabled (just enable the checkbox in users/roles) by the backup administrator. Users do not have to redeploy their authenticators:


Best,
Fabian