Event ID 4625 of Veeam.Backup.IdentityService.exe after Upgrade to 13

[kraeg]

Hello

After we have upgraded or VB&R Server to Version 13.0.1.180 the Security Event Log is flooded with Event ID 4625 error messages:


Fehlerinformationen:
Fehlerursache: Bei der Anmeldung ist ein Fehler aufgetreten.
Status: 0x8009030E
Unterstatus:: 0x0

Prozessinformationen:
Aufrufprozess-ID: 0x20f0
Aufrufprozessname: C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.IdentityService.exe


Detaillierte Authentifizierungsinformationen:
Anmeldeprozess: Authz
Authentifizierungspaket: Kerberos
Übertragene Dienste: -
Paketname (nur NTLM): -
Schlüssellänge: 0


The server is a standalone machine - no Active Direcory Member.

When the server was running with Version 12 we never got those messages.

Backup is running , but our SIEM is runnig crazy.

We have already opened a ticket - but the support does not have an idea yet.

Does anybody else have the same problem?

Thanks

Axel

[Yapman]

Ya Have a ticket open with the same issue.

Waiting to hear back from support right now but haven't heard anything yet.

[GenDev]

Following. Same issue.

[GenDev]

Not sure if this is the correct "fix". But, I went to Control Panel / Programs, select "Veeam B&R", and selected "Uninstall". When the setup dialog came up, I unchecked everything and then checked the plugins I do not use to uninstall them. Except, I did not uninstall "Veeam Plug-ins for Enterprise Applications Redistributable". Once I restarted the system, the 4625's went away.

Again, I dont know if this is the correct fix and I dont know which plugin was causing the issue. All I can assume was one of the plugins was trying to log into something that didn't exist.

[GenDev]

Edit to my previous post. Maybe that wasn't the "fix". The 4625's have definitely quiet down but still getting them occasionally for Veeam.Backup.IdentityService.exe.

[kraeg]

Veeam Support told me today, that this is only a "cosmetical" problem.

I think this is unacceptable for an enterprise security solutions. Our SIEM get flooded.

[Mildur]

Hi all,

I don’t see a case number shared in this topic.
Could you please provide the case number, so we can review the case and decide if a patch is required?

Thank you,
Fabian

[kraeg]

Hi

Our case id is 07898489 and it was noted, that the internal Veeam Reference number is #1163154

We have excact the same problem with two customer installations and we have stopped the rollout at all other locations.

Thanks

Axel

[Mildur]

Hi Axel,

Thank you, both numbers are helpful.
I reviewed the internal case, and since the issue is purely cosmetic, an immediate private fix is currently not planned.
The good news is that it’s currently scheduled to be addressed in version 13.1, which is planned for release next year.

Do you have the option to filter out this event ids on the SIEM side?

Best regards,
Fabian

[kraeg]

Hello Fabian,

Sorry - but this is not a purely cosmetic issue!

It's not a glitch in the GUI or a wrong color. It's an service trying to authenticate!

The event security log is getting flooded with entries. This means that older entries are getting deleted.

We have over 46 thousand authentication error every single day!!!! Just because of this "cosmetic" issue.

This is not the level of professionalism that we are all used of Veeam!

Please take this seriously!

[Mildur]

Hi Alex,

I’ll check with R&D and Support to see if we can address this earlier.

Best,
Fabian

[PeterDE]

Hi Fabian,

instead of "V13.1" we got the info last week, that "it is planned for this to be addressed in a future patch." (Case # 07898583).

We stopped all upgrades to V13 until this is fixed, as all four installations we upgraded have this issue.

Best regards,
Peter

[Mildur]

Following. Same issue.

Can you please share your case number.

Thank you,
Fabian

[m.thijs]

Same issue, Case #07918354

[Dima P.]

Hello folks,

Thank you for sharing your support cases! We’ve identified the issue and are working on a fix, which will be included in the upcoming patch.

[Yapman]

Same issue, Case #07897637