Failed to prepare guest for hot backup.

[Colordeaf]

Howdy,

So I've been looking around in the Veeam B&R Powershell scripting lately. I used one of the scripts here on the community forum from Andy's scripting corner, adjusting the scripting and implementing the job works fine. But everytime I keep getting the error below. I'm almost afraid to ask this question since I didn't find simular problems through google and I've got the feeling I'm missing something dead obvious.

the error:
Failed to prepare guest for hot backup. Details: Failed to connect to guest agent. Errors: 'Cannot connect to the host's administrative share. Host: [wsus01]. Account: [xxxxxxxx\sa_veeam]. Win32 error: logon error: unknown username and/or password. Code: 1326 '

Anyway, troubleshooting so far:
- the user is enterprise/domain admin, backup operator.
- I can access the \\host\admin$ on the specified server from another computer.
- It's windows server 2k3 so the reg key for UAC isn't relevant.
- I've made sure there aren't any typo's in the script credential whise.

So yeah, I'm completely baffled by the fact I haven't got this properly working yet.

I've got the feeling that the error doesn't really correspond to the problem, that it lies somewhere else but Veeam isn't telling me. Or Powershell doesn't accept certain symbols even if the password is inbetween "". Those are my only guesses so far.

Any ideas where to look?

[veremin]

First of all, in order to understand better it might be worth taking a look at the actual code body.

Additionally, what happens if you change the way given account is specified: from domain\user to machinename\user?

Hope this helps.
Thanks.

[Colordeaf]

Unfortunately using a local account on the machine which is member of the administrators group shows the same result.

Also tested making a net use to the admin$ using the local account's credentials.

[Colordeaf]

Anyway, this is the only piece of code of the script I edited, the adding/editing of the job goes fine.

Code: Select all

#Manual Input (With input validation)
$VM = "WSUS01"
$VSSEnabled = "True" #True/False
$Username = "test_veeam"
$Password = "xxxxxxxxx"
$Domain = "WSUS01"
$CreateJobName = "VEEAM-WSUS01"

############################################################################################################
# Editable Settings (be carefull => no input validation)

$VCenter = "xxx.xxx.xxx.xxx" #vCenter/ESX-Host that was added to B&R Console - as displayed in the B&R Console

$RetainCyclesadd = "3" # Restore Points
$RetainDaysadd = "5" # VM deleted retention period in days


$VSSDefaultUsername = "test_veeam"
$VSSDefaultPassword = "xxxxxxxxxxx"
$VSSDefaultDomain = "WSUS01"
$SetResultsToVmNotesadd = "True" #Write Results to VM description/custom field
$VmAttributeNameadd = "BackupNotes" #Write Results to VM description/custom field

[veremin]

[xxxxxxxx\sa_veeam].

Is this account the one under which Veeam Service is being run? Does it have required permissions to access given share?

Are there any VMs running special MS applications (like SharePoint, SQL, Exchange, DC, etc.) within the backup job? If there are none, then, it stands to reason to disable Application Aware Image Processing and see whether it helps:

Code: Select all

$VSSEnabled = "False"

In case there is a VM that run special MS applications, kindly install VMware Tools on it and try run to the corresponding script again.

Hope this helps.
Thanks.

[Colordeaf]

Yes, the error was the situation where I used a domain admin account.

The script example was the edited version with the local account.

I'll try disabling VSS to see if that makes a difference.

[Colordeaf]

Unfortunately again the same error.

VMware tools is installed by the way.

[veremin]

It's windows server 2k3 so the reg key for UAC isn't relevant.

In addition, please check the “network access: sharing and security model for local accounts” security policy and see what mode is being selected.

The mode should be classic: Local users authenticate as themselves.

Thanks.

[Colordeaf]

Was already set to classic

[veremin]

Ok, I think, I finally managed to find the issue.The problem is that “False” absolute symbol, that has been mentioned in the original Andy's script, should be written as $False, instead of "False".

Thus, if you disable AAIP using the following line, everything is likely to work fine:

Code: Select all

$VSSEnabled = $False

Assuming even this doesn’t help, then kindly place the following line after the part responsible for creating the job and see whether it helps:

Code: Select all

$Job = Get-VbrJob -name "Name of newly-created job"
$Toset = $Job.GetVssOptions()
$Toset.GuestFSIndexingType = "None"
$Job.SetVssOptions($Toset) 

Thanks.

[Colordeaf]

your first suggestion worked immediately, thank you, now I have a standard I can apply on all the servers I want to add

I'm wondering though, if I do want to use VSS, what are the dependencies to make it work?

[veremin]

Glad to hear, that nowadays everything works, as expected.

I'm wondering though, if I do want to use VSS, what are the dependencies to make it work?

First of all, what happens if you start newly-created job from the GUI, not from PS console? Do you keep getting similar errors or not?

From my side, I’ve mentioned above all the caveats I happen to know that might prevent VB&R from accessing administrative share.

Since now it’s out of the scope of PowerShell sub forum, I’d recommend opening a ticket with our support team, letting them investigate it directly, and/or create a new topic in the specific forum section with the corresponding support ticket ID.

Hope this helps.
Thanks.

[Colordeaf]

Well, point is, I use the script as a template to easily fill out server information and have a new job ready with one click of a button.

I do however, start the job from the gui, mainly because I use the gui to monitor all my backups.

What caught my attention is that when I viewed the job options through the gui I noticed that the AAIP option was always enabled until I used $False. So it was probably nothing more than a wrongly used powershell command.

However, why the job fails with domain admin rights when AAIP IS enabled is a mystery to me. If there are any prerequisites I need to make on the backed up server end, there should have been some sort of warning or pop up when you enable the option in the job.

I'll try opening a case with the support team.

[veremin]

What caught my attention is that when I viewed the job options through the gui I noticed that the AAIP option was always enabled until I used $False

Yep, as I’ve stated previously, there was a typo with the original script that could be found in the Andy’s script corner. Absolute symbols (such as True and False) should be defined using $, not just quotes.

If there are any prerequisites I need to make on the backed up server end, there should have been some sort of warning or pop up when you enable the option in the job.

In fact, usually there are no preliminary steps that need to be taken in order for AAIP to work, apart from general confirmation that specified account does have required permissions to access administrative share.

Thus, I’ve recommended you to open a ticket with our support team, since it’s rather hard to investigate such an issue through forum correspondence.

I'll try opening a case with the support team.

The best way to go, indeed. Moreover, kindly update the topic with support case ID and/or found resolution for the convenience of future readers.

Thanks.