PowerShell environment initialization failed: Failed to connect to Veeam Backup

[Elemer.gazda]

Hi,

Background:
We have server monitoring software which runs as a service on all servers (including Veeam).
This above service is running as "NT Authority\System".
We have a number of powershell scripts to monitor the state of the backups on the Veeam servers.
As a consequence the powershell scripts are executed as "NT Authority\System"

Issue:
Recently some servers started to output Access is denied when the above scripts run.
It fails at the step "Connect-VBRServer -Server localhost"

Here is the output of one of these sessions:

Code: Select all

PS C:\Windows\system32> whoami
nt authority\system

PS C:\Windows\system32> Add-PSSnapin VeeamPsSnapin

PS C:\Windows\system32> Connect-VBRServer -Server localhost
Connect-VBRServer : PowerShell environment initialization failed: Failed to connect to Veeam Backup & 
Replication server: 
Access denied.
At line:1 char:1
+ Connect-VBRServer -Server localhost
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Connect-VBRServer], Exception
    + FullyQualifiedErrorId : System.Exception,Veeam.Backup.PowerShell.Cmdlets.ConnectVBRServer
 

Note:
SQL Server is running as Local System
The same script works fine if run as a local administrator.

Question:
How could this be fixed?
What permissions need to be changed?
Is it on the SQL Server?

Regards,
Elemer Gazda

[HannesK]

Hello,
hmm, I cannot confirm your observations

Code: Select all

Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> whoami
nt authority\system
PS C:\Windows\system32> Add-PSSnapin VeeamPsSnapin
PS C:\Windows\system32> Connect-VBRServer -Server localhost
PS C:\Windows\system32>

but I would try it with user and password parameter (must be a local admin)

Best regards,
Hannes

[Elemer.gazda]

Hi @HannesK,

I know it is just randomly happening, so far we had 2 servers playing up.
The fix I applied on the first server was to change the "Log on as" for the Monitoring Service to a local Administrator.
Because the script runs fine as local administrator this was effectively fixed.

Now we have a second server where SYSTEM has access denied to the Veeam powershell.

Whilst I could change the Logon for the monitoring service again, it wouldn't be a scalable solution.
Ideally I want to figure out what permissions are needed and change that.

Setting the Password in the script is not an option in my case because the 56 Veeam servers we monitor are located on 50 different organizations, and passwords don't match.

Here is a screenshot as well:

Image on OneDrive

Regards,
Ele

[chris.arceneaux]

Hi Elemer,

I, like Hannes, am not seeing the same behavior in my lab environment. You mentioned that your monitoring agent service is running as the System account. If you changed that service to run using an account with local administrator permissions, this should resolve the odd behavior you're seeing without specifying the password in the monitoring script.

[Elemer.gazda]

A bit more update on this.
Server was installed on 13/09/2019 (last Week).
Operating System is Windows 2019 - 1809
Veeam is version 9.5.4.2866
SQL is 2016

I have found 3 other servers with the specs as above, but they don't have the same access denied issue.

Weird.
Oh, well I'll have to change the "Log on as" for the monitoring service to a Local administrator account.

Please post the fix here if you encounter this issue in the future and know the solution.

[chris.arceneaux]

Thanks, Elemer. Will do.

[Elemer.gazda]

Raised a low priority ticket for this with Veeam and I got through to Ilya Matveev, who just asking the right questions pointed me in the right direction.
In my case the solution was:
In Veeam - Main Menu - Users and Roles - Add "Administrators" with "Veeam Backup Administrator role"
and now it works.

[chris.arceneaux]

Great to hear! Thanks for sharing the solution!