This access control list is not in canonical form and therefore cannot be modified

[tkCPSadm]

Veeam support case - 04726248

After upgrading from version 9.5 release 4b, to Version 11.0.0.837 I received these warnings after jobs complete. It appears the backups are successful, yet I've not been able to find a similar enough reported warning message. Nor could I track down the cause. I'm not seeing any new errors on the server being backed up. (Windows 2016 via remote Veeam agent)

Warning: Collecting recovery media files Details: This access control list is not in canonical form and therefore cannot be modified

Any help is appreciated!

Cheers

[PetrM]

Hi Tim,

Thanks for providing a case ID! Most likely the error is provoked by specific ACL permissions at the OS level. Let's wait for findings of our support team.

Thanks!

[tkCPSadm]

Veeam support case - 04726248
So my case was archived. I've not found a lot of information on this KB (https://www.veeam.com/kb3026) which suggests making a registry edit to work around the issue. My worry is the error doesn't show which ACL is the issue. Nor do I want to randomly run ICACL verify on all directories to see if this is resolved. Has anyone come across ACL warnings before? I haven't had time to try to restore from a backup with the warning yet they do seem to process data. We do run Webroot AV, yet I have the endpoint directories added to an exclusion set as well. https://www.veeam.com/kb2034

Cheers,
Tim

[PetrM]

Hello,

We provide support on a "best effort" basis for customers using Community licensed products but you may try to open a support case once again. Every single attempt increases chances of getting support.

Thanks!

[tkCPSadm]

Case #04739186

I ran the jobs with AV turned off and still get the warning. I guess checking all directories is next. https://docs.microsoft.com/en-us/window ... nds/icacls

[tkCPSadm]

Case #04751729

I've not been able to location any information in the logs or forums as to which ACL is being accessed by Veeam to perform this backup. Is there a list of file sets used? I have not found any resolution via ICACLS verify commands. Though I have not run it on the whole of C:/Windows or C:/Programfiles.

Cheers,

[PetrM]

Hi Tim,

Let's wait for what our support engineers can figure out.

Thanks!

[tkCPSadm]

Case #04765287, all prior cases were closed without review. I know this is policy, but this seems excessive.

I can find no other related information on the process that Veeam runs to create the recovery media. I've not been able to locate the ACL the warning is referencing. Even locating related information on the given warning has been impossible to find, nor could I locate what the entry in the KB above controls. I will make an update after further testing.

Cheers,
Tim

[Mike.Powell]

https://www.veeam.com/kb3026

explicitly set the location for Agent to unpack and backup the winRE component to C:\temp as described in the KB and it will resolve the issue, any other internal drive would also work, but C:\temp is the one I normally recommend people.
Can't speak to the logic or why it fails, way above my paygrade, but that'll fix it.

[tkCPSadm]

#04778497
Thanks after a bit more research I found a way to restore should this break anything. I was just hesitate to make the entry as so little was available on the cause, and how the job creates the media along with what the registry edit from the KB actually does. I'll post an update after the outage window when I make our change.

Cheers
Tim-

[tkCPSadm]

I'm still not sure why it happened or if there is a better way, but this KB resolution did correct the issue. https://www.veeam.com/kb3026

Cheers
Tim