Endpoint Backup. Backup of the Domain Controller

[sebastian.schaefer]

We're testing Veeam Endpoint Protection on an old physically DC (2008 R2).

After configuring the Job to SMB Share it starts and after 2 mins we got the following error:

17.12.2014 15:23:41 :: Creating VSS snapshot Error: Failed to create snapshot: Backup job failed. Cannot create a shadow copy of the volumes containing writer's data. Cannot prepare the [NTDS] data to a subsequent restore operation. Cannot process NTDS data. Cannot create a backup copy of the BCD.

Another Server runs fine after installing, also 2008R2 physically.

Any Idea?

[Dima P.]

Hello,
We have an old article with the same error: VSS Failed Windows 2008 R2, please check if the provided solution applies to your case? Thank you.

[sebastian.schaefer]

Opened a ticket and the following tip worked for the customer:

Can you please manually create the following folder and re-run the job?
C:\ProgramData\Veeam\Backup\


Thanks

[Vitaliy S.]

I'm not sure why folder creation helps in this case, but thanks for the update, I will discuss it with our dev team.

[Dima P.]

Sebastian,
It’s a known issue, thank you for sharing this temporary workaround. Will be fixed in the GA version.

[ian0x0r]

Nice one. I can confirm that this fix worked for Server 2012 R2 DC as well. Have been pulling my hair out trying to figure out what was wrong

[Mike Resseler]

Ian,

Thx for letting us know! We appreciate it a lot. Another question... Can you let us know what type of restores you are going to test and how they went? I would be very happy to see how exactly you are going to restore and what scenario's you have in mind.

Thanks!

Mike

[ian0x0r]

Hi Mike,

To be honest this DC is in my home lab, so was going to use it for file level restores rather than any kind of bare metal restores / domain recovery. (unless of course my server blows up then it will be very useful )

I would however be interested to know if I can import the VBK backup files into Veeam B&R 8. I could test a full recovery back to a VM either using B&R 8 or using the bootable bare metal recovery ISO in a new VM in a VMware environment.

Thanks,

Ian

[Mike Resseler]

Ian,

For that you will have to wait until GA. Then B&R will become a valid target.

Cheers

Mike

[theJonson]

Just to add that this also worked for me on Server 2012 - thanks.

[e.santing]

Hello,

Made this folder:
C:\ProgramData\Veeam\Backup\
But Veeam Endpoint does still not backup :
5-1-2015 18:53:03 :: Creating VSS snapshot Error: Failed to create snapshot: Backup job failed. Cannot create a shadow copy of the volumes containing writer's data. VSS asynchronous operation is not completed. Operation: [Shadow copies commit]. Code: [0x80042306].

5-1-2015 18:53:16 :: Error: Failed to create snapshot: Backup job failed. Cannot create a shadow copy of the volumes containing writer's data. VSS asynchronous operation is not completed. Operation: [Shadow copies commit]. Code: [0x80042306].

5-1-2015 18:53:16 :: Processing finished with errors at 5-1-2015 18:53:16

WHen I do a vssadmin list writers I see a lot of errors for example:
Writer name NTDS
Last error: Non-retryable error.

Shadow Copy Optimization Writer
Last error: Timed out

FRS Writer
Last error: Timed out
BackupExec agent is installed. Can that be the cause of the problem?

[Mike Resseler]

Hello Edwin,

1. Yes, BackupExec agent can be the case. Both can conflict if different VSS sequesters are trying to use VSS and certainly if one of them has a locked snapshot or leftover snapshot somewhere... Never a good situation to be in.
2. What OS is this? Is the 2008 R2? Did it get the latest patches and VSS hotfixes? it needs to be up-to-date. VSS is pretty sensitive to that
3. You will need to reboot first now. Because you see the Non-retryable error on NTDS, the only way to put the writer back into a good state is by rebooting your server.

The most logical thing to do (imho) is reboot, make sure it is fully patched, reboot after the patches and try again. But I fear that the problem will be with the BackupExec Agent. So if you have the possibility to uninstall that one... After all, you don't put 2 AV solutions at the same box either

Let us know

Mike

[Gostev]

Most likely, the issue is caused by BackupExec VSS Provider's presence.

[e.santing]

Ok,
Windows server 2008R2sp1 with latest Windows updates
Removed SymantecBackup
Rebooted the server mulitple times, but still the same
Did "vssadmin list writers" before I run VEB. No errors.
When i do "vssadmin list writers" after VEB went wrong, again a lot of errors.

Collected log files from VEB
End of Svc.VeeamEndpointBackup.log is everytime:
05.01.2015 16:59:13] <52> Info Connecting to RPC port '6183', host '127.0.0.1', service 'VeeamDeploymentSvc', secure channel: 'false' .
[05.01.2015 16:59:13] <08> Info [SQLSERVER] Checking whether remote Installer service is available.
[05.01.2015 16:59:13] <52> Info Getting version of the deployment service.
[05.01.2015 16:59:13] <52> Info Service version: [6]
[05.01.2015 16:59:13] <08> Info [SQLSERVER] Connection to Installer service is established. Endpoint: '127.0.0.1:6183'
[05.01.2015 16:59:13] <08> Info [SQLSERVER] Trying to connect to proxy service. Account: '<current user>'. IP addresses: '127.0.0.1'. Port: '6183'. Backup console version: '8.0.0.1822'.
[05.01.2015 16:59:13] <52> Info Connecting to RPC port '6183', host '127.0.0.1', service 'VeeamRpcInvoker', secure channel: 'false' .
[05.01.2015 16:59:13] <08> Info [SQLSERVER] Connection to the proxy service is established. Endpoint: '127.0.0.1:6183'
[05.01.2015 16:59:13] <08> Info [SQLSERVER] Creating File Commander.
[05.01.2015 16:59:13] <08> Info Physical host volume was not found for path '\\192.168.11.226\public' on host 'This server'.
[05.01.2015 16:59:13] <08> Info [SQLSERVER] [FC] Getting disk free space: path: '\\192.168.11.226\public'

Dont get confused by the servername. Server is both Domain Controller and SQL server
\\192.168.11.226\public is nas where i want to backup to.

[Gostev]

The log snippet looks good. What errors do you get now?

It's quite possible that VSS framework is FUBAR by Symantec.
Do you get this issue on any other server or desktop?

[e.santing]

I get the same errors as before.

This is the second computer I tried. The first Computer (desktop Windows 8.1) went fine.

[e.santing]

Hi,
Same errors unfortunately.

This is only the second computer I tried to backup with VEB.
Windows 8.1 desktop went fine.

[Mike Resseler]

Hi Edwin,

Can you use the email support and file a case? I don't think we will solve it through the forums. There must be something strange happening. I do remember from years back that a SQL writer and a DC writer can cause issues together but I can't remember the details anymore

Mike

[Simon-Sez]

same here!
Windows Server 2012 R2.
create C:\ProgramData\Veeam\Backup\ and backup work.

file level restores worked fine
but any kind of bare metal restores was not running.
I tried the backup on a server with the same hardware.
Active Directory doesnt work after the restore.
services (AD, DNS ect.) dont run.
Does anyone have an idea?

[Simon-Sez]

Ok i found a Solution:

http://www.veeam.com/kb1277

Endpoint start DC in Safe Mode too

[Dima P.]

Simon-Sez,
Thanks for sharing this KB with the community and great that the provided solution works for Endpoint restores.

[Mike Resseler]

Just to give some additional information here...

I won't go too deep in it, but because of the way AD works, with USN's, the behavior of starting in Safe Mode is expected. In fact, this is the safest. Because if you would bring a DC back online that comes from an older timestamp, bad things could happen to your AD environment. That's why the people at MSFT have built this in. So following above mentioned KB is the way to go. The good thing is that you will be able to select whether you are going to do an authoritative restore or non-authoritative restore. (the KB gives you the non-authoritative...) so in case you need to "go back" with your domain to the previous situation (or you need to recover one specific object because you are not using the recycle bin ) you can do that also.

Cheers

Mike

[linde]

Hi everybody,
have anyone experience to backup a physical Windows2008R2 Domain controller ?
Is there a issue ?

Best regards

[Dima P.]

Hello Peter,
Some users report positive experience, please review this thread.

[Simon-Sez]

@Mike
thx for the information I'm not so deep in the topic.

@Peter
so far everything is running

[SGalbincea]

As a quick follow up to this, I have found in several instances that disabling the SQL VSS service has resolved the VSS issues on both DCs and workstations where SQL protection was either N/A or not a priority. This is with the latest version 1.1.2.119.

[Dima P.]

Hello Steve,

Have you checked with the support team? I believe Endpoint should use the native applications VSS writer if there is any without any issues.