AD Group Policy restore - access denied

[jround]

One of our engineers accidentally broke a group policy yesterday, not a problem Veeam can restore those!

Loaded up a DC backup, great we could see all the GP objects

However when restoring it fails with ACCESS DENIED to sysvol by the looks, even with trying main domain administrator credentials

Has anyone else restored a GP successfully through Veeam 10a? (AD servers 2012 R2 at a 2008 R2 functional level, Veeam console on a Server 2016 although I did also try through my Windows 10 PC)

I will of course raise a support ticket but I am sure we tested this and it worked fine in Veeam 9.5

Also the export feature in AD explorer exports a policy as a LDF file which we couldn’t work out how that could maybe used to import the policy back in, can Veeam not use similar technology to the GP MMC? (‘Back up all’ option to a folder then a simple browse to the folder with the saved backups to import back in again should there be a problem, sadly our engineer was not aware of that option before making the change!)

[jround]

Apologies...I meant to post this in the main Veeam forum rather than the vSphere sub forum

[veremin]

I think the debug log analysis is required here, so, having the support ticket opened is the fastest path to the resolution. Thanks!

[jmoock]

Sorry to bump this old thread, but I am encountering what appears to be a similar issue on 10.0.1.4854 and I was wondering if you ever arrived at a resolution? I have opened a support case, but I'd love to have a possible resolution to point them toward.

[Gostev]

Can't check on that as OP never posted the support case. I hope at least you will

[jmoock]

Support case 04696603.

Support asked me to try the built-in domain Administrator account, which worked (albeit with some warnings that appear harmless). I compared the group memberships of the built-in domain Administrator vs the Veeam Domain Admin and noticed that the built-in Administratror was a member of the domain level Administrators group along with Domain Admins.

Per https://helpcenter.veeam.com/archive/ba ... sions.html, we had only added the Veeam Domain Admin account to the domain level Administrators group. Adding it to Domain Admins allows it to restore GPOs (albeit with the same warnings).

[Gostev]

Great, thanks for sharing the solution!