Backup failing due to UAC?

Availability for the Always-On Enterprise

Backup failing due to UAC?

Veeam Logoby Rik » Thu Aug 02, 2012 10:52 pm

Hi,

I'm using Veeam B&R 6.1 to backup our vSphere VM's, but all backups are failing with the error:
Code: Select all
Failed to prepare guest for hot backup. Error: Failed to connect to guest agent. Errors: 'Cannot connect to the host's administrative share. Host: [xx.xx.xx.xx]. Account: [xxx\xxx]. Win32 error:The network path was not found. Code: 53

I noticed this line in the release notes:

Network-less interaction with Microsoft Windows guests having UAC enabled (Vista or later) requires that Local Administrator (MACHINE\Administrator) or Domain Administrator (DOMAIN\Administrator) account is provided on Guest Processing step.

Our backup servers only have a connection to vSphere and storage. They can't access the guest networks. Also, due to security reasons, the 'default' DOMAIN\Administrator account is disabled so I entered another domain administrator account. Is there any way to enable Application-aware backups without disabling UAC or altering the reg key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\LocalAccountTokenFilterPolicy?

Thanks.

Rik Bruins
Rik
Service Provider
 
Posts: 7
Liked: never
Joined: Thu Aug 02, 2012 10:19 pm
Full Name: Rik Bruins

Re: Backup failing due to UAC?

Veeam Logoby Gostev » Thu Aug 02, 2012 11:38 pm

Hi Rik, no it's not possible. You need to either use administrator account (domain, or local machine), or disable UAC. Can you use local Administrator account on those VMs? Also, note that backup server does not need to be able to access guess networks. Thanks!
Gostev
Veeam Software
 
Posts: 21390
Liked: 2349 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Backup failing due to UAC?

Veeam Logoby Rik » Thu Aug 02, 2012 11:44 pm

Hi Gostev,

What's so special about the dedault Administrator account? Why can't I use a self created local/domain administrator account with a different name than 'Administrator?

Regards,
Rik
Rik
Service Provider
 
Posts: 7
Liked: never
Joined: Thu Aug 02, 2012 10:19 pm
Full Name: Rik Bruins

Re: Backup failing due to UAC?

Veeam Logoby Gostev » Fri Aug 03, 2012 12:03 am

Because of how Microsoft designed UAC. And I don't really understand the reasoning behind this design decision either, although I am sure there is one probably...
Gostev
Veeam Software
 
Posts: 21390
Liked: 2349 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Backup failing due to UAC?

Veeam Logoby tsightler » Fri Aug 03, 2012 12:33 am 1 person likes this post

Rik wrote:What's so special about the dedault Administrator account? Why can't I use a self created local/domain administrator account with a different name than 'Administrator?


Because the "built-in" administrator accounts use well-known security descriptors that are completely exempted from UAC by the default security policy. If you open the Local Security Policy editor, and navigate to Local Policies...Security Options, you will find a policy as follows:

User Access Control: Admin Approval Mode for the Built-in Administrator account: Disabled

Basically this means that the built-in accounts technically have UAC enabled, but are automatically approved for escalation rather than prompted. If you set this policy to enabled, then the built-in accounts are not treated any differently than other admins and they ALL require approval for escalation.

You can read more about well know security principals in Windows here. For anyone super interested, I strongly recommend watching Raiders of the Elevated Token.
tsightler
Veeam Software
 
Posts: 4768
Liked: 1737 times
Joined: Fri Jun 05, 2009 12:57 pm
Full Name: Tom Sightler

Re: Backup failing due to UAC?

Veeam Logoby Rik » Mon Aug 06, 2012 9:31 am

I disabled UAC and also added the reg key, but application aware backups are still not working:
Code: Select all
6-8-2012 11:29:01 :: Failed to prepare guest for hot backup. Error: Failed to connect to guest agent. Errors:
'Cannot connect to the host's administrative share. Host:  [xx.xx.xx.xx]. Account: [xxx\xxx].
Win32 error:The network path was not found.
 Code: 53
Cannot connect to the host's administrative share. Host:  [x::x:x:x:x]. Account: [xxx\xxx].
Win32 error:The network path was not found.
 Code: 53
Cannot connect to the host's administrative share. Host:  [x::x:x:x:x]

There is no network connection between vmware/veeam and the guest networks. Any ideas?
Rik
Service Provider
 
Posts: 7
Liked: never
Joined: Thu Aug 02, 2012 10:19 pm
Full Name: Rik Bruins

Re: Backup failing due to UAC?

Veeam Logoby foggy » Mon Aug 06, 2012 9:54 am

Rik, I would suggest to open a case for further investigation as the problem seems to lie a bit deeper.
foggy
Veeam Software
 
Posts: 14728
Liked: 1078 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Re: Backup failing due to UAC?

Veeam Logoby Gostev » Mon Aug 06, 2012 9:56 am

Something is still missing, and preventing network-less operation from functioning. Please include support case ID for this issue on this topic.
Gostev
Veeam Software
 
Posts: 21390
Liked: 2349 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Backup failing due to UAC?

Veeam Logoby Rik » Mon Aug 06, 2012 10:57 am

It seems that UAC can't be disabled. It is enforced within the group policies. But I also added the regkey. Is this not enough, or is this only working when there is a network connection between vmware/veeam and the guest VM?
Rik
Service Provider
 
Posts: 7
Liked: never
Joined: Thu Aug 02, 2012 10:19 pm
Full Name: Rik Bruins

Re: Backup failing due to UAC?

Veeam Logoby Rik » Mon Aug 06, 2012 11:17 am

In another post I read something about manually installing a Veeam Proxy Agent. Could this work? If so, how do I install this thing?
Rik
Service Provider
 
Posts: 7
Liked: never
Joined: Thu Aug 02, 2012 10:19 pm
Full Name: Rik Bruins

Re: Backup failing due to UAC?

Veeam Logoby Gostev » Mon Aug 06, 2012 3:20 pm

Actually, there is no "thing" you can install in this case... we do not use persistent agents inside guest, so there is no installation package available.

If you change a Group Policy controlled registry setting, it will be over-written by the policy... I believe, registry keys like the above one work if there are no group policy in play that involves it. Otherwise, group policy would be to easy to hack around.
Gostev
Veeam Software
 
Posts: 21390
Liked: 2349 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Backup failing due to UAC?

Veeam Logoby Rik » Mon Aug 06, 2012 3:32 pm

Yes, I know that I can change the GPO, but this is not allowed in the security policy. That's why UAC is enforced through a GPO.
So, there is no way we can make an application aware (VSS) backup with Veeam when UAC is enabled? That's a huge disappointment!
Rik
Service Provider
 
Posts: 7
Liked: never
Joined: Thu Aug 02, 2012 10:19 pm
Full Name: Rik Bruins

Re: Backup failing due to UAC?

Veeam Logoby Gostev » Mon Aug 06, 2012 3:39 pm

Of course you can make an application aware (VSS) backup with Veeam when UAC is enabled, you just need to provide the account that meets the above-mentioned requirements.
Gostev
Veeam Software
 
Posts: 21390
Liked: 2349 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Backup failing due to UAC?

Veeam Logoby Rik » Mon Aug 06, 2012 4:02 pm

Yes, by using the builtin\administrator or domain\administrator account.
I feel that if you're taking security seriously, disabling these account is one of the first things everyone should be doing when deploying a new environment.

Our security policy is very strict. It's a shame we can't use Veeam as an enterprise backup solution. If there would be a solution for this, Veeam would be perfect!
Rik
Service Provider
 
Posts: 7
Liked: never
Joined: Thu Aug 02, 2012 10:19 pm
Full Name: Rik Bruins

Re: Backup failing due to UAC?

Veeam Logoby Gostev » Mon Aug 06, 2012 4:06 pm

No other solution for this at this time, unfortunately. The only two are disabling UAC, or using account that can bypass it.
Gostev
Veeam Software
 
Posts: 21390
Liked: 2349 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Next

Return to Veeam Backup & Replication



Who is online

Users browsing this forum: bstreza, iColin and 32 guests