BEM web url fails to load with IIS error "Access to the path 'C:\ProgramData\Veeam' is denied"

[joebranca]

I had a case open with Veeam previously and tried to resolve this issue popping up but the resolution was recovering the Veeam server to a prior date and restoring config database, so no definitive answer on root cause. I'm wondering if anyone else has seen this?

We were suspecting access level of account owning the Enterprise Management Windows Service, but whether it's Local System account or an AD account in local admin group, that didn't seem to make a difference. Not to mention, the issue seemed to come up out of the blue unrelated to any known changes to the Veeam server.

Here is the entire message on what should be the BEM login page (BEM and B&R server are on the same Windows 2012 R2 VM)

[EDIT] logs removed per forum rules

[joebranca]

Update:

With the new case we opened, it appears that Network Service needs to be added to Security settings for C:\ProgramData. This being done, it looks like the issue is resolved. However it is not clear on why something changed with regards to Security Settings for this path. We are checking with our Windows Admin team if anything in patching or AntiVirus operations would have made this change.

[stevenrodenburg1]

It's an old thread but if it helps: I ran into the exact same problem yesterday when I wanted to start the 9.5 Enterprise Management Web Console. Adding the local "Network Service" account to C:\Programdata\Veeam folder made it accessible again. Don't ask me what happened or why. I cannot imagine anyone messing around with permissions on that backup server. Regardless, the fix described above works well.

[Mgamerz]

I learned recently that whatever the first account that makes the folder or files in ProgramData becomes the only person who can normally access it. I write software and I don't let it run as admin - but some users choose to run it as admin anyway, so when files are populated in that folder, it makes them only accessible to one account. I have to grant permissions to others to access it. It's a poorly documented feature of that folder.