Comprehensive data protection for all workloads
Post Reply
RobMiller86
Service Provider
Posts: 195
Liked: 38 times
Joined: Oct 28, 2019 7:10 pm
Full Name: Rob Miller
Contact:

Can't backup DCs with Guest Interaction

Post by RobMiller86 »

We have been onboarding more clients with Veeam. I'm on my 3rd one this month with the exact same issue. All 3 have been the same. Domain Controllers can't pass the credential test in the job, and they can't run app consistent backups, crash consistent only.

Case # 06395099
Case # 06403909

We can browse the c$ or admin$ shares from the hosts as well as the VBR using our veeam service account. We've installed the VeeamInsallerSvc on the VMs. We've tried with firewalls disabled. We've uninstalled our security software SentinelOne. We know to keep it at or below version 23.1.5.886 for now due to safeboot protection issues on DCs, which this problem I'm facing seems identical to that problem, even without S1 at all. We've disabled Defender realtime protection. It doesn't matter what we do, none of our DCs, on 3 different networks can pass the cred test. I can even verify in the sec logs on the DCs during a cred test that the account is being successfully authenticated and granted the proper backup privileges. Nonetheless, the test fails.

Support seems to be struggling with finding a solution. Anyone have any other ideas?
MarkBoothmaa
Veeam Legend
Posts: 218
Liked: 67 times
Joined: Mar 22, 2017 11:10 am
Full Name: Mark Boothman
Location: Darlington, United Kingdom
Contact:

Re: Can't backup DCs with Guest Interaction

Post by MarkBoothmaa »

It may not be relevant. Have you tried the remote UAC registry setting?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
Create a DWORD value called LocalAccountTokenFilterPolicy and assign it a value of 1.

The server will need a reboot.
RobMiller86
Service Provider
Posts: 195
Liked: 38 times
Joined: Oct 28, 2019 7:10 pm
Full Name: Rob Miller
Contact:

Re: Can't backup DCs with Guest Interaction

Post by RobMiller86 »

Thanks Mark. Just gave it a try. Added it to a DC and rebooted. No change. Still fails cred test.
tyler.jurgens
Veeam Software
Posts: 425
Liked: 251 times
Joined: Apr 11, 2023 1:18 pm
Full Name: Tyler Jurgens
Contact:

Re: Can't backup DCs with Guest Interaction

Post by tyler.jurgens »

Is the account you are using a domain admin?
Tyler Jurgens
Blog: https://explosive.cloud
Twitter: @Tyler_Jurgens BlueSky: @explosive.cloud
RobMiller86
Service Provider
Posts: 195
Liked: 38 times
Joined: Oct 28, 2019 7:10 pm
Full Name: Rob Miller
Contact:

Re: Can't backup DCs with Guest Interaction

Post by RobMiller86 »

Yes the account is a dedicated veeam service account that is a domain admin. I'm not precisely sure what the difference is from existing deployments to new deployments, but all of our new deployments are having this issue. The logs from Veeam aren't very specific as to the issue. They just say it can't access the path, admin$ or whatever. Since we can access it from the host or the VBR using that account, that leaves us nothing to go on.
tyler.jurgens
Veeam Software
Posts: 425
Liked: 251 times
Joined: Apr 11, 2023 1:18 pm
Full Name: Tyler Jurgens
Contact:

Re: Can't backup DCs with Guest Interaction

Post by tyler.jurgens »

Have you tried entering the username as either: domain\username and username@domain.fqdn formats (trying one, then the other?)
Tyler Jurgens
Blog: https://explosive.cloud
Twitter: @Tyler_Jurgens BlueSky: @explosive.cloud
RobMiller86
Service Provider
Posts: 195
Liked: 38 times
Joined: Oct 28, 2019 7:10 pm
Full Name: Rob Miller
Contact:

Re: Can't backup DCs with Guest Interaction

Post by RobMiller86 »

Yes I have tried both formats for entering the creds. Both formats work on member servers, neither format works on DCs.
RaHa
Service Provider
Posts: 16
Liked: 2 times
Joined: Feb 15, 2021 8:31 am
Full Name: RH
Contact:

Re: Can't backup DCs with Guest Interaction

Post by RaHa »

Hi,

Did you try disable LUA via regedit? Keep in mind it needs reboot.

Do you have any firewall in between?

Did you successfully login manually on the DC with the domain account? - purpose is to create user folder.
dips
Veeam Legend
Posts: 21
Liked: 6 times
Joined: May 08, 2019 12:32 pm
Full Name: Dipen N Kumar
Contact:

Re: Can't backup DCs with Guest Interaction

Post by dips »

Are you using Windows Defender ATP with ASR?
dargueta
Lurker
Posts: 1
Liked: never
Joined: Feb 07, 2014 8:15 pm
Full Name: Denys Argueta
Contact:

Re: Can't backup DCs with Guest Interaction

Post by dargueta »

You don't say whether those DCs are Win2022 or 2019s?
I learned the hard way this weekend that to Backup/Replicate Windows 2019 still need "TCP/IP NetBIOS Helper" service (NetBT). I would also check Firewall ports to allow RPC https://helpcenter.veeam.com/docs/backu ... kup-server
drobbins
Lurker
Posts: 1
Liked: never
Joined: Nov 15, 2021 4:25 pm
Full Name: drobbins
Contact:

Re: Can't backup DCs with Guest Interaction

Post by drobbins »

Do you have correct credentials in the credential manager in VBR? Any special characters in the password that it doesn't like?
randytho
Lurker
Posts: 2
Liked: never
Joined: Sep 19, 2021 5:24 pm
Contact:

Re: Can't backup DCs with Guest Interaction

Post by randytho »

Is there an issue here with NTLM auth against the domain controllers? Is user in protected group? (As far as I know NTLM is still used here.)
Post Reply

Who is online

Users browsing this forum: Amazon [Bot] and 142 guests