-
- Service Provider
- Posts: 195
- Liked: 38 times
- Joined: Oct 28, 2019 7:10 pm
- Full Name: Rob Miller
- Contact:
Can't backup DCs with Guest Interaction
We have been onboarding more clients with Veeam. I'm on my 3rd one this month with the exact same issue. All 3 have been the same. Domain Controllers can't pass the credential test in the job, and they can't run app consistent backups, crash consistent only.
Case # 06395099
Case # 06403909
We can browse the c$ or admin$ shares from the hosts as well as the VBR using our veeam service account. We've installed the VeeamInsallerSvc on the VMs. We've tried with firewalls disabled. We've uninstalled our security software SentinelOne. We know to keep it at or below version 23.1.5.886 for now due to safeboot protection issues on DCs, which this problem I'm facing seems identical to that problem, even without S1 at all. We've disabled Defender realtime protection. It doesn't matter what we do, none of our DCs, on 3 different networks can pass the cred test. I can even verify in the sec logs on the DCs during a cred test that the account is being successfully authenticated and granted the proper backup privileges. Nonetheless, the test fails.
Support seems to be struggling with finding a solution. Anyone have any other ideas?
Case # 06395099
Case # 06403909
We can browse the c$ or admin$ shares from the hosts as well as the VBR using our veeam service account. We've installed the VeeamInsallerSvc on the VMs. We've tried with firewalls disabled. We've uninstalled our security software SentinelOne. We know to keep it at or below version 23.1.5.886 for now due to safeboot protection issues on DCs, which this problem I'm facing seems identical to that problem, even without S1 at all. We've disabled Defender realtime protection. It doesn't matter what we do, none of our DCs, on 3 different networks can pass the cred test. I can even verify in the sec logs on the DCs during a cred test that the account is being successfully authenticated and granted the proper backup privileges. Nonetheless, the test fails.
Support seems to be struggling with finding a solution. Anyone have any other ideas?
-
- Veeam Legend
- Posts: 218
- Liked: 67 times
- Joined: Mar 22, 2017 11:10 am
- Full Name: Mark Boothman
- Location: Darlington, United Kingdom
- Contact:
Re: Can't backup DCs with Guest Interaction
It may not be relevant. Have you tried the remote UAC registry setting?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
Create a DWORD value called LocalAccountTokenFilterPolicy and assign it a value of 1.
The server will need a reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
Create a DWORD value called LocalAccountTokenFilterPolicy and assign it a value of 1.
The server will need a reboot.
-
- Service Provider
- Posts: 195
- Liked: 38 times
- Joined: Oct 28, 2019 7:10 pm
- Full Name: Rob Miller
- Contact:
Re: Can't backup DCs with Guest Interaction
Thanks Mark. Just gave it a try. Added it to a DC and rebooted. No change. Still fails cred test.
-
- Veeam Software
- Posts: 425
- Liked: 251 times
- Joined: Apr 11, 2023 1:18 pm
- Full Name: Tyler Jurgens
- Contact:
Re: Can't backup DCs with Guest Interaction
Is the account you are using a domain admin?
Tyler Jurgens
Blog: https://explosive.cloud
Twitter: @Tyler_Jurgens BlueSky: @explosive.cloud
Blog: https://explosive.cloud
Twitter: @Tyler_Jurgens BlueSky: @explosive.cloud
-
- Service Provider
- Posts: 195
- Liked: 38 times
- Joined: Oct 28, 2019 7:10 pm
- Full Name: Rob Miller
- Contact:
Re: Can't backup DCs with Guest Interaction
Yes the account is a dedicated veeam service account that is a domain admin. I'm not precisely sure what the difference is from existing deployments to new deployments, but all of our new deployments are having this issue. The logs from Veeam aren't very specific as to the issue. They just say it can't access the path, admin$ or whatever. Since we can access it from the host or the VBR using that account, that leaves us nothing to go on.
-
- Veeam Software
- Posts: 425
- Liked: 251 times
- Joined: Apr 11, 2023 1:18 pm
- Full Name: Tyler Jurgens
- Contact:
Re: Can't backup DCs with Guest Interaction
Have you tried entering the username as either: domain\username and username@domain.fqdn formats (trying one, then the other?)
Tyler Jurgens
Blog: https://explosive.cloud
Twitter: @Tyler_Jurgens BlueSky: @explosive.cloud
Blog: https://explosive.cloud
Twitter: @Tyler_Jurgens BlueSky: @explosive.cloud
-
- Service Provider
- Posts: 195
- Liked: 38 times
- Joined: Oct 28, 2019 7:10 pm
- Full Name: Rob Miller
- Contact:
Re: Can't backup DCs with Guest Interaction
Yes I have tried both formats for entering the creds. Both formats work on member servers, neither format works on DCs.
-
- Service Provider
- Posts: 16
- Liked: 2 times
- Joined: Feb 15, 2021 8:31 am
- Full Name: RH
- Contact:
Re: Can't backup DCs with Guest Interaction
Hi,
Did you try disable LUA via regedit? Keep in mind it needs reboot.
Do you have any firewall in between?
Did you successfully login manually on the DC with the domain account? - purpose is to create user folder.
Did you try disable LUA via regedit? Keep in mind it needs reboot.
Do you have any firewall in between?
Did you successfully login manually on the DC with the domain account? - purpose is to create user folder.
-
- Veeam Legend
- Posts: 21
- Liked: 6 times
- Joined: May 08, 2019 12:32 pm
- Full Name: Dipen N Kumar
- Contact:
Re: Can't backup DCs with Guest Interaction
Are you using Windows Defender ATP with ASR?
-
- Lurker
- Posts: 1
- Liked: never
- Joined: Feb 07, 2014 8:15 pm
- Full Name: Denys Argueta
- Contact:
Re: Can't backup DCs with Guest Interaction
You don't say whether those DCs are Win2022 or 2019s?
I learned the hard way this weekend that to Backup/Replicate Windows 2019 still need "TCP/IP NetBIOS Helper" service (NetBT). I would also check Firewall ports to allow RPC https://helpcenter.veeam.com/docs/backu ... kup-server
I learned the hard way this weekend that to Backup/Replicate Windows 2019 still need "TCP/IP NetBIOS Helper" service (NetBT). I would also check Firewall ports to allow RPC https://helpcenter.veeam.com/docs/backu ... kup-server
-
- Lurker
- Posts: 1
- Liked: never
- Joined: Nov 15, 2021 4:25 pm
- Full Name: drobbins
- Contact:
Re: Can't backup DCs with Guest Interaction
Do you have correct credentials in the credential manager in VBR? Any special characters in the password that it doesn't like?
-
- Lurker
- Posts: 2
- Liked: never
- Joined: Sep 19, 2021 5:24 pm
- Contact:
Re: Can't backup DCs with Guest Interaction
Is there an issue here with NTLM auth against the domain controllers? Is user in protected group? (As far as I know NTLM is still used here.)
Who is online
Users browsing this forum: Amazon [Bot] and 142 guests