Enterprise manager loses connection to VBR after upgrade to 12

[jasonede]

After upgrading to version 12 it seems our Enterprise manager has lost connection to the VBR servers. Looking in backup servers in EM it still sees the VBR server as version 11 and all communication to it is now showing as access denied.
I've checked firewall settings and nothing being blocked. Also it was working fine till the upgrade. Originally I thought it was an issue between vcenter and EM, but that looks fine and it's EM to VBR that seems to be not working.

I'm not sure what is generating the access denied in this case.

I can see this in the BES collect log.

#Edited by MOD: Logs removed. Please don't post logs to the forum. It's against our forum rules.

Anyone else seen this or things I can try?

Case : #05921991

[Mildur]

Hello Jason

Can you please check again your case number? #02 is a contract number.
Is it Case 05921991?

Best,
Fabian

[jasonede]

Oops, sorry, copy/paste error. Fixed.

[johan.s@it-total.se]

Hello.

Any solution on this problem?
opened a case today, but no answer yet.
Case # 05947727

[jasonede]

In our case it was linked to the users/roles in the VBR console. The users need to be explicitly added rather than just by adding a group. For one server I needed to switch it to using a different account and it then went through fine. After adding it moves to certificate authentication anyway.

I believe it's an issue that will be fixed in a later release.

[PetrM]

Hello,

The best way is to ask your support engineer to check whether case 05921991 (which was solved by adding a corresponding user to "Users and Roles") is similar to yours. The described behavior is quite generic and we cannot conclude that you have an identical issue just based on the forum posts.

Thanks!

[mdglazerman]

We have the same issue in our enterprise manager environment since updating to v12. We have 3 VBR instances reporting into this Enterprise manager instance. Enterprise manager and 2 of the 3 VBR instances were upgraded to v12 and since then, data collection activities have failed for everything on v12. We've had Case # 05938800 open with support since 03/13 and so far all we've heard is that R&D are looking into it. This is a huge problem for us as we provide access to Enterprise manager for our partner teams to service self service restores. Currently this functionality is unavailable to these teams which is generating a considerable amount of additional work for our team.

While it is problematic for everyone who's posted here, I am somewhat comforted that this isn't an issue specific to our environment.

Veeam... please resolve this ASAP.

Thanks,

Mark

[PetrM]

Hi Mark,

As far as I see our RnD actively researches the issue, it's difficult to comment on ETA as it strictly depends on the technical complexity of the problem. Anyway, I notified our support leaders that you need a resolution soon and asked them to accelerate the research if it's possible.

Thanks!

[jasonede]

Check you've got the vsphere role assigned in enterprise manager as I think that's a new one that is needed with V12. https://helpcenter.veeam.com/docs/backu ... ml?ver=120

[zmcneely]

Check the release notes for upgrading Veeam Backup & Replication

Are you using Veeam Backup Enterprise Manager? If yes, consider the following:

• Important! Starting with Veeam Backup Enterprise Manager 12, a new port (port 9405) is used for certificate communication between Enterprise Manager and Veeam Backup & Replication. Ensure that your firewalls are configured to take into account this new port to avoid communication issues between Enterprise Manager and Veeam Backup & Replication.

https://www.veeam.com/veeam_backup_12_r ... tes_rn.pdf

[Seve CH]

Same problem here:
Enterprise Manager updated from 11a to v12 Wednesday. Everything worked fine.
Veeam server updated from 11a to v12 yesterday -> connection lost.
No problem at the firewall, etc. Even we temporarily disabled all firewall rules just in case, like jasonede.

EM thought the server was still v11 and the new certificate port was not displayed, so just in case, we removed it from the configuration, tried to add it back, but always the same error:
"Failed to open session" (Enterprise Manager web)
"<201> Warning User [veeamserver\serviceaccount] access is not allowed: Access denied." on Svc.VeeamBackup.log

The solution was to add the "Veeam Backup Administrator" role to the account directly instead of indirectly via BUILTIN\Administrators.

In Svc.VeeamBackup.log it now says "<275> Error Failed to get linked token [..] (Veeam.Backup.Common.CSecurityHelper.IsUserElevated(WindowsIdentity userIdentity)", but also under it there is "Access is granted. User has permissions" and it works.

The Veeam Backup Server is not member of a domain. Enterprise manager uses servername\serviceaccount to log in. The service account is member of the "administrators" group local to the server. I suspect Veeam is looking for an SSID which is not allowed or was stripped like by UAC (removes the local admin SID -500).

[staun]

I just upgraded our branch office VBR server and ran into the same problem.. After pulling my hair, checking Global and local windows firewall, Antivirus and what ever came to mind. I re-enabled the local administrator on the remote VBR, used this user instead and then I had succes connecting..
Double checked password for my veeam-user, everything was good. But I cannot use any other accounts that local administrator.. really strange