Failed to create persistent connection to ADMIN$

[rafael.reimer]

Hello,

We are deploying an environment based on Windows 2012 R2 STD in a workgroup ( not domain ). At the moment in wich i try to add any Managed Server i receive the message: "Failed to create persistent connection to ADMIN$".

Note: I am NOT using the local "Administrator" to do this, i create an account named "adm.veeam" on servers within the "Administrators" group. If i try to "\\server\c$" with my "adm.veeam" i can't login in the server share.

But, if i try to use the "LOCALHOSTSERVER\Administrator" i can connect in the Windows Explorer and install the Veeam agents.

In a search in the forum i see some references to make some registry entries and all are done. So, why i can't use the created account to connect in the servers and install Veeam ?

[nielsengelen]

It basically means that the account (adm.veeam) you are using does not have access to the ADMIN$ share on the machine you are trying to deploy the Proxy services to. As you have tried to connect to it and you get a failure.

Could you check if remote UAC is enabled? If this is you can disable it with the following reg key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

Create a DWORD value called LocalAccountTokenFilterPolicy and assign it a value of 1.

Then all you need is a reboot of the server and it should work fine.

[denit]

Hi Niels,

Is disabling UAC really the only way forward?
Reason i ask this is because i have installed more than one Veeamserver and infrastructure and i never disabled this.

However, today i have installed another veeamserver and i get this error when adding a proxy.
The proxy resolved by DNS perfectly, i have disabled the firewalls on veeamserver and proxy and i have tried several admin accounts.

This must be a simple thing to solve, but i am baffled at the moment.

[denit]

I managed to solve it, it was my own mistake probably.
I checked everything from scratch again, username (and specially how i type it) , servername, firewall.

I noticed the firewall is not the issue.
I think it was the way i typed the username. I was using local useraccounts and i have doubts on how to type that in the credentials screen. Because of this i created a domain\username and added it to the local administrators group on the proxies.

This seemed to do it. I had trouble with the local accounts by adding them like this ".\username".
I should, next time, immediately create domain service accoutns only.

[annhwebster]

Thank you, I had the same issue. ".\username" was the solution

[dirch]

Got the same error.
The solution was a registry fix mentioned in another forum thread from 2011.

My setup was 2 Windows 2012R2 servers in a domain.
If i tried to add the proxy using these accounts it worked:
- domain account, like domain\useraccount
- with the proxy local administrator, like proxyserver\administrator or IP\administrator (10.10.0.44\administrator)

If i tried the exact same thing with a local administrative user from the proxy server it did not work:
- proxyserver\veeamuser or IP\veeamuser or .\veeamuser

Tried creating another local admin account but got the same error.
Tried the veeam checklist: FW, UAC, File and printer sharing, VSS remote registry etc and access to admin$ worked fine.

The only that made it work was a old Veeam-forum write from 2011 which described a registry fix that is describe my MS as "This value enables the remote administration of the print drivers on a server within a workgroup.":
https://forums.veeam.com/veeam-backup-r ... t9612.html
https://support.microsoft.com/en-us/hel ... -on-a-wind
_________________________________________________
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"LocalAccountTokenFilterPolicy"=dword:00000001
_________________________________________________

Thank you stevenrodenburg1.

BR lars
I

[MCH_helferlein]

Thanks for that Lars
Thougt I'm going crazy....

That registry entry did the trick even without reboot!

[colohost]

Just wanted to add some input to this old thread; doing a fresh install on Windows 2016 servers and receive the same error when trying to connect the master to the first proxy. I didn't have to do any of the registry tricks, etc., but I did have to use the "Server Manager" and enable the file server role, along with using the username format PROXYSERVERNAME\username for the remote connection from the Veeam installer on the master. Even though the appropriate firewall rules were enabled on the proxy manually, I could not get around the ADMIN$ error until doing that role addition in server manager.

[sam.woz]

Adding the LocalAccountTokenFilterPolicy to the registry was the only fix for me as well. Server 2016 using a local non-domain/non-Administrator account. We use non-domain accounts for extra segregation for backup data, so glad to find the solution! Thanks!

[ortoscale]

Reghack did the job. Important, close wizard and start it again. Otherwise you can close yourself into non-working loop forever. Just like I did .

[Harald]

Thanks all, I'm currently setting up Veeam 10 with two physical proxies based on Win 2019 - and guess what, I had to set the RegKey to get it working with an account other than local administrator on the proxies. So, this issue is still present, and maybe it's worth to add it to the installation documents.

[JamesMcG]

Same here for v10 on 2019. Veeam should have the installer add this DWORD during setup.

[Gostev]

Then we will make the news as a trojan horse, because this setting disables UAC which is really bad for security.

[dwageman]

Ok Gostev, but then what is the recommended fix?

[Gostev]

Using local "Administrator" account (this one will work through UAC). See the thread above for details. Thanks!

[wross]

What if the "Administrator" account name is changed? I assume it will continue to work through UAC?

[foggy]

Correct, as it will continue to use the same SID.

[Zew]

A little late to the party, I took the information here and else were and did a "Things to check" guide for each error you might come across in the "add Windows Managed Server Wizard".

If you hit this error then most of the network layers are not the problem and like mentioned it's just the UAC problem.

If you are interested here is the link to my blog and the specific post on this issue.https://zewwy.ca/index.php/2020/09/08/v ... ed-server/ (100% Free, No Ads). Cheers stay safe everyone!

[spencer_rrs]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"LocalAccountTokenFilterPolicy"=dword:00000001

This fixed my issue on a stand alone Windows Std 2019 Hyper-V host. Username was put in as "SERVER\Username" and no reboot needed. Thanks!

[dlapointe]

It basically means that the account (adm.veeam) you are using does not have access to the ADMIN$ share on the machine you are trying to deploy the Proxy services to. As you have tried to connect to it and you get a failure.

Could you check if remote UAC is enabled? If this is you can disable it with the following reg key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.

Create a DWORD value called LocalAccountTokenFilterPolicy and assign it a value of 1.

Then all you need is a reboot of the server and it should work fine.

I had the same issue which this registry key fixed for me in the past. I don't know why today it did not work on a new Workgroup server I wanted to add to Veeam Backup & Replication. But I also needed to change the policy on my workgroup server to make it work (as well as adding the registry key):
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Server SPN target name validation level to Off

Note: I am using CIS Hardening GPOs which might be the root cause of my issues thought.