Server 2008R2 & SBS2011 VSS backup without network connectio

[ken.wilson]

Hello,

I am having an issue trying to get application aware backups (VSS) of 2008R2 and SBS2011 (2008R2) machines. I have found out what's causing the issue but I can't seem to find a correct fix for it.

The error I get is this:

Starting guest agent
Cannot upload guest agent's files to the administrative share [C:\Windows].
Cannot create folder [C:\Windows\VeeamVssSupport] in guest.
VIX Error: You do not have access rights to this file Code: 13

Now before you tell me it's an issue with the user account I am running if I disable the Server 2008R2 firewall and turn off UAC then the backup works fine with the user account I have used but once I turn it all back on it stops working again. I have been looking around and found some fixes http://www.it-book.co.uk/2012/veeam-bac ... s-firewall and this does not seem to be my issue and the "fix" didn't work for me.

Also I have tried creating a user account that's just the member of the built-in administrators group (I can't have local admin since they are all DC's or SBS's servers) and they still don't work for me.

Can someone point me into the right direction to get this fixed so I can leave the firewall and UAC enabled and still get VSS backups.

Thanks in advance,

Ken

[Gostev]

Hi Ken, this issue is documented under Known Issues in the Release Notes document included with your download. Thanks.

[Platform1]

We're having this issue also on a 2008 R2 server, though the server backed up successfully previously many times.

Starting guest agent
Cannot upload guest agent's files to the administrative share [C:\Windows].
Cannot create folder [C:\Windows\VeeamVssSupport] in guest.
VIX Error: You do not have access rights to this file Code: 13

I can't find this listed in the known issues list as mentioned, can you paste the specific part you refer to please?

What do Veeam recommend to use as a workaround as turning off UAC and firewall is not an option.

[Gostev]

I can't find it listed in the known issues list.

This is the only issue listed under the Application-aware image processing section of the Known Issues list.

[Platform1]

Application-aware image processing
• Connection-less operation with Microsoft Windows versions having UAC enabled
(Vista or later) requires that Local Administrator (MACHINE\Administrator) or Domain

Thank you Gostev but the domain service account does have local administrative privileges. I also tried a separate MACHINE\admin account with the same result. Once UAC is turned off the error goes away.

[Gostev]

Thank you Gostev but the domain service account does have local administrative privileges.

As per issue description, you need to specify "DOMAIN\Administrator" account, not just "domain account with local administrative privileges".

[Platform1]

It is setup up with a DOMAIN\administrator account and has been since the job was set up weeks ago. It started failing a few days ago with the access rights error a few days ago. UAC appears to be the central reason why.

[Gostev]

Looks like some environmental change then... some security related changes lately?
DOMAIN\Administrator definitely works with the default settings.

[mbiesheuvel]

Yesterday I had the same problem on my environment.

The veeam job was running successful for a couple of weeks. Suddenly the job is failing on 80% of the vm's. All vm's are 2008 R2 sp1 and 1 vm is sbs 2011. This happends everyday on the same vm's. VSS errors are seen in the eventlog of the guest and the same errors in veeam 6 patch 3.

2 weeks ago i made a ticket with veeam (5181451). The engineer reviewed the logs and came to the conclusion it had something to do with security policy (his answer: It might be caused by security policy. So the account has to be local administrator, as explained on the corresponding wizard page.)

I checked the user (domain admin on domain and local admin on all machines, no security policy active) and deleted the account in the register (there was a temp user created, i dunno know why). I did this on all servers and the job started to run again. I closed the ticket with Veeam because i solved it myself.

Last night I saw that the backup was failing again and i researched the problem and came to this topic by accident. I checked the UAC and it was at the 3rd level (default; notify only when programs try to make changed to the computer). I disabled UAC on all servers and retried the backup. The backup runs successfully.

The strange part is that not all servers with UAC were affected and the symptoms only started after a couple of days.

Why is this? Does UAC need to be turned off for Veeam to work? Why does it only happends to certain vm's after a couple of days? Is this a bug in Veeam? Is it a bug in Windows?

[mbiesheuvel]

By the way: the errors in veeam were somewhat different then the first topic:

Code: Select all

11/04/2012 23:25:15 :: Failed to prepare guest for hot backup. Error: Cannot start service. Machine: [172.17.168.17]. Service: [VeeamVssSupport].
Cannot start service.
Win32 error:The service did not respond to the start or control request in a timely fashion.
 Code: 1053

In the event log of the windows servers is the following:

Code: Select all

The VeeamVssSupport service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

A timeout was reached (30000 milliseconds) while waiting for the VeeamVssSupport service to connect.

Code: Select all

Faulting application name: VeeamGuestAgent.exe, version: 6.0.0.153, time stamp: 0x4ed3c999
Faulting module name: VeeamGuestAgent.exe, version: 6.0.0.153, time stamp: 0x4ed3c999
Exception code: 0xc0000005
Fault offset: 0x0000000000055eaa
Faulting process id: 0x1ffc
Faulting application start time: 0x01cd18258c0095dc
Faulting application path: C:\Windows\VeeamVssSupport\VeeamGuestAgent.exe
Faulting module path: C:\Windows\VeeamVssSupport\VeeamGuestAgent.exe
Report Id: d2a8be50-8418-11e1-b1b6-005056a13b3b

--

I think that the veeamguestagent.exe wants to install a service and needs elevated permission. With UAC on you need to click "ok" when a program want to change something on a server. Because you cannot click ok the timeout occurs and eventually the backup crashes.

[Cokovic]

Maybe you could give this registry hack a try

http://support.microsoft.com/kb/947232/en-us

Applies to Vista and newer versions.

[mbiesheuvel]

True only the first line is: You work on a Windows Vista-based computer that is a member of a workgroup.

And this is a member of a domain . So not for this issue.

[Cokovic]

I know. But as it's related to UAC i would still give it a try with the elevated token stuff. Nothing to lose here. If it doesn't work you can revert this setting back.

[xkursion]

I had the same issue when trying to back up a VM running my Deep Security Manager. Backup would fail saying it couldn't access admin share. Looked at the firewall rules and it was preventing network based VSS ports. I opened the ports and it worked. Closed them again and it did not work. Disabled UAC and the backup works again, likely through the tools API.