VSS ERROR

[biker]

Cannot connect to the host’s administrative share : HOST [IP-Adress-of-VM-Host] Account DOMAINXY\USERXY (user with Administrator rights)

Win32 Error : The network location cannot be reached Code:1231

VCB-Backup without VSS works

My Veeam Backup HOST is not in VM Network, he only can see ESX-Hosts, SAN-Storage and VI3-Center-Server.

Veeam Backup can't login to in VM to start VSS-Service on Microsoft-VM ? Is that the Problem ?

How works VSS - VCB and Veeam together ???

1. Veeam Backup login in VM (with DOMAINXY\USERXY) and start VSS-Service
2. VSS Service freeze Database (Exchange 2007 , Active Directory, SQL) transactions
3. VCB make konsistent VM-Snapshot
4. Veeam Backup , take Backup

is it correct ?

[Gostev]

Hello biker, yes you need to be able to ping target VM in order for Veeam VSS integration to work.
Your high-level description of VSS process is correct.

[alexr]

I see a potential problem here. For VMs on DMZ networks it would be quite impossible to start stop VSS since people are not about to open firewall to required extent. I wonder if it would be possible to achieve the same via VMTools interfaces. We could deploy your VSS services permanently on target computers so you would not need to do on the fly deployment just start and stop it which should be quite possible via VMTools

[Gostev]

Yes, we've received similar request before (but only once so far). Pre-installing agent and using VMTools to run it might be a good idea how this can be addressed.

[beckhamk]

BTW: I know that with VB2 you could decide to not use VB's VSS agent and use vmwares vss support (but you need to have installed the vmware vss support in vmtools). That works also. In our environment, the VB server has access to a certain vlan and certain vm's so those use the VB VSS Agent, but all other vm's are isolated on their own vlan(s) and we have to use vmware vmtools VSS. Both work fine. Originally VB had VSS support prior to vmware releasing the VSS option. Now vmware has it. not sure why we care about the vb vss anymore.

[Gostev]

We care about Veeam VSS because:

1. VMware VSS does not support application-level quiescense on Windows 2008.

2. VMware VSS does not implement correct restore for certain applications requiring custom restore procedure by vendor (Microsoft), as described here. Yes restore with VMware VSS seem to work in lab environment. But as soon as you install 3rd party apps like antivirus, file audit agents etc. (real-world situation) your chances to see restore failing with VMware VSS implementation increase significantly due to restore (although Microsoft description implies that even having AD service running during shadow copy restore could potentially cause the restore issue). It is clear that the restore procedures required by Microsoft to correctly restore AD, Exchange, SQL are there for a reason - they would not require them if they were not absolutely necessary. Besides, following the mandatory restore procedures is required from Microsoft supportability standpoint.

[biker]

Now i have antoher Problem Problem, my VeamHost can ping now my VM.

I have the following Warning :


Retrieving file list Cannot connect to the host's administrat ive share. Host: [HostIP]. Account: [DOMAINXY\USERXY_with_admin_rights]. Win32 error:No network provider accepted the given network path. Code 1203

Please help,

I have WINXP SP2 VM here.

[Gostev]

Do you have File and Printer Sharing enabled on your WindowsXP VM?

[biker]

Yes, it runs

But now after i've activated "pass trough" for File an Printersharing in Windows-Firewal-Settings of this VM, i have now this :

Cannot connect to the host's administrative share : Host : [IP]. Account DOMAIN\Username

Win32 error: Incorrect Username or Password Code:1326

But im sure my Domain\Username settings are correct and my DNS works.

im going crazy

Thanks

[biker]

I dont have Netbios im my net (only DNS lookup works, DHCP-Netbios Function ist deactivated for DHCP-Hosts) , its deactivated.

[Gostev]

Please try to connect to \\x.x.x.x\admin$ from Veeam Backup console using the VSS credentials you specify for job, and upload some file there.
Where x.x.x.x is your VM IP address.

[biker]

The Problem was

first (Blocked File and Printer Sharing in Firewall)

second My user in VeeamBackup-Vss-Credentials was in the group of local Admins in this VM, but he was not local Admin, only in this group of local Admins .

nice problem or ?

Solution - full rights to disk c:\ to this user and ....

it works

And it works, its funny.

VSS Agent successfully installed on VM and backup was successfull (only with VSS)

[Gostev]

Glad it worked. I don't understand your explanation around local administrator issue though. This is actually how you make a domain user to be Local Administrator on some computer - you simply add the user to Local Administrators group on this computer, and bingo, user gets Local Administrator privileges on the computer. This is actually the only way I am aware of. I am not sure how can it be that the user was in this group but did not have local administrator privileges - it is impossible... one thing you may have missed is that changes to local groups require logoff/logon so that user gets his security token updated to reflect new group membership (security token is constructed during logon).

[alexr]

I think I posted it before but do not remember if I got any replies.
One case is doing VB VSS on DMZ hosts which are not accesible from VB computer but is accesible on VMware management network.
What if we are given an option to install VB's VSS binaries onto target windows host and have VB use WMTools API to start/stop snapshot (if possible) via management network. The requirement of access from truested to DMZ and especially file/print sharing on DMZ server (might not be allowed for security reasons) will not be an issue

[biker]

I mean this User was not the standard built-in Local Administrator, he was in the group of Administrators, it must work , but it did not.

Only after i given full rights to disk c:\ for this User this start to work. He was already a member of Admin group on this Machine, like u say.

Now another question

If i use VSS, should i disable in Veeam Backup " Enable Vmware Tools quiscence" ? ( i have Windows Server 2008 64 bit VM with Exchange and Active Directory - Small Business Server 2008)

And should i deinstall in VMtools on this Machine "VMware-Vss Driver" ?

What are the best settings to make a consistent Backup from my VM (Small Business and Exchange 2007 64 bit) with Veeam Backup 3.0 and VSS.

Thanks

[Gostev]

With 3.0 you do not need to disable VMware VSS - it will be disabled automatically if Veeam VSS is used.
Best settings for you are default settings with Veeam VSS enabled.

[T.Holighaus]

Hello,

what is the solution for the vss error, if the VM's are still in the DMZ and not rechable for the veeam Backup Console?

Thank You

Thorsten Holighaus

[Gostev]

Hello Thorsten, you could install separate instance of Veeam Backup console in the DMZ to backup those servers.

[weslyle]

Can you tell us what ports to open in the Windows 2008 firewall to allow proper VSS functions.
Thanks
Wes

[Gostev]

NetBIOS (TCP port 139, UDP ports 137, 138), SMB (TCP port 445) and RPC (TCP port 135) between Veeam Backup console and guest VM