Win32 error:Access is denied.

[sv572]

trying to backup a Win2k3 domain controller with VSS with Veeam Backup 2.0.1.164

Error Cannot initialize information about the guest's system. Target host: [172.xxx.xxx.10].
Error Cannot collect metrics about the guest's operation system.
Error Cannot open sessions manager's registry key.
Error Win32 error:Access is denied.
Error Code: 5
Error Cannot initialize information about the guest's system. Target host: [172.xxx.xxx.10].
Error Cannot collect metrics about the guest's operation system.
Error Cannot open sessions manager's registry key.
Error Win32 error:Access is denied.
Error Code: 5 at VeeamGuestAgentCtrlLib.IVeeamGAInstaller.CollectGuestMetrics()
Error at AgentProvider.CVssFreezer..ctor(String vmName, String vmUser, String vmPassword)
Error at VeeamManager.CVssAutoFreezer..ctor(String vmName, VirtualMachinePowerState vmPowerState, CGuestOs vmGuestOs, CVssOptions options)

the process does continue to do the backup of the VMDK

i have set the default credentials in the backup job to a domain admin account id and password

[Gostev]

Hmm, this clearly looks like security or lack of permissions issue.
Could it be that you have some advanced security policy set on your domain controllers denying remote access to it?
What OS you have your Veeam Backup console installed on? What format do you use to enter credentials?

Since this is environment-specific issue, it would be best if you contact our support directly with this information.

[sv572]

i'm going to post my correspondence with Veeam support - hopefully it will provide insight to others who may have the same issue.

[sv572]

To verify that you have sufficient privileges on that entry please do the following on the Veeam Backup machine:

net use \\<guest_host>\admin$ /u:<VSS_account_NT_4_compatible> <pwd>
i.e: net use \\host\admin$ /u:host\admin qwerty

After that try to open the remote registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session
Manager\Environment

I know that you are using a Domain Administrator account but it still seems to be an authentication problem. The above will verify that, but you can also specify a known local administrator or another domain administrator account to test with.

Best regards,
-Ben

--------------------------------------------


Hi Ben,

Ok - I had to make a change in order to see HKLM of the exchange server

http://support.microsoft.com/kb/555335

I verified that I can see the registry from the Veeam Backup machine - with "net use" and loading the remote registry.

I still get the same error with Veeam Backup. I am using the same user id / password in the Veeam settings. For default credentials and for "set user" - I specify the same user in the "net use" command.

--------------------------------------------

This error has nothing in common with VSS, sorry for miscommunication. WHat is the exact version of your ESX host? We've had reports that on certain ESX versions other values of this parameter help. However, this issue will be fixed in the next release version.

--
Stanislav Simakov

--------------------------------------------

Both VM servers at the same version

VMWare ESX Server, 3.5.0, 110268

Please confirm what versions are affected

[sv572]

At this point, there has been no confirmation from Veeam support on what versions of VMWare are affected by this "issue"

I'd like to make the point that we did purchase a license for Veeam (4 socket) as well as purchasing support.

I'm also unable to get a successful VMDK backup - but that is for a different forum topic.

[ssimakov]

Simeon,

There are two separate issues related to your opened case. One is SSH control "connection forcibly closed" message and the other is this "Access denied" message. SSH control connection issue is related to ESX SSH configuration and is not related to VSS or guest VMs. Altering ESX configuration may help, however we failed to reproduce this issue in our lab, but there were posts on this forum with reports on successfully resolving this issue using different values for ClientAliveInterval parameter.

As to "Access denied" VSS issue, please check your email, we've requested some additional information that may help.

[Gostev]

Simeon, please let's not mix these two issues together here because they are unrelated, so instead of providing insight for other people, this topic would confuse them. Also, it would be best if we only post the solution here after the issue is resolved, but until then keep all communication internal.

[murda]

What was the solution for this problem?

I have the same issue at a costumer.

[Gostev]

The solution is to upgrade to the latest version - the fix for this was included around 3.1.1 release timeframe.

[murda]

The solution is to upgrade to the latest version - the fix for this was included around 3.1.1 release timeframe.

We have Veeam Backup 4.1

[Gostev]

We have Veeam Backup 4.1

Then it is definitely not the same issue. Most likely, it is simple permissions issue with Veeam VSS account not having Local Administrator privileges on the processed VM, or some non-default security settings on the VM causing authentication problems.

Did you do the test mentioned above from Veeam Backup server:

net use \\<guest>\admin$ /u:<VSS_account_NT_4_compatible> <pwd>
i.e: net use \\vm\admin$ /u:domain\admin qwerty

After that try to open the remote registry key with regedit (use "Connect to remote registry"):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Environment

[murda]

Then it is definitely not the same issue. Most likely, it is simple permissions issue with Veeam VSS account not having Local Administrator privileges on the processed VM, or some non-default security settings on the VM causing authentication problems.

Did you do the test mentioned above from Veeam Backup server:

Indeed it is a security problem but so far I cannot find a solution.
I cannot acces the registery remotely on HKLM.

But I do have permissions on that registery folder as a local admin and as a domain admin.
I'll better make a thread on technet as this is more a windows/OS issue.

[murda]

I Fixed the issue.
Permissions on HKLM were correct however. When I checked permissions - advanced - permissisions.

Click on Machine\administrator.
Then enable the following and press ok.

- Include inheritable permissions from this object's parent
- Replace all child object permissions with inheritable permissions from this
object.

Then it suddenly worked although I already had acces to the following HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Environment.

Bizarre