Event 4625 logged after upgrade from VeeamONE 9 to 9.5

[jassonmc]

Is it only me or do others have this issue too?
I get this error now on both installations we support which we upgraded just recently from VeamONE 9 to 9.5
The errors are only logged during running backup tasks.
Although the error is logged multiple times, the backup runs without any issues.

What kind of access does that process "VeeamHvWmiProxy.exe" need anyway?

Thanks for a hint to anyone

Cheers
jassonmc


EVENT VIEWER ENTRY
----------------------------
An account failed to log on.

Subject:
Security ID: SYSTEM
Account Name: HYPERVHOST$
Account Domain: DUMMYDOMAIN
Logon ID: 0x3E7

Logon Type: 9

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: -
Account Domain: -

Failure Information:
Failure Reason: An Error occured during Logon.
Status: 0xC0000106
Sub Status: 0x0

Process Information:
Caller Process ID: 0x1a88
Caller Process Name: C:\Program Files\Veeam\Hyper-V Integration\VeeamHvWmiProxy.exe

Network Information:
Workstation Name: -
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

[rkovhaev]

It is a known issue and VeeamHvWmiProxy.exe is a VBR component. Feel free to open a support case with VBR team - as a reference you can mention case #02088046

[jassonmc]

Thanks for the info. Just opened case #02132159.

[dsapergia]

Seeing the same behavior on a fresh install of Veeam Backup 9.5 Update 1. Upgrading to Update 2 does not fix this issue.
Affects both Server 2012r2 and 2016 hosts.
Opened a case with support.

[jassonmc]

I got in touch with 2nd level support and they sent me a fixed VeeamHvWmiProxy.exe that I had to put on the Hyper-V host.
It fixed the error partially but I figured that the event 4625 wouldn't go completely away.

After some more investigation it became clear, that the Veeam generated event 4625 entries indeed vanished after applying the fix and some others remained.
When we upgraded to Veeam 9.5, we did at the same time upgrade our Hyper-V host to Windows Server 2016 and there seems to be an issue with the BITS service.
Every start of that service generates the event 4625 as well, which seems a "standard feature" for WS 2016 aka "bug that MS does not care to fix"

Let's talk about coincidence...

Anyway, Veeam issue fixed, Microsoft issue still pending.

[dsapergia]

Was also provided the same hotfix as jassonmc. Applied it to my Server 2016 hosts and confirmed it is no longer triggering alerts in VeeamOne.
The error had also shown up on my 2012 r2 hosts when I added them to VeeamOne, but has not reoccured even without using the hotfix, so perhaps that was just related to the initial setup.

[Shestakov]

Good to know the fix helped.
Could you provide your support case numbers for future reference?
Thanks!