Veeam ONE Monitor Client on Domain Controller not supported?

[dcolpitts]

Ok - what is up with this? I can understand not loading the Veeam ONE Server on a DC, the client - really? It was ok with v7 - what changed so much that v8 can't do it.

I've got a small site - with a pair of ESXi 5.5 hosts and one physical Windows 2012R2, which happens to be not only a DC, but my VBR server too - it would certainly be nice to have it all in place.

This is not acceptable boys and girls... Even VMware figured that out when they initially blocked the vSphere client install on DCs when 5.5 shipped - it isn't blocked now...

dcc

[dcolpitts]

Seriously Veeam - you went so far as to have a custom MSI action (VmACheckIsDC) and wrote it into VmCommonActions.dll to block installation of Veeam ONE Monitor Client on a domain controller? What possible excuse can you come up with to explain this?

I'm sure this is totally unsupported and I have no idea if this breaks other things, but for those who need the Veeam ONE Monitor Client installed on a Domain Controller, use your favorite MSI repackaging tool (i.e. Orca or SuperOrca), edit "veeam_monitor_cln_x86.msi" and navigate to the InstallExecuteSequence table and set VmACheckIsDC to True (type in the word True in as the condition). Then navigate to the InstallUISequence table and do the same thing. Save your MSI and launch it - it should now install on your DC.

Again - use this edit at your own risk... I accept zero responsibility if this hoses your system or causes any issues...

dcc

[Shestakov]

Hello Dean,

You are right, our QA team became over-cautious for a certain time and included VmACheckIsDC action to block installation of Veeam One Client on a DC since it`s not the best practice as you probably know.
Sorry for the arisen inconvenience.

As a workaround we recommend to do the following:
Download a Transform file here. And set a path to it manually:
Msiexec.exe /i <full_path_to_veeam_monitor_cln_x86.msi> TRANSFORMS=<full_path_to_MonCln80DC.mst> /lv*! <full_path_to_logfile>
For instance:
msiexec.exe /i E:\Monitor\veeam_monitor_cln_x86.msi TRANSFORMS=D:\exchange\vo80\MonCln80DC.mst /lv*! D:\exchange\vo80\log.txt

Thank you for the feedback, Dean!

[dcolpitts]

Thanks Shestakov. While installing tools and utilities on a DC may not be a best practice in most peoples books, for alot of smaller sites, it may be the only option available... As you may or not be aware, VMware took this same approach with the VMware Client installer when 5.5 was release (which is required if there is vCenter server in the site), although they left a command line property exposed (/VSKIP_OS_CHECKS="1") to override it without the use of an MST. And now it appears they completely removed the blocking all together in the more recent VMware Client 5.5U2 installers because I was able to install it the other day on a new 2012R2 DC without the command line switch. This particular DC is the only physical install of Windows in the client's computer room because everything else is virtualized (including a couple of other DCs) across three hosts. This is why it is so important to allow client installs on DCs, because if there is a virtualization issue, this is the box we need to use to resolve those issues while onsite in the computer room. Like I said - I can understand blocking the installation of the Veeam ONE server, but not the client on any supported OS - it's just a client interface anyways.

Is the .mst documented anywhere other than this thread? If not - it needs to be - infact it should be included on the .iso. And I want to really encourage you to consider at the very least invoking a command line property to override it - or better yet - re-able the client install out of the of the box for the client like V7 allowed. There are other options available to re-enforce to the person attempting the install that they shouldn't be using a DC - you could easily have the installer pop up a dialog box if a DC is detected and prompt the person installing to accept (by typing I Accept or clicking something that is your typical Yes/No/Ok/Cancel button) that they know the machine is a DC and that they know the risks...

Anyways - enough of my ranting. Once again, thanks for listening Shestakov.

dcc

[Shestakov]

Thanks for the comprehensive feedback, Dean.

To say the truth you are the first person who mentioned the restriction to install Veeam One Client on DC, and we`ve just made the hot-fix. So yes, for now it`s just here, but we will think how to provide it to all the users with the same need, because we do understand the demand. Probably we will describe the workaround in a KB.

Again, sorry for the inconvenience and thanks for your advice.

[tny]

Hello,

is it also possible to install the Server on a Domain Controller? I only have 3 servers: 2 cluster nodes and one Backup/DC Server (second DC in Cluster VM). I wanted to install Veeam One on the Backup/DC Server so it can monitor the cluster.

Best regards

[Vitaliy S.]

Veeam ONE server cannot be installed on the DC, since there are no local groups required by the installation. Thanks!

[Tasman505]

Shestakov

You say there is a hot fix for this available? Where can I grab this?

[Shestakov]

Hello,
After additional observation it was decided not to allow installing Veeam One client on DC since it can cause unrecoverable issues.
Thanks.

[Vitaliy S.]

Tasman505, do you want to install Monitor Client or Veeam ONE server on a DC? Can you please tell us a bit more why do you want to do this?

[dcolpitts]

Really? - installing the Veeam One Monitor Client on a DC is still blocked in V9? Get real guys - it is just a frickin CLIENT!!!!!!

dcc

[Vitaliy S.]

Hi Dean, we will take a look at what can be done to fix that in our next updates.

[dcolpitts]

v9.5 changes the table and condition that needs changed to install the Veeam ONE Monitor Client on Domain Controller.

Here are the required steps to modify the MSI to allow installation of the Veeam ONE v9.5 Monitor Client on Domain Controller.

• 1.) Extract the VeeamONE.9.5.0.3201 iso image to a folder, then navigate to the extracted Monitor folder
  2.) Copy veeam_monitor_cln_x64.msi to veeam_monitor_cln_x64_dc_installer.msi
  3.) Open veeam_monitor_cln_x64_dc_installer.msi with an msi editor such as SuperOrca
  4.) Scroll down to the VMLaunchConditions table
  5.) There you should find three entries, and one of them will have the following data: "MsiNTProductType <> 2"
  6.) Edit the entry and change "<>" to "=" so you end up with "MsiNTProductType = 2"
  7.) Save the msi and close your msi editor
  8.) On your domain controller, doubleclick veeam_monitor_cln_x64_dc_installer.msi to install the Veeam One Monitor client

Use this edit at your own risk!!! I accept zero responsibility if this hoses your system or causes any issues...

dcc

[Vitaliy S.]

Hi Dean,

Thanks for the solution. I have shared it with our setup guys and they say that you don't need point 6 at all. In other words, you can remove this line entirely "MsiNTProductType = 2" to allow installing Veeam ONE Monitor Client on a DC machine.

On a side note, we will remove this verification in our next updates once again. It seems like some dev guys think that this is not a best practice deployment and recheck-in this code verification to every new product update.

Thanks!

[dcolpitts]

Excellent - thanks for the update.

Darn devs - you just can't trust them for nothing...

dcc

[dcolpitts]

Vitaliy - removing the entire line works fine assuming you launch the .msi directly for installation from Explorer or command line... However, if you try to install the Monitor Client by launching from the setup.exe splash screen, it still pukes and complains about installing on a DC.

dcc

[Vitaliy S.]

Yes, there are extra checks on the DC role presence, so the only way to install it is via MSI package.