Access Denied connecting to vCenter 18455184 after 11a upgrade

[Fredde7803]

After an upgrade to VBR 11a it refuses to connect to our vCenter 18455184 and it just states "Access Denied".

Host discovery etc obviously fails and no backups can be run.

In Svc.VeeamBroker.log the following can be seen:
[date/time] <11> Error [ViHierarchyService] Unable to get hierarchy content for host [some kind of GUID]
[date/time] <11> Error Access denied. (System.Security.SecurityException)
[date/time] <11> Error at Veeam.Backup.ServiceLib.CBackupUacAccessChecker.DoCheckAnyPermission(IPrincipal principal, Permissions[] permissions)
[date/time] <11> Error at Veeam.Backup.BrokerService.CViHierarchyServiceStub.GetHierarchyObjects(CHierarchyManagerUid hierarchyManagerUid, UInt64& version, Guid& sessionId, String[]& removedObjects, Boolean retryConnect)

The account used works just fine from a browser and I've tried the obvious with changing the password under credentials and retry etc.

Anyone with similar a similar issue?

Ticket exists (05055069) but no solution so far.

[Natalia Lupacheva]

Hi Fredrik,

Couldn't find any issues exactly matching your situation.
If you're unhappy with your Support ticket, you can always escalate your case.

Thanks!

[Ollo]

I had this error in past after upgrading VCenter to the latest patch level.
Solution was, to go vcenter connection wizard again under Inventory/Virtual Infrastructure/vCenter Servers/your vcenter/properties
Start it and then, next, next, finish.

It seems so, that sometimes the vcenter and the vbr has to exchange some encryption keys.

[Fredde7803]

I've escalated the case and I'm now in contact with a support engineer!

Ollo - that doesn't work and I only get "Access Denied" as the error message. Obviously something with the relationship is broken but I don't dare to just remove the vCenter and re-add it since I don't want to redo (and rerun) all the jobs from scratch unless really necessary.

I'll get back with more information here soon.

[TshepoM]

Did you try login in with the local vCenter credentials.

[stagnant]

Same issue here. We just upgraded Veeam to 11a and are running vCenter 7.0.3.00000 (18700403). We cannot remove and re-add vCenter to Veeam B&R as we have dozens of jobs and tags tied to it. We are debating upgrading vCenter to 7.0.3.00100, but as of now VMware has listed many bugs with Update 3. https://kb.vmware.com/s/article/86398

Did anyone find a specific solution?

[stagnant]

Update. Turns out we just had a permission issue in the actual Veeam console Users and Roles. We had migrated our Veeam config from an old (domain joined) server to a new Server 2019 VM (non domain joined). We were able to log into the console with the local user account and add repos & proxies. But we were NOT able to rescan vCenter no matter which credentials we tried. Once we added the local account as a Veeam Administrator, everything worked just fine. As to why we were able to log into the console at all with no account listed in the Users and Roles is beyond me, but we're backing up now!

[cs233]

Same issue here with my vCenters after upgrading to 11a, from 9.5 u4. vCenter was at build 18010531 (6.7.0.48000) and receiving Access Denied errors with Veeam trying to Connect or rescan my vCenters after v11a. Upgraded vCenter to build 18485166 (6.7.0.50000) and still unable to connect to my vCenters in Veeam 11a (access denied).

I will open a ticket with Veeam as well.

[cs233]

Update: My issue was the same as @stagnant posted. I just hadn't verified the correct account in Veeam Users and Roles. I needed to give a Veeam role to the service account my Veeam B&R service runs under, then I was able to connect to vCenters and successfully rescan them. Not sure if this was a new requirement, or the upgrade removed a role that had existed prior.