Application Level Backup Failure-Windows Server 2012 R2 UAC

[dlowe]

Veeam Support - Case # 00543912

I added a new Windows Server 2012 R2 standard server to one of our Veeam backup jobs, and it was failing with the following error:

Failed to prepare guest for hot backup. Error: Failed to connect to guest agent. Errors:
'Cannot connect to the host's administrative share. Host: [192.168.0.x]. Account: [DOMAIN\VBRbackup].
Win32 error:The network name cannot be found.
Code: 67
'
Note that the DOMAIN\VBRbackup account is a member of the Domain Admins group, has logon as service rights, is a member of the local administrators group on the MACEQT1 server, and even log on locally rights. UAC was disabled and the server rebooted.

After working with Veeam Support, they pointed me to the following article on how Windows 8 handles UAC differently than Windows 7, much the same as Windows Server 2012 R2 vs Server 2008 R2.
http://www.petri.co.il/disabling-user-a ... ows-8.htm#

After disabling all the UAC group policies on the server, application level quiesced backups started working.

Hope this helps someone else out there

[dlowe]

Sorry I meant to add that this is when doing Application processing backups over VIX, whereby there is no connectivity between the Veeam Server and the network that the VMs reside on, except for the VMware Management network connectivity...

[Vitaliy S.]

Hi Darryl,

Thank you for sharing this information, but have you tired using built-in admin account in application-aware image processing. The behavior you describe looks similar to this one > Backup failing due to UAC?

Thanks!

[dlowe]

Hi Darryl,

Thank you for sharing this information, but have you tired using built-in admin account in application-aware image processing. The behavior you describe looks similar to this one > Backup failing due to UAC?

Thanks!

I'm not sure what you mean by built in admin account. Are you referring to the local administrator account on each server? We would prefer to use an AD domain administrative service account that is locked down for security purposes, that we don't need to change the password on. See the notes on the support ticket for details.

Thanks,
Darryl

[Vitaliy S.]

Yes, I was referring either to built-in local account or built-in admin account. Accounts that are added to admin groups cannot bypass UAC policies as per the thread above. Thanks again!