Challenge

 “Not all privileges or groups referenced are assigned to the caller”

Cause

Solution

1. Open Run and type in secpol.msc to bring up the Local Security Policies
2. Navigate to Security Settings > Local Policies > User Rights Assignment and locate the policy for “Debug programs”​
3. Right Click the policy and select Properties
4. The credentials being used to run the install should be listed here, or be included in one of the groups listed. 

More Information

Challenge

Cause

Solution

1. Edit the bindings within Internet Information Services (IIS)

2. Update site information within the VeeamONE Settings Utility

a. Open the VeeamONE Settings utility (In Veeam One Monitor console navigate to Options > Server Settings > Other Settings > Launch Support Utility or browse to or run C:\Program Files\Common Files\Veeam\Veeam ONE Settings\VeeamOneSettings.exe)
b. On the General tab, select Shortcuts at the top
c. Update the link to the appropriate port number
d. Navigate to the Reporter tab on the left side of the utility and select the Website Settings option at the top
e. Update the port number on this link as well
f. Click ‘Save’ in the bottom right corner to commit the changes to the database.
g. Click yes when prompted to allow the services to restart
 

3. Test the site by launching the site via the desktop icon or typing the link into a browser manually. The site should now open under the new port number.

More Information

Challenge

• Restoring single lost DC in a multi-DC environment
• Restoring entire AD infrastructure (AKA “all DC’s are lost”)
• Restoring from Active Directory corruption

Solution

More Information

Challenge

Cause

• Backup of failover clusters is supported in Veeam Agent for Microsoft Windows managed by Veeam Backup & Replication only. You cannot process a failover cluster by Veeam Agent for Microsoft Windows operating in the standalone mode.
• Agent license with a server counter must be installed in Veeam Backup & Replication to enable Agent Management features including failover cluster support.
• Veeam Agent for Microsoft Windows supports Windows Server Failover Clusters running Microsoft Windows Server 2008 R2 and later.
• Workgroup clusters, multi-domain clusters, Windows Server 1709 core edition clusters, and mixed OS version clusters are not supported.
• Cluster Shared Volumes (CSV) are skipped automatically during the backup.
• The following Microsoft Failover Cluster applications are supported: Microsoft SQL Server Failover Cluster Instances (Microsoft SQL Server 2008 SP4 or newer), Microsoft SQL AlwaysOn Availability Groups, Microsoft Exchange Database Availability Groups (Microsoft Exchange Server 2010 or newer).
• Microsoft Exchange Database Availability Groups should be protected by independent managed by backup server jobs with server type.
• When using Basic Availability Groups on Microsoft SQL Server 2016 Standard Edition, consider that secondary replica node cannot be backed up because the secondary node is not readable. See the following article for more information.
•  AlwaysOn Availability Groups based on multiple Failover Cluster Instances are not supported.
• AlwaysOn Clusterless Availability Groups are not supported.
• Managed by backup server job with failover cluster type does not support the file-level backup mode.
• Recovery must be performed via Veeam Backup & Replication console.

Solution

Microsoft Windows Server Failover Clusters, Microsoft SQL Server Failover Cluster Instances, SQL Always On Availability Groups

Microsoft Exchange Database Availability Group

Challenge

Product Information: 

Product Family: HybriStor 
Status: Veeam Ready – Repository 
Classification Description: Verified backup storage that supports all Veeam backup and restore features. 

Solution

Product Details: 

Model number: HS-SMB-24 
Number of Drives: 8 
Drive type: 4TB SAS 
Firmware version: 2.3.108 and newer. Note the HybriStor HS-SMB-24 maximum file size is 16TB with this firmware version. VMs larger than 16TB (or ~28TB if compression is enabled) may exceed this limit. 
Connection protocol and speed: 10 GbE 
General product family overview:  
HS-SMB-24 
24TB up to 64TB 
8 x 4TB (RAID 6) 
2 x 10GbE ports 
2 x 1GbE ports 
1 x IPMI ports 

Veeam Details: 

Veeam Build Number: 9.5.0.1536 
Veeam Settings:  

• Repository Type: Shared Folder 
• Deduplication: No 
• Compression: No 
• Storage Optimization: Local target 
• Per-VM Backup Files: Yes 
• Decompress before storing: No 
• Align backup file blocks: No 

More Information

Company Information: 

Company name: Neverfail 
Company overview: Neverfail is at the forefront of business continuity and disaster recovery solutions that protect businesses from the devastating effects of downtime and data loss. With a unique approach to BC/DR, we enable IT to meet SLAs for every application tier and recovery profile - ensuring that organizations never under-protect or over-pay for data protection again. 

Challenge

• Unexpected End of File
• Exchange Web Services error code: ErrorExceededConnectionCount
• Error: Failed to get folder properties
• Error: You have exceeded the available concurrent connections for your account.  Try again once your other requests have completed.
• Error: Unexpected end of file has occurred. The following elements are not closed: m:Data, m:ExportItemsResponseMessage, m:ResponseMessages, m:ExportItemsResponse, s:Body, s:Envelope. Line 1, position 21397505.

Cause

Solution

Challenge

Cause

Solution

More Information

Challenge

Cause

Solution

Challenge

Product Information:

Product Family: iXsystems X-Series
Status: Veeam Ready - Repository
Classification Description: Verified backup storage that supports all Veeam backup and restore features.

Solution

Product Details:

Model number: X20
Number of Drives: 18
Drive type: 2TB 7200 SAS
Firmware version: 11.1
Connection protocol and speed: 10 GbE iSCSI
Additional support: All models and configurations of iXsystems X-Series with specifications equivalent or greater than the above
General product family overview: TrueNAS X20 Modular 2U Rack Mount with Hot-Swappable Storage Controllers and Global Fault Notification LED

Vendor Veeam testing configuration:

Veeam Build Number: 9.5.0.1038
Veeam Settings:

• Repository Type: Windows
• Deduplication: Yes
• Compression: Optimal
• Storage Optimization: Local target
• Per-VM Backup Files: Yes
• Decompress before storing: No
• Align backup file blocks: No

More Information

Company Information:

Company name: iXsystems
Company overview: Champions of Open Source - iXsystems believes that Open Source technology has the power to change the world throughits process of open and collaborative innovation. This principle fuels all product design at iXsystems. By leveraging decades of expertise in hardware design, its contributions to many Open Source software communities, and corporate stewardship of leading Open Source projects (including FreeNAS® and TrueOS®), iXsystems has become an industry leader in building innovative storage solutions and superior enterprise servers for a global marketplace that relies on open technology.

Challenge

Product Information:

Product Family: IntelliFlash T-Series, HD-Series
Status: Veeam Ready - Repository 
Classification Description: Verified backup storage that supports all Veeam backup and restore features.

Solution

Product Details:

Model number: T4100 
Number of Drives: 3, 13
Drive type: 500GB SSD, 2TB HDD
Firmware version: 3.7
Connection protocol and speed: 10 GbE iSCSI
Additional support: All models and configurations of Tegile T or HD-Series with specifications equivalent or greater than the above 
General product family overview: Tegile enterprise storage arrays accommodate different grades of storage media—from hard disks to high-performance flash memory. Using patented IntelliFlash™ software architecture, data is organized and placed on the most appropriate media to deliver optimal performance with the best possible economics. Native SAN and NAS protocols enable you to simplify data management by storing application data, virtual machines, and unstructured data—all on a single array.

Vendor Veeam testing configuration:

Veeam Build Number: 9.5.0.1038
Veeam Settings:

• Repository Type: Windows
• Deduplication: Yes
• Compression: Optimal
• Storage Optimization: Local target
• Per-VM Backup Files: Yes
• Decompress before storing: Yes
• Align backup file blocks: Yes

More Information

Company Information:

Company name:Tegile – A Western Digital Brand
Company overview: Founded in 2010, Tegile Systems - A Western Digital Brand, is an enterprise storage vendor headquartered in Silicon Valley, California. Tegile makes all-flash and hybrid storage arrays that help organizations eliminate storage silos and simplify storage management by consolidating all of their workloads onto a single flash platform.

Challenge

Cause

Solution

1. Backup the Veeam database. (http://www.veeam.com/kb1471)
2. Run the following query against the VeeamBackup database

Challenge

Task fails with the error "root element is missing."
You can find such entries in the log file:
 

[timestamp] <01> Error    Read summary xml error   at Veeam.Backup.Core.CRawSummary.CreateOibSummary()

[timestamp] <01> Error       at Veeam.Backup.Core.CSynOibAlg.CreateOib(CPoint fullPoint, CPoint rollPoint, CStorage fullStorage, CStorage rollStorage, COib rollOib)

[timestamp] <01> Error       at Veeam.Backup.Core.CBackupJobPerformer.ExecuteTask(IBackupTask task, ITarget target)

[timestamp] <01> Error    Root element is missing.   at System.Xml.XmlTextReaderImpl.Throw(Exception e)

Cause

This usually occurs when part of Veeam data could not be written to the summary.xml file (due to space, connectivity issue or some other specific issue). After that failure, cleaning up space on a target or fixing other problems that caused this behavior initially will not let you proceed with the incremental because the summary.xml is missing critical information on the previous backup.

Solution

Challenge

Solution

Challenge

Cause

Solution

Required Permissions

Authorizing with Veeam ONE

To authorize with Veeam ONE software components (Veeam ONE Monitor, Reporter and Business View), a user must have the Allow log on locally privilege assigned.

By default, this privilege is assigned to users included in the local Administrators group. For users not included in the local Administrators group, you must assign this privilege manually. For details, see this Microsoft TechNet article.

Connection to Microsoft SQL Server

The account used to connect to the Microsoft SQL Server hosting the Veeam ONE database must have the following permissions:

• Public role (default permissions)
• CREATE ANY DATABASE permissions
• db_owner role on the Veeam ONE database
• db_datareader permissions on the master database
• public, db_datareader, SQLAgentUserRole permissions on the msdb database
• [For Always-On Availability Groups] VIEW SERVER STATE permissions 

Connection to Microsoft Hyper-V VM Guest OS

The account used to collect data from guest OSes of Microsoft Hyper-V Windows VMs, must have local Administrator permissions on the guest OS.

Connection Under UAC

Veeam ONE collects data from Microsoft Windows servers using WMI. For some configurations, UAC access token filtering can prevent running WMI commands on connected machines, which in turn will cause data collection failures.

The affected configurations are:

• Non-domain machines (machines in a workgroup)
• Machines with an unelevated local Administrator account (the account that is not Built-in Administrator)

To allow Veeam ONE collect data from these machines, perform the following steps on target virtual servers:

1. Set the network location to private:

1. Log on to a machine as Administrator.
2. Open the Network and Sharing Center.
3. In the list of active networks, click the necessary network and change its location to Private.

In some Windows OS versions, this location is called Home or Work.

1. Configure Windows Remote Management.

To do so, in the command prompt, type winrm quickconfig and press [Enter].

For more details on UAC access token filtering, see User Account Control and WMI.

Authorizing with Veeam ONE

To authorize with Veeam ONE software components (Veeam ONE Monitor, Reporter and Business View), a user must have the Allow log on locally privilege assigned.

By default, this privilege is assigned to users included in the local Administrators group. For users not included in the local Administrators group, you must assign this privilege manually. For details, see this Microsoft TechNet article.

Remote Access

To be able to access Veeam ONE software components installed on a remote machine, you can use one of the following options.

Remote Access to Veeam ONE Reporter and Business View through Web Browser

Veeam ONE Reporter and Business View consoles can be accessed using a web browser on a remote machine. To learn more on how to access Veeam ONE software components, see Accessing Veeam ONE Monitor, Reporter and Business View.

Veeam ONE Reporter and Business View consoles remotely, a user must be a member of the Veeam ONE Administrators or Veeam ONE Read-Only Users group on the machine where Veeam ONE Web UI component is installed. For details on Veeam ONEsecurity groups, see Security Groups.

Remote Access for Multi-Tenant Monitoring and Reporting

Veeam ONE supports multi-tenant access to its monitoring and reporting capabilities. Authorized users can remotely monitor a subset of the vCenter Server or vCloud Director infrastructure and create reports.

To monitor and report on a restricted scope of the virtual infrastructure, a user must have permissions assigned on objects of the vCenter Server or vCloud Director inventory hierarchy. For details, see Veeam ONE Multi-Tenant Monitoring and Reporting.

Required Ports

1 You must open these ports manually
2 To learn about enabling and disabling WMI traffic, see http://msdn.microsoft.com/en-us/library/aa389286(v=vs.85).aspx and http://msdn.microsoft.com/en-us/library/aa822854(v=vs.85).aspx 
3 Associated with the File and Printer Sharing service
4 To gather performance data from Windows Server 2012 and 2012R2, you must additionally enable network discovery.

Challenge

Warning Failed to create agent manager {IEpAgentManagementProtocol} (Agent: image-01, SessionName: PackageInstall): No connection could be made because the target machine actively refused it IPAddress:6185 Info [UploadManager] Checking windows package 'C:\ProgramData\Veeam\Agents\VAW\Veeam_B&R_Endpoint_x64.msi' signature on host 'HOSTNAME'Error Failed to call RPC function 'PckgCheckSignature': Signature of module 'C:\ProgramData\Veeam\Agents\VAW\Veeam_B&R_Endpoint_x64.msi' is invalid.. InParams: '<InputArguments><ModulePath value="C:\ProgramData\Veeam\Agents\VAW\Veeam_B&R_Endpoint_x64.msi" /></InputArguments>'. Error Signature of module 'C:\ProgramData\Veeam\Agents\VAW\Veeam_B&R_Endpoint_x64.msi' is invalid Error --tr:Failed to call DoRpc. CmdName: [PckgCheckSignature]. (System.Runtime.InteropServices.COMException)

Cause

Solution

1. Download DigiCert Assured ID Root CA here (right click on Download button - save as)
2. Double click the downloaded .srt file
3. Click Install Certificate
4. Choose Local Machine and click on Next
5. Place the certificate into Trusted Root Certification Authorities by clicking the Browse button.

Challenge

Solution

Please Note:
• WebDAV must have been enabled on the Exchange 2003/2007 server when the restore point being restored from was created in order to restore using U-AIR.
• If WebDAV was not enabled, or you need a .pst, you can start the SureBackup job and use Outlook installed on the Veeam server to connect the Exchange server in the isolated network to export the data to PST.
• Veeam Backup & Replication must have an Enterprise or Enterprise Plus license to perform this restore.
• You will need the U-AIR wizard for Microsoft Exchange, this package does not come with Veeam Backup & Replication v8. You must contact Veeam Support (support.veeam.com) in order to acquire this package.
• As of April 2017, Microsoft no longer supports Exchange 2007. Therefore, Veeam Support can no longer assist with steps 7 and 8 of the below process.
 
Once you’ve downloaded the U-AIR Wizard, perform the following to process the restore:
This KB contains the SureBackup Configuration Guide for 8.x https://www.veeam.com/kb2047
 
1. Create a Virtual Lab.
     http://helpcenter.veeam.com/backup/80/vsphere/index.html?create_vlab.html
     https://www.veeam.com/videos/5-easy-sessions-for-modernizing-your-data-protection-configuring-your-first-virtual-lab-2110.html
 
2. Create an application group.
     http://helpcenter.veeam.com/backup/80/vsphere/appgroup_create.html
 
     Add to it the following servers in the order listed here:
     • Domain Controller w/ Global Catalog role
     • Exchange Mailbox server
     • Exchange CAS server (if separate).
 
     Note: In the application group settings, enable the "Domain Controller" role for the DC and remove all test scripts.
     For the Exchange server, leave all roles unchecked. Disable the IP boot verification tests on all servers in the application group, and set the application initialization timeout for all servers other than the DC to 0 seconds.
 
3. Create a Surebackup job.
     http://helpcenter.veeam.com/backup/80/vsphere/create_surebackup_job.html
 
     Configure it to use the Virtual Lab and Application Group configured in the previous steps.
     Note:
     • On the Application Group tab, enable the “Keep the application group running once the job completes” option.
     • Do not configure any Linked Jobs
 
4. Run the Surebackup job.
     Note: If you need to restore to a specific restore point choose the “Restore to…” option.
 
5. Wait for the job to report that all VMs in the SureBackup job are “Started”
 
6. Start the Exchange AIR Wizard.
     From an administrative command line, run the following command:
 
  "C:\Program Files\Veeam\Application Restore\Exchange Restore\Veeam.AIR.Exchange.exe" /admin
 
7. Specify the DC and Account to be used for the restore.
     Use the Production DC IP address, and an account that has impersonation rights.
 
8. Specify the account to restore emails from.
 
9. Specify the Backup CAS.
     Use the masquerade address displayed within the SureBackup statistics window.





10. Specify the Production CAS
 
11. Specify the CAS server version:
 
12. Complete the U-AIR Wizard
      The next steps are documented here:
      http://helpcenter.veeam.com/backup/70/uair/uair_exch_restore_mailbox.htm
 
13. Restore Complete and Cleanup
     After the restore is complete you will need to stop the SureBackup job manually.

More Information

Challenge

Info [UploadManager] Checking windows package 'C:\ProgramData\Veeam\Agents\VAW\Veeam_B&R_Endpoint_x64.msi' signature on host 'HOSTNAME'
Error Failed to call RPC function 'PckgCheckSignature': Signature of module 'C:\ProgramData\Veeam\Agents\VAW\Veeam_B&R_Endpoint_x64.msi' is invalid..
Error Signature of module 'C:\ProgramData\Veeam\Agents\VAW\Veeam_B&R_Endpoint_x64.msi' is invalid Error --tr:Failed to call DoRpc. CmdName: [PckgCheckSignature].

Cause

Solution

1. Download DigiCert Assured ID Root CA here (right click on Download button - save as)
2. Double click the downloaded .srt file
3. Click Install Certificate
4. Choose Local Machine and click on Next
5. Place the certificate into Trusted Root Certification Authorities by clicking the Browse button.

Challenge

Solution

Backup issues:

1. Navigate to C:\ProgramData\Veeam\Backup365\Logs with Windows Explorer or use “Open Log path” button in the main menu of Veeam Backup for Microsoft Office 365.

2. Zip contents of the directory and save the archive to a temporary location.

3. If there is more than one proxy in your environment,  zip C:\ProgramData\Veeam\Backup365\Logs of the proxy used by the affected job and save the archive to a temporary location.

4. Please attach these to your case. If the total attachment size is under 3.5MB, you may attach via email reply. If none of these upload options are working, please notify Veeam Support and an engineer will provide FTP credentials for the case.

Restore issues:

1. Navigate to C:\ProgramData\Veeam\Backup\ExchangeExplorer\Logs on the machine where restore session was started, zip contents of the directory and save archive to a temporary location.

2. (Optional) Sometimes default logging level is not enough to find the root cause of an issue and extended logging is required. To enable extended logging please create a file named “Config.xml” under C:\ProgramData\Veeam\Backup\ExchangeExplorer and add the following line there:

<Veeam>
               <Core>
                               <Log Level="Extended" />
               </Core>
</Veeam>
 

Close all instances of Veeam Explorer for Exchange, retry the restore and collect extended logs.

3. Please attach these to your case, or in the event that the total attachment size is under 3.5MB, you may attach via email reply. If none of these options for upload are working, please notify Veeam Support and an engineer will provide FTP credentials for the case. 

Below is an animation demonstrating how to upload logs to the Veeam Support FTP.​

Note: Please use the FTP account provided to you by the engineer for your case. When submitting logging data for analysis by request of an engineer, ensure that the case is replied to when the log submission has completed. In this reply, please include the names of any tasks and associated VMs with issues.




Note: SFTP is now supported when uploading to supportftp2, please place files in the \upload\ folder.

Challenge

Cause

Solution

• Sysadmin role, or the following can be used if you need to provide only minimal permissions:
  • SQL Server instance-level roles: dbcreator and public
  • Database-level roles: db_backupoperator, db_denydatareader, public
  • For System Databases:
    • master - db_backupoperator, db_datareader, public;
    • msdb - db_backupoperator, db_datawriter, db_datareader, public
  • Securables: view any definition, view server state
  • For truncation of SQL Server 2012 or SQL Server 2014 database transaction logs, this account should have the db_backupoperator database role (minimal required) or the sysadmin server role.

Challenge

Solution

1. Select the Incremental backup mode.
2. Do not enable synthetic full backups and/or active full backups. If you enable synthetic and/or active full backups, Veeam Backup & Replication will produce a forward incremental backup chain (documented below).

1. During the first run of a backup job, Veeam Backup & Replication creates a full backup file (VBK) on the backup repository.
2. During subsequent backup job sessions, Veeam Backup & Replication copies only VM data blocks that have changed since the last performed backup (full or incremental) and saves these blocks as an incremental backup file (VIB) in the backup chain.

 
Information regarding how retention works for this backup method can be found here:
https://helpcenter.veeam.com/docs/backup/vsphere/retention_forever_incremental.html?ver=95

──────────────────────────────────────────────────────────
Forward Incremental Backup Method
──────────────────────────────────────────────────────────
During the first run of a forward incremental backup, or simply incremental backup, Veeam Backup & Replication creates a full backup file (.vbk). During subsequent runs of the backup job, it will only retrieve changes that have taken place since the last run of the job (whether full or incremental) and saves this information as an incremental backup file (.vib). Each full backup files (.vbk) and its incremental files (.vib) that depend upon it are treated as a chain. Meaning that each incremental restore point depends on the one that came before it, the full restore point has no dependencies.
 

 

Within this animation the lettered squares represent blocks on a disk.
 
Incremental backup is the best choice if company regulation and policies require you to regularly move a created backup file to tape or a remote site. With incremental backup, you move only incremental changes, not the full backup file, which takes less time and requires less tape. You can initiate writing backups to tape or a remote site in Veeam Backup & Replication itself, by configuring Backup to Tape jobs.
 
If you decide to use the forward incremental backup method, it is necessary to schedule the creation of periodic active full or synthetic full backups. This will help you avoid long chains of increments, ensure safety of backup data, and allow you to meet the requirements of your retention policy. Below are animated examples of these things.
 

 


 



 
Within this animation the lettered squares represent blocks on a disk.
 
For more information please review the follow portions of the Help Center:
https://helpcenter.veeam.com/docs/backup/vsphere/incremental_forever_backup.html?ver=95
https://helpcenter.veeam.com/docs/backup/vsphere/retention_forever_incremental.html?ver=95
https://helpcenter.veeam.com/docs/backup/vsphere/forward_incremental_backup.html?ver=95
https://helpcenter.veeam.com/docs/backup/vsphere/retention_incremental.html?ver=95
https://helpcenter.veeam.com/docs/backup/vsphere/active_full_backup.html?ver=95
https://helpcenter.veeam.com/docs/backup/vsphere/synthetic_full_backup.html?ver=95
https://helpcenter.veeam.com/docs/backup/vsphere/backup_copy_remove_missing_point.html?ver=95