VSS does not work on SMB shares

Challenge

A NAS backup/file to tape job skips VSS snapshot creation on SMB share and ends with the following message in the log:
Failed to create a VSS snapshot for %hostname%, failing over to backup directly from the share.

Solution

To support the new VSS for SMB File Shares feature, make sure that the following requirements are met:

• Application server and file server run Windows Server 2012.
• Application server and file server are domain joined to the same Active Directory domain.
• The “File Server VSS Agent Service” role service is enabled on the file server.
• The backup agent runs in a security context that has backup operators or administrator privileges on both the application server and file server.
• The backup agent/application runs in a security context that has at least the READ permission on the file share data that is being backed up.
• Veeam Backup Proxy server should resolve both hostname and IP address of the server hosting the file share.

For more information on the VSS for SMB File Shares feature, see the following Microsoft page:
https://docs.microsoft.com/en-us/archive/blogs/clausjor/vss-for-smb-file-shares

"File Server VSS Agent Service" role service installation and configuration

Do the following, with administrative privileges, to install the File Server role and the File Server Shadow Copy Agent role service on each file server:

GUI:

1. In the Server Manager Dashboard, click Add roles and features.
2. In the Add Roles and Features Wizard, do the following:

PowerShell

1. Start elevated Windows PowerShell (Run as Administrator).
2. Run the following command:

Add-WindowsFeature -Name File-Services,FS-VSS-Agent

Add backup user to Backup Operators local group on file server

The user context in which the shadow copy is performed must have the backup privilege on the remote file server(s) that is part of the shadow copy set.
Usually, this is done by adding the user that is performing the shadow copy to the Backup Operators group on the file server(s).
To add a user to the local Backup Operators group, do the following with administrative privileges on each file server:

GUI

1. In the Server Manager Dashboard, click Tools and select Computer Management.
2. In Computer Management: PowerShell

1. Start elevated Windows PowerShell (Run as Administrator)
2. Run the following commands, adjusting the user account and file server name to your environment:

$objUser = [ADSI]("WinNT://domain/user")
$objGroup = [ADSI]("WinNT://fileserv/Backup Operators")
$objGroup.PSBase.Invoke("Add",$objUser.PSBase.Path)