| KB ID: | 4186 |
| Product: | Veeam Agent for Microsoft Windows 5.0 |
Challenge
Veeam Agent fails to run auto-update and download the latest version on the following operating systems:
- Microsoft Windows 7 SP1
- Microsoft Windows Server 2008 R2 SP1
- Microsoft Windows Server 2012
Cause
Solution
TLS 1.2 must be enabled in the aforementioned operating systems according to Microsoft recommendations.
Semi-Automated Solution
- Ensure the OS is running on the latest updates and at least KB3140245 is installed.
- Apply the registry settings using a hotfix installer EasyFix 51044
- Restart the machine
Manual Solution
Manually create the following registry value(s):
Key Location1: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp
Value Name: DefaultSecureProtocols
Value Type: DWORD (32-bit) Value
Value Data (Hex)2: 0x00000A00
1On x64-based computers, DefaultSecureProtocols must also be added to the Wow6432Node path: HLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp
2Value Data options:
0x00000800for TLS 1.2 only0x00000A00for TLS 1.1 and 1.2
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp" -Name 'DefaultSecureProtocols' -PropertyType DWORD -Value 0x00000A00
New-ItemProperty -Path "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp" -Name 'DefaultSecureProtocols' -PropertyType DWORD -Value 0x00000A00
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" -Name 'SecureProtocols' -PropertyType DWORD -Value 0xA80
New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" -Name 'SecureProtocols' -PropertyType DWORD -Value 0xA80For Microsoft Windows 7, an additional step is required
For TLS 1.2 to be enabled and negotiated on Windows 7, the "DisabledByDefault" entry in the appropriate subkey (Client) must be created and set to "0". These subkeys will not be created in the registry since these protocols are disabled by default.
Key Location: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client
Value Name: DisabledByDefault
Value Type: DWORD (32-bit) Value
Value Data: 0