Challenge
When backing up a machine running a Microsoft SQL server where TLS 1.0 has been disabled, a job may fail with the error code 0x80004005 [TLS 1.0].
The following warning will be found on the server that is being protected by either Veeam Backup & Replication or Veeam Agent for Microsoft Windows, the path to the file containing this warning is listed below.
- For a VM being processed by Veeam Backup & Replication:
%ProgramData%\Veeam\Backup\VeeamGuestHelper_<dd.mm.yyyy>.log - For a server being backed up using Veeam Agent for Microsoft Windows:
%ProgramData%\Veeam\Endpoint\<job_name>\Job.Backup.log
INFO Connecting to mssql, connection string: Provider='sqloledb';Data Source='(local)\SQLINSTANCENAME';Integrated Security='SSPI';Persist Security Info=False, timeout: 15
WARN Code = 0x80004005 WARN Code meaning = Unspecified error
WARN Source = Microsoft OLE DB Provider for SQL Server
WARN Description = [DBNETLIB][ConnectionOpen (SECCreateCredentials()).]SSL Security error.
WARN COM error: Code: 0x80004005
Cause
The SQL Server being protected by Veeam is using a SQL OLE DB provider which does not support TLS 1.2
Solution
The direct solution to this situation is to review available updates for the SQL Server that is having this issue and ensure that TLS 1.2 is supported by the Microsoft OLE DB provider for SQL Server.
Please review: https://support.microsoft.com/en-us/help/3135244/tls-1-2-support-for-microsoft-sql-server
As a workaround, it is possible to force Veeam to request that the 'Native SQL Client Provider' be used instead of SQLOLEDB. This is done by adding a registry value to the Guest OS of the machine being protected by Veeam.
Please review the scenarios below and use the location and value specified:
- For a VM being protected by Veeam Backup & Replication:
- Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication
- Value: UseSqlNativeClientProvider
- Type: DWORD
- Data: 1
- For machines being protected (managed or standalone) by Veeam Agent for Microsoft Windows:
- Location: HKLM\SOFTWARE\Veeam\Veeam Endpoint Backup
- Value: UseSqlNativeClientProvider
- Type: DWORD
- Data: 1
- For SQL Failover Clusters protected by Veeam Agent for Microsoft Windows via a job in Veeam Backup & Replication with the option Backup logs periodically an additional value must be specified (the value in HKLM\SOFTWARE\Veeam\Veeam Endpoint Backup also still remains the place).
- Location: HKLM\SOFTWARE\Veeam\Veeam Backup and Replication
- Value: UseSqlNativeClientProvider
- Type: DWORD
- Data: 1
No server restart is required, registry key will be checked on next job run.
More Information
https://support.microsoft.com/en-us/help/3117336/schannel-implementation-of-tls-1-0-in-windows-security-status-update-n
Driver history for Microsoft SQL Server
https://docs.microsoft.com/en-us/sql/connect/connect-history?view=sql-server-ver15