Veeam Recovery Media creating fails with "This access control list is not in canonical form and therefore cannot be modified" error

Veeam Backup & Replication;Veeam Agent for Microsoft Windows
Last Modified:


Creating of Veeam Recovery Media fails with the error:

Collecting recovery media files Details: This access control list is not in canonical form and therefore cannot be modified.

The warning may appear in the following cases:


The error is caused by incorrect Access Control List (ACL) permissions occured in the Microsoft Windows OS.


Each case should be treated individually. Some of registry hives may have incorrect ACL permissions. The root cause of ACL injuries should be investigated deeply.
As a workaround, we recommend you to update the RecoveryImageTempPath registry key in the Veeam Agent computer OS registry.

  1. Run regedit.exe.
  2. Locate the HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Endpoint Backup key.
  3. Create the following value under the key:
    • Name = RecoveryImageTempPath
    • Type = String
    • Value = <path where you'd like to unpack WinRE> (e.x. C:\Temp)
  4. Go to Control Panel > System and Security > Administrative Tools > Services.
  5. Restart the Veeam Agent for Microsoft Windows service.
  6. Create the Veeam Recovery Media again.
The updated registry key value changes the temporary path for the WinRE image unpacking. The registry key does not affect any OS variables or settings.

Rate the quality of this KB article: 
4.1 out of 5 based on 5 ratings

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.

Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Spelling error in text: