1-800-691-1991 | 9am - 8pm ET
EN

"Access is Denied." when using a local account to add Windows machine to Veeam Backup & Replication

KB ID: 4185
Product: Veeam Agent for Microsoft Windows, Veeam Backup & Replication
Published: 2021-06-23
Last Modified: 2021-07-30

Challenge

While attempting to perform one of the following actions the error "Access is Denied." occurs:

add server error
Expand for Full Error Code Text
Error text as shown in GUI:
Access is denied.
--tr:Error code: 0x00000005
--tr:Failed to create persistent connection to ADMIN$ shared folder on host [<servername>].
Failed to install service [VeeamDeploySvc] was not installed on the host [<servername>].
Full error text from log file:
C:\ProgramData\Veeam\Backup\Satellites\VBR\<username>\Satellite_Console.log
Info         [winsrvr] Trying to install Installer service on <servername>:6160.
Info         [RPC] Making sure that the deployment service installed on host [<servername>].
Info         [RPC] Creating persistent connection to ADMIN$ shared folder on host [<servername>].
Warning      [winsrvr] Failed to install Installer service on <servername>:6160. Reason: Access is denied.
Warning      --tr:Error code: 0x00000005
Warning      --tr:Failed to create persistent connection to ADMIN$ shared folder on host [<servername>].
Warning      --tr:Failed to install service [VeeamDeploySvc] was not installed on the host [<servername>].   at VeeamProxyClient.GenerateComException(basic_string<char\,std::char_traits<char>\,std::allocator<char> >* excMsg, Int32 errHrCode)
Warning         at VeeamProxyClient.RegenerateCLRException(exception* excBase)
Warning         at VeeamProxyClient.CCliVeeamDeployer.InstallServiceEx(String svcPath)
Warning         at Veeam.Backup.ProxyProvider.CProxyRawDeployerService.Connect(CCliVeeamDeployer veeamDeployer, String srvName, String connectionPoint, Int32 port, CCredentials creds, Boolean install, WindowsIdentity identityForImpersonationOrNull, Boolean quickFailureMode)
Warning         at Veeam.Backup.ProxyProvider.CProxyRawDeployerService.Connect(String srvName, String[] connectionPoints, CCredentials creds, Int32 configPort, Boolean install, WindowsIdentity identityForImpersonationOrNull, Boolean quickFailureMode, Boolean withoutLogging)
Error        Access is denied.
Error        --tr:Error code: 0x00000005
Error        --tr:Failed to create persistent connection to ADMIN$ shared folder on host [<servername>].
Error        --tr:Failed to install service [VeeamDeploySvc] was not installed on the host [<servername>]. (System.Runtime.InteropServices.COMException)
Rescan error
Expand for Full Error Code Text
Error text as shown in GUI:
Unable to install backup agent: cannot connect to <servername> Error: Access is denied.

When rescanning an individual server within a Protection Group the log file for that action can be found here: C:\ProgramData\Veeam\Backup\Rescan\Rescan_of_<servername>\Job.Rescan_of_<servername>.log

When rescanning an entire Protection Group the log file for that action can be found here: C:\ProgramData\Veeam\Backup\Rescan\Rescan_of_<protection_group>\Job.Rescan_of_<protection_group>.log

Info         [<servername>] Trying to install Installer service on <servername>:11731.
Info         [RPC] Making sure that the deployment service installed on host [<servername>].
Info         [RPC] Creating persistent connection to ADMIN$ shared folder on host [<servername>].
Info         [RPC] Creating persistent connection to ADMIN$ shared folder on host [<servername>]. Failed.
Info         [RPC] Making sure that the deployment service installed on host [<servername>]. Failed.
Warning      [<servername>] Failed to install Installer service on <servername>:11731. Reason: Access is denied.
Warning      --tr:Error code: 0x00000005
Warning      --tr:Failed to create persistent connection to ADMIN$ shared folder on host [<servername>].
Warning      --tr:Failed to install service [VeeamDeploySvc] was not installed on the host [<servername>].   at VeeamProxyClient.GenerateComException(basic_string<char\,std::char_traits<char>\,std::allocator<char> >* excMsg, Int32 errHrCode)
Warning         at VeeamProxyClient.RegenerateCLRException(exception* excBase)
Warning         at VeeamProxyClient.CCliVeeamDeployer.InstallServiceEx(String svcPath)
Warning         at Veeam.Backup.ProxyProvider.CProxyRawDeployerService.Connect(CCliVeeamDeployer veeamDeployer, String srvName, String connectionPoint, Int32 port, CCredentials creds, Boolean install, WindowsIdentity identityForImpersonationOrNull, de)
Warning         at Veeam.Backup.ProxyProvider.CProxyRawDeployerService.Connect(String srvName, String[] connectionPoints, CCredentials creds, Int32 configPort, Boolean install, WindowsIdentity identityForImpersonationOrNull, Boolean quickFailureMode, )
Error        Access is denied.
Error        --tr:Error code: 0x00000005
Error        --tr:Failed to create persistent connection to ADMIN$ shared folder on host [<servername>].
Error        --tr:Failed to install service [VeeamDeploySvc] was not installed on the host [<servername>]. (System.Runtime.InteropServices.COMException)
Error           at VeeamProxyClient.GenerateComException(basic_string<char\,std::char_traits<char>\,std::allocator<char> >* excMsg, Int32 errHrCode)
Error           at VeeamProxyClient.RegenerateCLRException(exception* excBase)

Cause

When a Windows Server is added as a Managed Server or added to a Protection Group, Veeam Backup & Replication checks if the Veeam Installer Service (VeeamDeploySvc) is present on the server. If the service is not accessible Veeam Backup & Replication will attempt to connect to the machine via the admin$ share to deploy the service. 

Example: \\localhost\admin$

The "Access is Denied" error occurs because the user account specified is a local account, and UAC restricts remote access for local accounts.

 

If this error is encountered while using a Domain account that is a member of the Local Administrators group on the remote Windows machine, please create a Veeam Support case mentioning this article.

Solution

For Veeam Backup & Replication to add a remote Windows machine as a managed server or as part of a Protection Group, the user account used to connect to that remote machine must work with the UAC remote restrictions. The account must be either:

  • A domain account that is a member of the Local Administrators group.
  • The built-in account named Administrator.

 

Use Case Examples:

  • If the Windows machine being added to Veeam Backup & Replication is joined to a domain, a domain account that is a member of the Local Administrators group on the remote machine should be used to add the server to Veeam Backup & Replication.

  • If the Windows server being added to Veeam Backup & Replication is not joined to a domain, or there is a need to avoid using a domain account, the built-in account named Administrator must be used to add the server to Veeam Backup & Replication. Other local accounts will be restricted by UAC, even if they are members of the Administrators group.

    Note: If the Administrator account has been renamed, it can be used as the unique SID that bypasses Remote UAC Restrictions is still valid.

  • If the Windows machine being added to Veeam Backup & Replication is not joined to a domain and is not a server OS, the built-in Administrator account will have to be enabled and a password set for it. Then, that account should be used to add the machine to Veeam Backup & Replication.

More information

If none of the provided solutions are viable, it is possible to disable UAC remote restrictions. This will allow local accounts other than Administrator to be used for remote access. This option should be considered a last resort as it involves disabling a Microsoft Windows OS security feature.
KB ID: 4185
Product: Veeam Agent for Microsoft Windows, Veeam Backup & Replication
Published: 2021-06-23
Last Modified: 2021-07-30

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.
Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Spelling error in text

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Your report was sent to the responsible team. Our representative will contact you by email you provided.
We're working on it please try again later
Knowledge base content request
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Policy.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Thank you for your interest in Veeam products!
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend

ty icon

Thank you!

We have received your request and our team will reach out to you shortly.

OK

error icon

Oops! Something went wrong.

Please go back try again later.