Application-Aware Processing Tasks Fail in a Kerberos-Only Environment After Upgrading to Veeam Backup & Replication 12
| KB ID: | 4393 |
| Product: | Veeam Backup & Replication | 12 |
| Published: | 2023-01-30 |
| Last Modified: | 2026-11-04 |
Oops! Something went wrong.
Please, try again later.
Challenge
If you use persistent agents for guest OS processing in a Kerberos-only environment, after upgrading to Veeam Backup & Replication 12, some backup jobs may fail with the error:
Failed to connect to guest agent, failing over to guest agent through VIX Failed to connect to guest agent though VIX, failing over to guest runtime components
This issue may affect the following jobs types:
- Virtual machine backup jobs
- Replication jobs
- Microsoft SQL log backup jobs
- Oracle archived log backup jobs
Cause
After upgrading to Veeam Backup & Replication 12, the Veeam Backup Server attempts to connect to the Veeam Installer Service and Veeam Guest Helper Service within the Guest OS of the machines using persistent agents and fails. The authentication fails because those services do not have SPNs registered with the Active Directory in the required format.
For Kerberos authentication, each Veeam Backup & Replication services must have two SPNs registered with the Active Directory in the following formats:
- {ServiceName}/{FQDN}
Example: VeeamBackupSvc/vbrserver01.tech.local - {ServiceName}/{NetBIOSName}
Example: VeeamBackupSvc/VBRSERVER01
Solution
To resolve the issue, perform the following steps:
- Register new SPNs for Veeam Installer Service and Veeam Guest Helper Service and map them to the Active Directory computer objects of backed-up or replicated servers:
- VeeamDeploySvc/{FQDN}
- VeeamDeploySvc/{NetBIOSName}
- VeeamGuestHelperSvc/{FQDN}
- VeeamGuestHelperSvc/{NetBIOSName}
- Wait until the Active Directory replication applies changes.
You can also force replication if needed.
Registering SPNs
You can register SPNs using the setspn.exe utility, for example:
Setspn.exe -S VeeamDeploySvc/server01.domain.local server01 Checking domain DC=domain,DC=local Registering ServicePrincipalNames for CN=server01,OU=Servers,DC=domain,DC=local VeeamDeploySvc/server01.domain.local Updated object
Purging Negative SPN Cache
After registering new SPNs, you may still get authentication errors for up to 15 minutes because the negative SPN cache on the backup server, guest interaction proxies, and log shipping servers contains old SPNs. You can wait for some time or purge the cache using the following command:
More Information
- Veeam Backup & Replication User Guide: Kerberos Authentication for Guest OS Processing
- Veeam Backup & Replication User Guide: Persistent agent components
- Veeam Backup & Replication User Guide: Microsoft SQL Server Log Backup
- Veeam Backup & Replication User Guide: Oracle Log Backup
- Microsoft Documentation: Adding SPNs with Setspn.exe
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
