If you use persistent agents for guest OS processing in a Kerberos-only environment, after upgrading to Veeam Backup & Replication 12, some backup jobs may fail with the error:
Failed to connect to guest agent, failing over to guest agent through VIX Failed to connect to guest agent though VIX, failing over to guest runtime components
This issue may affect the following jobs types:
After upgrading to Veeam Backup & Replication 12, the Veeam Backup Server attempts to connect to the Veeam Installer Service and Veeam Guest Helper Service within the Guest OS of the machines using persistent agents and fails. The authentication fails because those services do not have SPNs registered with the Active Directory in the required format.
For Kerberos authentication, most Veeam Backup & Replication services must have two SPNs registered with the Active Directory in the following formats:
To resolve the issue, perform the following steps:
You can register SPNs using the setspn.exe utility, for example:
Setspn.exe -S VeeamDeploySvc/server01.domain.local server01 Checking domain DC=domain,DC=local Registering ServicePrincipalNames for CN=server01,OU=Servers,DC=domain,DC=local VeeamDeploySvc/server01.domain.local Updated object
You can also use a PowerShell script to register SPNs for several computer accounts.
The attached archive contains the following files:
You will also need the Active Directory module installed on your machine. For more information, see this Microsoft article.
After registering new SPNs, you may still get authentication errors for up to 15 minutes because the negative SPN cache on the backup server, guest interaction proxies, and log shipping servers contains old SPNs. You can wait for some time or purge the cache using the following command:
Klist.exe purge -li 0x3e7
This form is only for KB Feedback/Suggestions, if you need help with the software open a support case