Application-Aware Processing Tasks Fail in a Kerberos-Only Environment After Upgrading to Veeam Backup & Replication 12
Challenge
If you use persistent agents for guest OS processing in a Kerberos-only environment, after upgrading to Veeam Backup & Replication 12, some backup jobs may fail with the error:
Failed to connect to guest agent, failing over to guest agent through VIX Failed to connect to guest agent though VIX, failing over to guest runtime components
This issue may affect the following jobs types:
- Virtual machine backup jobs
- Replication jobs
- Microsoft SQL log backup jobs
- Oracle archived log backup jobs
Cause
After upgrading to Veeam Backup & Replication 12, the Veeam Backup Server attempts to connect to the Veeam Installer Service and Veeam Guest Helper Service within the Guest OS of the machines using persistent agents and fails. The authentication fails because those services do not have SPNs registered with the Active Directory in the required format.
For Kerberos authentication, each Veeam Backup & Replication services must have two SPNs registered with the Active Directory in the following formats:
- {ServiceName}/{FQDN}
Example: VeeamBackupSvc/vbrserver01.tech.local - {ServiceName}/{NetBIOSName}
Example: VeeamBackupSvc/VBRSERVER01
Solution
To resolve the issue, perform the following steps:
- Register new SPNs for Veeam Installer Service and Veeam Guest Helper Service and map them to the Active Directory computer objects of backed-up or replicated servers:
- VeeamDeploySvc/{FQDN}
- VeeamDeploySvc/{NetBIOSName}
- VeeamGuestHelperSvc/{FQDN}
- VeeamGuestHelperSvc/{NetBIOSName}
- Wait until the Active Directory replication applies changes.
You can also force replication if needed.
Registering SPNs
Using setspn.exe
You can register SPNs using the setspn.exe utility, for example:
Setspn.exe -S VeeamDeploySvc/server01.domain.local server01 Checking domain DC=domain,DC=local Registering ServicePrincipalNames for CN=server01,OU=Servers,DC=domain,DC=local VeeamDeploySvc/server01.domain.local Updated object
Using PowerShell
You can also use a PowerShell script to register SPNs for several computer accounts.
The attached archive contains the following files:
- RegisterVBRGuestAgentComponentsSPNs.ps1 — a script with the PowerShell module
- Example.ps1 — an example of using the PowerShell module
- ComputersListExample.txt — an example of the computer account list
You will also need the Active Directory module installed on your machine. For more information, see this Microsoft article.
Purging Negative SPN Cache
After registering new SPNs, you may still get authentication errors for up to 15 minutes because the negative SPN cache on the backup server, guest interaction proxies, and log shipping servers contains old SPNs. You can wait for some time or purge the cache using the following command:
More Information
- Veeam Backup & Replication User Guide: Kerberos Authentication for Guest OS Processing
- Veeam Backup & Replication User Guide: Persistent agent components
- Veeam Backup & Replication User Guide: Microsoft SQL Server Log Backup
- Veeam Backup & Replication User Guide: Oracle Log Backup
- Microsoft Documentation: Adding SPNs with Setspn.exe
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
Spelling error in text
Thank you!
Your feedback has been received and will be reviewed.
KB Feedback/Suggestion
This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
Thank you!
Your feedback has been received and will be reviewed.