TRY NOW
book meeting
BACK TO KB LIST

Veeam Operations Fail When the Backup Server Has Limited Internet Access

KB ID: 4819
Product: Veeam Backup & Replication | 13
Published: 2026-02-24
Last Modified: 2026-05-01
mailbox
Get weekly article updates
By subscribing, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.

Cheers for trusting us with the spot in your mailbox!

Now you’re less likely to miss what’s been brewing in our knowledge base with this weekly digest

error icon

Oops! Something went wrong.

Please, try again later.

Article Applicability
This article addresses an issue that may occur when using a Windows-based deployment of Veeam Backup & Replication v13, where the Veeam Backup Server or other Windows-based component servers are isolated from the internet or subject to significant firewall restrictions.

Challenge

When attempting to perform actions in Veeam Backup & Replication that initiate secure connections, those tasks may fail in environments where the Veeam Backup Server or other Windows-based component servers are either isolated from the internet or subject to significant firewall restrictions to outside servers.

Operations that may be affected include, but are not limited to:

  • Windows Guest File Level Restore (FLR)
    Example: Task fails with "The request has been canceled"
  • Malware Scan Backup Session (which relies on Windows FLR)
  • Veeam Data Cloud Vault connections
    Example: Interaction fails with "Rename folder failed"
  • Adding Hyper-V hosts
  • Connecting the Veeam Backup & Replication Console
Log Example - FLR Restore Failure
Error example in FLR session log: 
Info (3)    Starting oib mount on mount service. Binding: [IpOrDnsName: [localhost], Port: [6170], HostId: [{guid}], IsLinux: [False]]
Error (1)    [SVeeamBackupServiceClient][Veeam.Backup.Interaction.BackupService.FileRestoreManagementServiceProxy]Failed RPC call. Method: FileRestoreManagementService.StartAsync, Request: 6WfCxBGnSPQ, Client: Veeam.Backup.Fex_14968:BackupServiceRpc_HJz3otR3BLg, Correlation: 6WfCxBGnSPQ
Error (1)    Veeam.Backup.Grpc.VeeamGrpcException: The request has been cancelled.
Error (1)     ---> Grpc.Core.RpcException: Status(StatusCode="Cancelled", Detail="", DebugException="System.OperationCanceledException: The operation was canceled.")
Error (1)     ---> System.OperationCanceledException: The operation was canceled.
Error (1)     ---> System.Threading.Tasks.TaskCanceledException: The operation was canceled.
Error (1)     ---> System.TimeoutException: A connection could not be established within the configured ConnectTimeout.

Cause

When a connection is initiated, Veeam Backup & Replication components use certificates to establish gRPC connections over HTTPS. The Windows feature "Automatically update certificates in the Microsoft Root Certificate Program" checks for revoked certificates via an HTTP request to "ctldl.windowsupdate.com" with a 15-second timeout.

Since Veeam's gRPC connection timeout is also 15 seconds, if certificate verification takes too long then the connection fails.

Solution

At this time, two workarounds exist to resolve this issue:

 

Option 1: Update Firewalls or Network Access Policies

Ensure that both the Veeam Backup Server and other Windows-based component servers have access to "ctldl.windowsupdate.com" over port 80. This allows Windows to successfully complete certificate revocation checks

Test-NetConnection -ComputerName ctldl.windowsupdate.com -Port 80
A Windows PowerShell window shows the result of a "Test-NetConnection" command to "ctldl.windowsupdate.com" on port 80. The output confirms a successful connection with "TcpTestSucceeded : True" and displays connection details including remote address, port, and interface.
Example of a successful test.

Option 2: Disable Automatic Certificate Updates

If access to ctldl.windowsupdate.com cannot be granted, the "Automatically update certificates in the Microsoft Root Certificate Program" setting must be disabled in the Group Policy Editor on each affected component server.

  1. Open Group Policy Editor
  2. Navigate to: Computer Configuration > Windows Settings > Security Settings > Public Key Policies
  3. Open the entry for: "Certificate Path Validation Settings"
The Local Group Policy Editor window is open. The navigation tree on the left is expanded to "Computer Configuration" > "Windows Settings" > "Security Settings" > "Public Key Policies." The right pane highlights "Certificate Path Validation Settings."
  1. Switch to the "Network Retrieval" tab.
  2. Enable the option named: "Define these policy settings"
  3. Disable the option named: "Automatically update certificates in the Microsoft Root Certificate Program"
The "Certificate Path Validation Settings Properties" window is open to the "Network Retrieval" tab. The "Define these policy settings" box is checked, while "Automatically update certificates in the Microsoft Root Certificate Program (recommended)" is unchecked. Additional settings for retrieval timeouts and issuer certificate retrieval are visible, with the "OK" button highlighted.
  1. Click OK, and close the Group Policy Editor

More Information

More information about the Windows feature "Automatically update certificates in the Microsoft Root Certificate Program" can be found here:

Microsoft Documentation: Certificates and trust in Windows

If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.

To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Spelling error in text

Thank you!

Thank you!

Your feedback has been received and will be reviewed.

Oops! Something went wrong.

Please, try again later.

You have selected too large block!

Please try select less.

KB Feedback/Suggestion

This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
By submitting, you are agreeing to have your personal information managed in accordance with the terms of Veeam's Privacy Notice.
Verify your email to continue your product download
We've sent a verification code to:
  • Incorrect verification code. Please try again.
An email with a verification code was just sent to
Didn't receive the code? Click to resend in sec
Didn't receive the code? Click to resend
Start using Veeam:
Download the product
&
Activate the license key
Thank you!

Thank you!

Your feedback has been received and will be reviewed.

error icon

Oops! Something went wrong.

Please, try again later.