Challenge
If you use persistent agents for guest OS processing in a Kerberos-only environment, after upgrading to Veeam Backup & Replication 12, some backup jobs may fail with the error:
Failed to connect to guest agent, failing over to guest agent through VIX
Failed to connect to guest agent though VIX, failing over to guest runtime components
This issue may affect the following jobs types:
Virtual machine backup jobs
Replication jobs
Microsoft SQL log backup jobs
Oracle archived log backup jobs
Cause
After upgrading to Veeam Backup & Replication 12, the Veeam Backup Server attempts to connect to the Veeam Installer Service and Veeam Guest Helper Service within the Guest OS of the machines using persistent agents and fails. The authentication fails because those services do not have SPNs registered with the Active Directory in the required format.
For Kerberos authentication, each Veeam Backup & Replication services must have two SPNs registered with the Active Directory in the following formats:
{ServiceName}/{FQDN}Example: VeeamBackupSvc/vbrserver01.tech.local
{ServiceName}/{NetBIOSName}Example: VeeamBackupSvc/VBRSERVER01
Solution
To resolve the issue, perform the following steps:
Register new SPNs for Veeam Installer Service and Veeam Guest Helper Service and map them to the Active Directory computer objects of backed-up or replicated servers:
VeeamDeploySvc/{FQDN}
VeeamDeploySvc/{NetBIOSName}
VeeamGuestHelperSvc/{FQDN}
VeeamGuestHelperSvc/{NetBIOSName}
Wait until the Active Directory replication applies changes.You can also force replication if needed.
More Information
Veeam Backup & Replication User Guide: Kerberos Authentication for Guest OS Processing
Veeam Backup & Replication User Guide: Persistent agent components
Veeam Backup & Replication User Guide: Microsoft SQL Server Log Backup
Veeam Backup & Replication User Guide: Oracle Log Backup
Microsoft Documentation: Adding SPNs with Setspn.exe
