Operational Defect Database

BugZero found this defect 349 days ago.

Veeam | kb4456

WDAC Supplemental Policy for Veeam Backup & Replication Components on Azure Stack HCI

Last update date:


Affected products:

Veeam Backup & Replication

Affected releases:


Fixed releases:

No fixed releases provided.



When attempting to add an Azure Stack HCI OS cluster or node to Veeam Backup & Replication, the following error occurs: Your organization used Device Guard to block this app. Contact your support person for more info. Failed to start service 'VeeamDeploySvc'. Host: 'x.x.x.x'. Failed to start deployment service on the target host


By default, Azure Stack HCI OS 23H2 and newer has Windows Defender Application Control (WDAC) enabled and running in the enforcement mode. WDAC is a software-based security layer that reduces the attack surface by enforcing an explicit list of software that is allowed to run. WDAC limits the applications and the code that can run on the core platform. To allow third-party non-Microsoft signed software to run on Azure Stack HCI nodes, a WDAC supplemental policy provided by the third-party software vendor must be installed.


Veeam Backup & Replication WDAC Supplemental Policy Deployment Download the Policy XML Package from the Download Information section below. Copy the policy xml file to a location on the CSV shared by the nodes. Deploy the policy using Add-ASWDACSupplementalPolicy cmdlet. This can also be done using the latest version of Windows Admin Center.

Download Information

Download Policy XML Filename: KB4456-VBR-AZHCI-supplemental-policy- Updated: 2024-04-01 MD5: 109B177950F2BEFD6756AF4B129DD521 SHA1: CFA3998AC8BD8A031E6E5CABA87B50BA1AEACD1B

More Information

Windows Defender Application Control for Azure Stack HCI (preview) Manage Windows Defender Application Control for Azure Stack HCI, version 23H2 KB4047: Veeam Support for Azure Stack HCI

Additional Resources / Links


BugZero® Risk Score

What's this?

Coming soon



Learn More