What happen when Veeam Backup & Replication is not able to interact with your hypervisor to run backup job? The answer is easy: fails. The Integration Services allows some applications to create a channel between host and guest VM; Veeam use this integration to run Guest File Indexing but also, the most important, Application-Aware Processing.
Application-aware processing is the Veeam technology based on Microsoft Volume Shadow Copy Service (VSS). This process is critical to create transactionally consistent backups or replicas of VMs that run Active Directory, SQL Server, SharePoint Server, Exchange Server or Oracle. VSS writer is responsible for quiescing applications on the VM and creating a consistent view of application data on the VM guest OS, this means flush logs and make “secure” the backup.
Cannot do HvPrepareSnapshot
In my case, I found a strange behavior with some virtual machines of the same job not protected in a right way.
The message detail is:
Unable to subscribe to guest processing components: Cannot do HvPrepareSnapshot. Error: Failed to reinstall VSS integration service to isolate svchost.
Failed to create veeam svhost group in regestry.
Cannot open registry key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Win32 error:Access is denied.
Code: 5
There are a lot of articles about this issue but this scenario the reason is a little bit complicated and probably atypical. Why some VM works fine and others didn’t? So I compared the two VMs to understand what happened into the registry key and I found the solution! The good one have some users into Security area of key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
But all the issued virtual machines have a different security settings.
I don’t know why this happened because the procedure to create the VMs were always the same and the hypervisor is the same for everyone….but….this is the situation.
Fix the Issue
To resolve this issue is necessary:
- Run the registry as administrator, of each virtual machine
- Go to key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
- Open the Security Proprieties
- Change the Owner from SYSTEM to your administrator account (Domain Admin)
Is very important check the option Replace owner on subcontainers and objects because into Svchost there many sub-key that must be fixed.
Apply the changes, without close the window, and Enable inheritance without forget Replace all child object permission entries with inheritable permission entries from this object – this will replace all the permission in each sub-key.
The last step, very important, is change again the Owner of Svchost folder from domain account to SYSTEM.
Without restart the VM, I ran the backup job and the result is perfect!
Conclusions
In the majority of cases, the issue about HvPrepareSnapshot could be generated by not updated hypervisor, not updated Veeam B&R Engine or because the Integration Services are not enabled. The hard troubleshooting is always the only way to find the solution!
#DBS