Access to the Veeam\backup path denied after v11 Veeam update about advanced-prtg-sensors HOT 37 CLOSED

So an update from me.
When testing on the probe with powershell and running the script directly, all results were fine from any way we tested.
But as soon as the Probe sensor was trying to run it, we'd get the above failures.

To workaround this that we found worked was having the Sensor configured to run a separate PS1 file that invokes the PRTG sensor script.

Sensor settings: Psx64.exe
Params: -f="C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\RunVeeamScript.ps1"

Create .PS1 file called RunVeeamScript.ps1 with the following code:

Invoke-Command -ComputerName <VeeamServer> -FilePath "C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\VeeamAdvancedPRTG.ps1"

from advanced-prtg-sensors.

Hi,
Another user (Till) reported this on my blog:
https://mycloudrevolution.com/en/2020/01/27/prtg-veeam-sensor-retrospective/

I was need able to reproduce that and need a few more Details about your environment:

• have you installed the vbr console on the probe or are you using PS remote?
• which OS are you using?
• have you upgraded the console after vbr upgrade?
• have you tried to execute the script manually in the PowerShell?

Best wishes
Markus

from advanced-prtg-sensors.

Hi Markus thanks for the reply,

• have you installed the vbr console on the probe or are you using PS remote? | VBR Console is on the probe.
• which OS are you using? | 2012 R2 Standard
• have you upgraded the console after vbr upgrade? | Yes both are on V11.0.0.837
• have you tried to execute the script manually in the PowerShell? | Manually running the script shows no error.

from advanced-prtg-sensors.

Hello,

I assume the issue #77 has the same root cause.

from advanced-prtg-sensors.

What are the local permissions of the user the probe uses to call the script?

from advanced-prtg-sensors.

Hi guys, same problem here, I've read all #77 #78 and this.
Below my setup:

have you installed the vbr console on the probe or are you using PS remote? | VBR Console is on the probe.
which OS are you using? | 2019 Datacenter
have you upgraded the console after vbr upgrade? | Yes both are on V11.0.0.837
have you tried to execute the script manually in the PowerShell? | Manually running the script shows no error.

from advanced-prtg-sensors.

Duplicate of #77

from advanced-prtg-sensors.

This is a really strange issue. I am not able to reproduce that.

@cipo80 which permisses has the user on the local system which the PRTG Probe uses to run the sensor?

from advanced-prtg-sensors.

Hi All,

in my case the user has local administrative rights, and with the veeam console (installed on the probe server) I can login with my user an see the backups...

seems, that everything is OK.
In the past sometimes I have to correct the permission in the regedit (HKLM\SOFTWARE\Veeam\Veeam Backup and Replication)
But that is also fine in my environment

from advanced-prtg-sensors.

This is a really strange issue. I am not able to reproduce that.

@cipo80 which permisses has the user on the local system which the PRTG Probe uses to run the sensor?

Hi @vMarkusK , thank you for the reply,

the user has local administrative rights, like @carsten0407 I can correctly login by console installed on the probe server.
I'm using the full path of the .dll and I've also try to remove/reinstall the console.

from advanced-prtg-sensors.

I have already talked to prtgtools (vendor of PSx64) to make sure they do not use any special parameters - they do not.

Have you guys enabled UAC?

from advanced-prtg-sensors.

from advanced-prtg-sensors.

I have already talked to prtgtools (vendor of PSx64) to make sure they do not use any special parameters - they do not.

Have you guys enabled UAC?

Just check, UAC is off

from advanced-prtg-sensors.

Hi @carsten0407 , in my case both working (psx64 and without it) by PS and both aren't working by PRTG.
Without psx64 is it a XML Custom EXE/Script Sensor standard without parameter, right?

from advanced-prtg-sensors.

from advanced-prtg-sensors.

from advanced-prtg-sensors.

Carsten Trautmann

Same output by PRTG:

Disconnect-VBRServer : Access to the path 'Veeam\Backup' is denied.
At C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\PRTG-VeeamBRStats.ps1:77 char:5

• Disconnect-VBRServer -ErrorAction SilentlyContinue
  

• ~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], UnauthorizedAccessException
  • FullyQualifiedErrorId : System.UnauthorizedAccessException

from advanced-prtg-sensors.

from advanced-prtg-sensors.

Hey,

I've got the same error after the update to v11:

PS C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML> .\PSx64.exe -f="veeam_new.ps1" -p="server.local" -raw
0

XML: Das zurückgelieferte XML entspricht nicht dem erwarteten Schema. (Code: PE233) -- JSON: Das zurückgelieferte JSON entspricht nicht der erwarteten Struktur (Invalid JSON.). (Code: PE231)

I also tried the latest version 2.0.1 of the script and updated PRTG to the latest stable build.

from advanced-prtg-sensors.

Might you please add a new Sensor to PRTG, similar to the Original one (enable log) but use this Diagnostic Script instead:
https://github.com/vMarkusK/Advanced-PRTG-Sensors/blob/master/Veeam/PRTG-VeeamBRStats-Diag.ps1

Please share the Log (Default Path: C:\ProgramData\Paessler\PRTG Network Monitor\Logs\sensors) returned after the Sensor is executed. Example:

C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\PRTG-VeeamBRStats.-Diag.ps1 : Execution environment 
cannot be initialized to Remote
At line:1 char:1
+ &'C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\P ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,PRTG-VeeamBRStats.-Diag.ps1
 
C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\PRTG-VeeamBRStats.-Diag.ps1 : at <ScriptBlock>, 
C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\PRTG-VeeamBRStats.-Diag.ps1: line 48
at <ScriptBlock>, <No file>: line 1
At line:1 char:1
+ &'C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\P ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,PRTG-VeeamBRStats.-Diag.ps1
 
Failed to Connect
<prtg>
 <error>1</error>
 <text>User 'WIN-RT26QHK0M11$' /  Error::  Execution environment cannot be initialized to Remote</text>
</prtg>

from advanced-prtg-sensors.

Might you please add a new Sensor to PRTG, similar to the Original one (enable log) but use this Diagnostic Script instead:
https://github.com/vMarkusK/Advanced-PRTG-Sensors/blob/master/Veeam/PRTG-VeeamBRStats-Diag.ps1

Please share the Log (Default Path: C:\ProgramData\Paessler\PRTG Network Monitor\Logs\sensors) returned after the Sensor is executed. Example:

C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\PRTG-VeeamBRStats.-Diag.ps1 : Execution environment 
cannot be initialized to Remote
At line:1 char:1
+ &'C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\P ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,PRTG-VeeamBRStats.-Diag.ps1
 
C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\PRTG-VeeamBRStats.-Diag.ps1 : at <ScriptBlock>, 
C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\PRTG-VeeamBRStats.-Diag.ps1: line 48
at <ScriptBlock>, <No file>: line 1
At line:1 char:1
+ &'C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\P ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,PRTG-VeeamBRStats.-Diag.ps1
 
Failed to Connect
<prtg>
 <error>1</error>
 <text>User 'WIN-RT26QHK0M11$' /  Error::  Execution environment cannot be initialized to Remote</text>
</prtg>

Here is my log for it

> C:\Program Files (x86)\PRTG Network Monitor\custom 
> sensors\EXEXML\MIFSA-BKP.ps1 : Access to the path 'Veeam\Backup' is denied.
> At line:1 char:1
> + &'C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\M ...
> + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>     + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorExcep 
>    tion
>     + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorExceptio 
>    n,MIFSA-BKP.ps1
>  
> C:\Program Files (x86)\PRTG Network Monitor\custom 
> sensors\EXEXML\MIFSA-BKP.ps1 : at <ScriptBlock>, C:\Program Files (x86)\PRTG 
> Network Monitor\custom sensors\EXEXML\MIFSA-BKP.ps1: line 48
> at <ScriptBlock>, <No file>: line 1
> At line:1 char:1
> + &'C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\M ...
> + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>     + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorExcep 
>    tion
>     + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorExceptio 
>    n,MIFSA-BKP.ps1
>  
> Failed to Connect
> <prtg>
>  <error>1</error>
>  <text>User 'SKY-PRTG$' /  Error::  Access to the path 'Veeam\Backup' is denied.</text>
> </prtg>
> 

from advanced-prtg-sensors.

Hey Markus,

thanks for your fast response. Here is the result:

C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\veeam_diag.ps1 : Execution environment cannot be 
initialized to Remote
In Zeile:1 Zeichen:1
+ &'C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\v ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,veeam_diag.ps1
 
C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\veeam_diag.ps1 : bei <ScriptBlock>, C:\Program Files 
(x86)\PRTG Network Monitor\custom sensors\EXEXML\veeam_diag.ps1: Zeile 48
bei <ScriptBlock>, <Keine Datei>: Zeile 1
In Zeile:1 Zeichen:1
+ &'C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\v ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,veeam_diag.ps1
 
0:

And here the Data:

Data['linuxloginpassword'].asString := '***';
Data['notonpod'].asString := '0';
Data['fastcount'].asString := '0';
Data['lastmsg'].asString := '#Y2 Structural error in xml file, 3 open items. @#O231[Invalid JSON.]';
Data['resultfile'].asString := 'Result of Sensor 6351.txt';
Data['windowsloginusername'].asString := 'username';
Data['hostv6'].asString := '';
Data['exefile'].asString := 'PSx64.exe';
Data['lastuptime'].asString := '0';
Data['writeresult'].asString := '1';
Data['blockedsens'].asString := '';
Data['reqmsginterval'].asString := '60';
Data['windowslogindomain'].asString := 'domain.local';
Data['tlsexplicit_imap'].asString := '';
Data['channelnames'].asString := '';
Data['tlsexplicit_default'].asString := '';
Data['canlinux'].asString := '0';
Data['isexesensor'].asString := '1';
Data['windowsloginpassword'].asString := '***';
Data['environment'].asString := '';
Data['mutexname'].asString := '';
Data['channelinfos'].asString := '{}';
Data['uptimecount'].asString := '0';
Data['vmwareparams'].asString := '1';
Data['reboot'].asString := '44279.3297263079';
Data['usednstime'].asString := '0';
Data['newpowershell'].asString := '0';
Data['linuxlogindomain'].asString := '';
Data['tlsexplicit_port'].asString := '';
Data['monitorchange'].asString := '';
Data['inerror'].asString := '1';
Data['sensorid'].asString := '6351';
Data['ipversion'].asString := '0';
Data['tlsexplicit_smtp'].asString := '';
Data['host'].asString := 'hostname.domain.local';
Data['exeparamslist'].asString := '';
Data['usewindowsauthentication'].asString := '0';
Data['simulate'].asString := '0';
Data['tlsexplicit_ftp'].asString := '';
Data['timeout'].asString := '60';
Data['exeparams'].asString := '-f="veeam_diag.ps1" -p="hostname.domain.local"';
Data['momopersistent'].asString := '';
Data['tlsexplicit_pop3'].asString := '';

from advanced-prtg-sensors.

The root cause of this issue (and also #77 ) seems to be a connection issue to the Veeam Server.

• PRTG Uses the Security Context of the Probe Device for the Advanced Sensor
• Security Context is by default "Local System" (In @JasperSnail Case "SKY-PRTG$")
• This Security Context does not have permissions to the Veeam Server (I am wondering that this was the case in v10)

My Recommendation:

• Use a Dedicated Probe for this Sensor
• Start the PRTG Probe Service as an account with access to the Veeam Console

Other Options;

• Place the Computer Account from the remote probe in the local administrators group of the VBR Server (not recommended / Validated)
• Use PS Remote for this sensor

from advanced-prtg-sensors.

The root cause of this issue (and also #77 ) seems to be a connection issue to the Veeam Server.

• PRTG Uses the Security Context of the Probe Device for the Advanced Sensor
• Security Context is by default "Local System" (In @JasperSnail Case "SKY-PRTG$")
• This Security Context does not have permissions to the Veeam Server (I am wondering that this was the case in v10)

My Recommendation:

• Use a Dedicated Probe for this Sensor
• Start the PRTG Probe Service as an account with access to the Veeam Console

Other Options;

• Place the Computer Account from the remote probe in the local administrators group of the VBR Server (not recommended / Validated)
• Use PS Remote for this sensor

Thanks Markus, I will give these a shot

from advanced-prtg-sensors.

Hey Markus,

thanks for analyzing this and this makes sense. We're discussing the options and try your recommendations.

Thank you!

from advanced-prtg-sensors.

@efflicto @JasperSnail great, I am looking forward to your feedback.

And just to complete the analysis. The xml error is based on the strange error message of the Veeam PowerShell Cmdlet, which includes a XML syntax.

from advanced-prtg-sensors.

Hey Markus,

so we sided with the PRTG Remote Probe option. I've installed the probe on the Veeam server and added the sensor to it and it worked fine. The other options, except the PS Remote, weren't an option because of security.

Thank you for your time and help!

from advanced-prtg-sensors.

My Recommendation:

• Start the PRTG Probe Service as an account with access to the Veeam Console

Hello,
i tried that, but without success.

We've a sysaccount, especially for PRTG (sys022). I changed the Probe-Service to run under this account.

Veeam Backup and Replication:

But i get an error:

C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\PRTG-VeeamBRStats.ps1 : Failed to connect to Veeam 
BR Host '-BRHost xxxx.domain.local' with user 'sys022'
In Zeile:1 Zeichen:1
+ &'C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\P ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,PRTG-VeeamBRStats.ps1
 
C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\PRTG-VeeamBRStats.ps1 : bei <ScriptBlock>, 
C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\PRTG-VeeamBRStats.ps1: Zeile 317
bei <ScriptBlock>, <Keine Datei>: Zeile 1
In Zeile:1 Zeichen:1
+ &'C:\Program Files (x86)\PRTG Network Monitor\custom sensors\EXEXML\P ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,PRTG-VeeamBRStats.ps1
 
0:<prtg>  <error>1</error>  <text>Failed to connect to Veeam BR Host '-BRHost xxxx.domain.local' with user 'sys022'</text> </prtg> 

When i try to login with the sys022 account from the probe device, it does work.

Edit: I also tried to put the credentials in cleartext in the script, but doesn't work either ...

    Write-Debug "Connecting new BRHost '$BRHost' with user 'xxx\sys022'..."
    try {
        Connect-VBRServer -Server $BRHost -User "xxx\sys022" -Password "pass" 
    }
    catch {
        Throw "Failed to connect to Veeam BR Host '$BRHost' with user 'xxx\sys022'"
    }

If i run the script from powershell, it does work. But if i try to run it in PRTG, it does not work ...

from advanced-prtg-sensors.

from advanced-prtg-sensors.

@DerKiLLa Is your User "sys022" member of the local administrators on the VBR Server?

from advanced-prtg-sensors.

Hello,
I just want to update you about the current state of the analysis.

I have tested a few Concepts to reproduce this issue:

• Probe on VBR Server (Service as "local System" and "Named User")
• Probe on dedicated Server (Service as "Named User")

As I was not able to reproduce this issue I need more details details to dig deeper:

• OS of VBR Server
• OS of PRTG Probe
• Domain Members?
• Is the Probe installed on VBR or dedicated Server?
• Is probe Server Started as Named user?
• Local permission of the Probe Service user on the Probe?
• Local permission of the Probe Service user on the VBR Server?
• VBR Permissions of the Probe Service User?

from advanced-prtg-sensors.

@efflicto @JasperSnail great, I am looking forward to your feedback.

And just to complete the analysis. The xml error is based on the strange error message of the Veeam PowerShell Cmdlet, which includes a XML syntax.

Hi Markus,

I have set the PRTG Probe service to run as a domain admin service acc, it has access as a Standard user in Veeam BR - now upon trying to run the script I get the following error:
A required privilege is not held by the client. (0x522)

Do you know where I might be missing a permission?

from advanced-prtg-sensors.

from advanced-prtg-sensors.

@DerKiLLa Is your User "sys022" member of the local administrators on the VBR Server?

Yes. But this shouldn't make a difference.

OS of VBR Server Windows Server 2012 Datacenter
OS of PRTG Probe Windows Server 2019
Domain Members? Yes, Windows Domain
Is the Probe installed on VBR or dedicated Server? Dedicated Server
Is probe Server Started as Named user? Yes, sys022
Local permission of the Probe Service user on the Probe? Yes, local admin
Local permission of the Probe Service user on the VBR Server? Yes, local admin
VBR Permissions of the Probe Service User? Veeam Backup Administrator

from advanced-prtg-sensors.

So an update from me.
When testing on the probe with powershell and running the script directly, all results were fine from any way we tested.
But as soon as the Probe sensor was trying to run it, we'd get the above failures.

To workaround this that we found worked was having the Sensor configured to run a separate PS1 file that invokes the PRTG sensor script.

Sensor settings: Psx64.exe
Params: -f="C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\RunVeeamScript.ps1"

Create .PS1 file called RunVeeamScript.ps1 with the following code:

Invoke-Command -ComputerName <VeeamServer> -FilePath "C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\VeeamAdvancedPRTG.ps1"

Thanks for this workaround! Works like a charm! 👍

from advanced-prtg-sensors.

So an update from me.
When testing on the probe with powershell and running the script directly, all results were fine from any way we tested.
But as soon as the Probe sensor was trying to run it, we'd get the above failures.

To workaround this that we found worked was having the Sensor configured to run a separate PS1 file that invokes the PRTG sensor script.

Sensor settings: Psx64.exe
Params: -f="C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\RunVeeamScript.ps1"

Create .PS1 file called RunVeeamScript.ps1 with the following code:

Invoke-Command -ComputerName <VeeamServer> -FilePath "C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\VeeamAdvancedPRTG.ps1"

This work around working also in my enviroment.

Thank you 1k Jasper!!

from advanced-prtg-sensors.

So an update from me.
When testing on the probe with powershell and running the script directly, all results were fine from any way we tested.
But as soon as the Probe sensor was trying to run it, we'd get the above failures.

To workaround this that we found worked was having the Sensor configured to run a separate PS1 file that invokes the PRTG sensor script.

Sensor settings: Psx64.exe
Params: -f="C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\RunVeeamScript.ps1"

Create .PS1 file called RunVeeamScript.ps1 with the following code:

Invoke-Command -ComputerName <VeeamServer> -FilePath "C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\VeeamAdvancedPRTG.ps1"

Works well here too!
Thanks Jasper!!

from advanced-prtg-sensors.