Avamar: Exchange VSS plug-in - DAG backup failing due to PowerShell errors

Summary: Knowledge base (KB) that provides workarounds for Exchange DAG backup failures due to PowerShell errors.

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

Exchange backups may fail with the following errors:

2014-01-15 11:39:59 avexvss Info <18202>: The Powershell interface already has required permissions.  Will not impersonate with provided credentials.
2014-01-15 11:43:10 avexvss Error <0000>: Error [EXMB1.EMC.com] Connecting to remote server failed with the following error message : The WinRM client cannot complete the operation within the time specified. Check if the machine name is valid and is reachable over the network and firewall exception for Windows Remote Management service is enabled. For more information, see the about_Remote_Troubleshooting Help topic.
2014-01-15 11:43:10 avexvss Error <16954>: Unable to initialize Powershell interface process -- cannot continue.
2014-01-15 11:43:10 avexvss Error <13077>: Unable to complete backup.
  
2014/01/28-23:55:22.12100 [avexvss_snapup_assist]  Failed to initialize PowerShell interface using method 1; unable to launch process- return code: 1314
2014/01/28-23:55:22.12100 [avexvss_snapup_assist]  Attempting impersonation using CreateProcessWithLogonW
2014/01/28-23:55:22.12100 [avexvss_snapup_assist]  Failed to initialize PowerShell interface using method 2; unable to launch process as new user - return code: 1058
2014-01-28 15:55:22 avexvss Error <0000>: Unable to initialize PowerShell interface, verify the user name and password.
2014-01-28 15:55:22 avexvss Error <16957>: Powershell interface unable to logon as new user -- cannot continue.
Other variations may include the following: 
avexvss Error <0000>: Error [emcmbx01.avamar.com] Connecting to remote server failed with the following error message : The WinRM client sent a request to an HTTP server and got a response saying the requested HTTP URL was not available. This is usually returned by a HTTP server that does not support the WS-Management protocol. For more information, see the about_Remote_Troubleshooting Help topic. 
avexvss Error <16954>: Unable to initialize Powershell interface process -- cannot continue.  
...
avexvss Error <0000>: Error [emcmbx01.avamar.com]  Connecting to remote server failed with the following error message : The WinRM client cannot process the request. It cannot determine the content type of the HTTP response from the destination computer. The  content type is absent or invalid. For more information, see the about_Remote_Troubleshooting Help topic.

Cause

Internet Information Services (IIS) might be in a bad state if the Exchange client has not been rebooted in a long time.

For federated Exchange DAG backups, firewalls might be blocking PowerShell remote access between DAG members.

 

Resolution

Follow the solutions below to resolve this issue:
1. Restart IIS.
2. Verify that the username and password specified in the Exchange dataset is correct.
3. Check to see if PowerShell remote access is disabled and try to enable it using the following PowerShell command: 
Enable-PSremoting -force

4. Enable Windows Remote Management service by typing the following PowerShell command: 
winrm quickconfig 
5. If the backup is still failing, or gets the error message "Powershell interface unable to logon as new user," do the following to enable additional debugging:
a. In the bin directory where ps_exec.exe resides create a text file called "ps_exec.cmd."   Confirm it is created as a ".cmd" and not ".txt" file extension.
b. Edit ps_exec.cmd; add this line: 
--debug
c. Run the Exchange DAG test backup again (with the "AvamarBackupUser" credentials entered into the dataset) and a new log file is created called "ps_exec.log."  This log helps to identify any additional security permissions that may be needed for the "AvamarBackupUser" account.

Log in to each of the Exchange clients as "AvamarBackupUser" account, open the Exchange Management Shell and verify Powershell functionality with commands like:
  
get-mailboxdatabase

Alternatively, reconfigure the Avamar cluster agent services (federated Exchange DAG) as follows:

1. Start Failover Cluster Manager tool.
2. Stop "DELL Avamar backup cluster client for <DAG_NAME>."
3. Open Services and find "DELL Avamar Backup Agent for <DAG_NAME>."
4. If this service is started, stop it.
5. Under properties, select "Log On" tab. In this tab, select option "This account" and enter credentials for "AvamarBackupUser" account.
6. Select Apply and OK.
7. Repeat steps 3 - 6 on each DAG node.
8. Open Failover Cluster Manager and start "DELL Avamar backup cluster client for <DAG_NAME>."
 
Doing so, all DAG nodes are started with the same "AvamarBackupUser" account for both "Backup Agent" and "DELL Avamar Backup Agent for <dagname> services."  
 
In the dataset for the DAG client, leave the "AvamarBackupUser" credential fields blank, as the above-mentioned procedures negate the need for inputting those credentials.**

*If all the above workarounds fail, then the Exchange Management PowerShell or IIS is either misconfigured or incomplete. Microsoft support should be engaged in order to troubleshoot, reconfigure, or reinstall the necessary components.

Extra troubleshooting steps:

It is a Microsoft setup issue if it is not able to initialize the PowerShell and connect to the server. There are multiple reasons for this problem.

From Microsoft docs: "PowerShell remoting is enabled by default on Windows Server platforms. You can use Enable-PSRemoting to enable PowerShell remoting on *other supported versions of Windows and to reenable remoting if it becomes disabled. Run this command only one time on each server that receives commands."
* Group policy can override this.

Also, from a Microsoft article: "By default, all users can use the remote PowerShell function. Even so, the user has to be a member of a management role in AD."
*It has been disabled or restricted by group policy.

If you have a working exchange server and a problematic server, use the "systeminfo" command in the PowerShell to compare patch levels.


1. Check in the IIS Manager whether the correct or valid SSL certificate is assigned to the "Default Web Site" and the "Exchange Back End." Both sites can be found under "Bindings" -> HTTPS. Remove the checkmark from "SSL required" in the "SSL settings" on the Powershell website under "Exchange Back End." This ignores the SSL certificate, and tests whether the Powershell connection is working. 2. Run the command sin Powershell with administrator privilege and share the result:
  
IISRESET
winrm quickconfig

3. Uninstall the Windows update KB3134758 - 4. Check and install Windows feature "Windows PowerShell 2.0 Engine" - ​​​​​​ 5. Test PowerShell connectivity using the following command.
  
new-pssession -Authentication "kerberos" -ConfigurationName "Microsoft.Exchange" -Credential "domain\avamarbackupuser"  -ConnectionURI http://ex21.example.com/PowerShell
For help, see the below link.
Microsoft support should be engaged in order to troubleshoot, reconfigure, or reinstall the necessary components.

Additional Information

For federated backups using Avamar Exchange DAG client, the"AvamarBackupUser" credential fields can be left blank in the dataset. These credentials must only be specified in the dataset in the following situations:
 
  1. The "AvamarBackupUser" account has not been created or configured for the "Backup Agent" service account on the client.
  2. Federated backups using Exchange DAG client name

The "AvamarBackupUser" account must be created using the "AvamarBackupUser" configuration tool or following the Avamar Exchange client guide.
 

Affected Products

Avamar, Avamar Plug-in for Exchange VSS
Article Properties
Article Number: 000051325
Article Type: Solution
Last Modified: 25 Sept 2025
Version:  4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.