PowerProtect: Windows FLR Browse fails to access some Files with 400 Access denied error
Summary: When doing an FLR on Windows, the backups mounts without issues but when browsing the directories, some or all directories fail to be opened and browsed due to the 400: Access denied error. The user used to mount the backup can access these files and has permissions on the original VM for these folders. They can access these files from the mount point with the same user. ...
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
When Browsing Windows files on the FLR Wizard, an error occurs when attempting to access certain folders to browse into them:
When accessing the below mount point on the Target VM with the Mount User (either AD user or Local Administrator).
Error: 400: failed to update FLR session. Could not get directory contents. Unable to retrieve file list from 'VM Name' (VM IS) path 'FolderPath' offset 0. Unable to perform FLR operation "browse_files" on VM 'FSSRV' (vm-1031). Cannot stat 'C:\Program Files (x86)\EMC\vProxy FLR Agent\flr\mountpoints\FLRxxxxxxx\File_Path'. Create file C:\Program Files (x86)\EMC\vProxy FLR Agent\flr\mountpoints\FLR25469754941\xxxxxxx\File_Path: Access is denied
When accessing the below mount point on the Target VM with the Mount User (either AD user or Local Administrator).
'C:\Program Files (x86)\EMC\vProxy FLR Agent\flr\mountpoints\FLRxxxxxxx\File_Path'Then it will be possible to view and go through these folders without any issues.
Cause
The Original Path or Directories do not have permissions for the SYSTEM user to access these paths, which caused this issue as it is the Target VM's SYSTEM user that is used to browse the directories, not the user used to mount the FLR to the target VM.
Microsoft also recommends that the SYSTEM user is not removed from Folders or Directories:
The SYSTEM account's permissions can be removed from a file, but we do not recommend removing them.
https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
Microsoft also recommends that the SYSTEM user is not removed from Folders or Directories:
The SYSTEM account's permissions can be removed from a file, but we do not recommend removing them.
https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
Resolution
Add the SYSTEM user to the Windows OS Directories and paths on the Original host, take a fresh backup after adding this permission and the FLR of all future backups taken after this change was made on the Windows VM host will be successful for the browse operation.
For all older backups taken when these folders and directories cannot be accessed by the SYSTEM user, then the below Work-around must be followed:
PowerProtect Data Manager: How To Perform A File Level Recovery (FLR) when FLR Is Failing or Not Supported By the VM.
NVP vProxy: How To Perform A File Level Recovery When FLR Is Failing or Not Supported By the VM.
OR
Log in to the Target VM after mounting the backup using the FLR UI with the mount user.
Access the mount point directly and transfer the files to the required directory.
After the files have been moved, cancel the FLR process.
Do not change the page on the PowerProtect Data Manager while transferring this information as it causes the FLR to unmount.
From the PowerProtect Data Manager Virtual Machine User Guide:
To browse all the disk drives of a backup copy, the copy should be from a virtual machine that has the following Windows permission settings.
In the Advanced Security Settings for the Local Disk
At each disk drive level for both the SYSTEM and <COMPUTER-NAME>\Administrators Principal:
○ Type: Allow
○ Access: Full Control
○ Applies to: This folder, subfolders, and files
If any of the source files or folders are missing SYSTEM and <COMPUTER-NAME>\Administrators from the path of the backup copy being restored from, the file level restore browse might fail.
There will be an error indicating that access has been denied and the restore operation fails.
For all older backups taken when these folders and directories cannot be accessed by the SYSTEM user, then the below Work-around must be followed:
PowerProtect Data Manager: How To Perform A File Level Recovery (FLR) when FLR Is Failing or Not Supported By the VM.
NVP vProxy: How To Perform A File Level Recovery When FLR Is Failing or Not Supported By the VM.
OR
Log in to the Target VM after mounting the backup using the FLR UI with the mount user.
Access the mount point directly and transfer the files to the required directory.
After the files have been moved, cancel the FLR process.
Do not change the page on the PowerProtect Data Manager while transferring this information as it causes the FLR to unmount.
From the PowerProtect Data Manager Virtual Machine User Guide:
To browse all the disk drives of a backup copy, the copy should be from a virtual machine that has the following Windows permission settings.
In the Advanced Security Settings for the Local Disk
At each disk drive level for both the SYSTEM and <COMPUTER-NAME>\Administrators Principal:
○ Type: Allow
○ Access: Full Control
○ Applies to: This folder, subfolders, and files
If any of the source files or folders are missing SYSTEM and <COMPUTER-NAME>\Administrators from the path of the backup copy being restored from, the file level restore browse might fail.
There will be an error indicating that access has been denied and the restore operation fails.
Article Properties
Article Number: 000224705
Article Type: Solution
Last Modified: 11 Jul 2024
Version: 1
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.