PowerProtect: VM Backup or Restore Fails with DD Error - Insufficient User Access Rights

Whether a backup or restore, TSDM, or VADP, the main failure is returned from PowerProtect DD boost error "[5075] the user has insufficient access rights." This issue can affect not only VM but any Asset type.

The storage unit credentials are correct and matching on both PowerProtect Data Manager and PowerProtect DD.

VM Backup failures

• Error Codes ABV0010 or ABV0040
• Example Job error failures, under Errors->Read More:

TSDM or VADP backup failure on PowerProtect Data Manager server side:

Cannot connect to backup server 'ddve01.amer.lan':  [5075] the user has insufficient access rights

VADP backup failure on VM Direct Engine side:

Backup has FAILED.  Unable to open session to target device "ddve01.amer.lan".  Unable to open DDBoost connection to PowerProtect DD System host "ddve01.amer.lan":  [5075] the user has insufficient access rights

TSDM backup failure on TSDM service side (on ESXI):

Unable to successfully complete SDM Full Sync operation.  The error cannot be retried.  The vCenter task for 'SDM Snapshot Sync Full' completed with state 'error'.  TSDM Error Code: <TargetDataDomainUnreachable>, TSDM Error Message: <Unable to connect to target DataDomain host. Error message: Failed to connect to '192.168.9.106', conn_config_ver='6', err=the user has insufficient access rights>.

VM Restore failures

• Error Codes ARV0019 or ARV0012
• Example Job error failures, under Errors->Read More:

VADP VM Restore as new (no Instant Access):

Session '55d09f33-5212-457b-a092-62479749d7b7' is unsuccessful: Unable to open session to backup path device 'ddve01.amer.lan':  [5075] the user has insufficient access rights

TSDM VM Restore as new (no Instant Access):

Session '14274430-cb74-46e1-b554-9f32a033d622' is unsuccessful: Unable to perform full-restore SDM operation.  The error cannot be retried.  The vCenter task for 'SDM Commit Restore' completed with state 'error'.  TSDM Error Code: <TargetDataDomainUnreachable>, TSDM Error Message: <Unable to connect to target DataDomain host. Error message: Failed to connect to '192.168.9.106', conn_config_ver='6', err=the user has insufficient access rights>.

Error in tsdm.log on ESXI

Log Location: /var/run/log

2025-07-04T13:52:01.474Z In(30) tsdm[2099861]: error TSDM[0x0000000bd7b05700] [sub=DdBoostLogger]: ddBoostLogger.cpp:69 WriteDDBoostLog: [2099861:50863298304] ddp_connect_with_config_internal() failed, Hostname: 192.168.9.106, Err: 5075-DDBOOST Error 1 for lookup /data/col1/ on 192.168.9.106 (nfs: Operation not permitted)
2025-07-04T13:52:01.475Z In(30) tsdm[2099861]: error TSDM[0x0000000bd7b05700] [sub=DdBoostLogger]: ddBoostLogger.cpp:69 WriteDDBoostLog: [2099861:50863298304] ddp_connect_with_config() failed, Hostname: 192.168.9.106, Err: 5075-DDBOOST Error 1 for lookup /data/col1/ on 192.168.9.106 (nfs: Operation not permitted)
2025-07-04T13:52:01.475Z In(30) tsdm[2099861]: error TSDM[0x0000000bd7b05700] [sub=SdmDdLog]: ddBoostFacade.cpp:1338 CreateConnectStatus: {DdBoostFacade SdmOpId=[protectedEntity='503e32bf-fe66-4bb8-9458-4529cd6a3770',cycleSession='1751637121228012',traceId='9602a7797e6b9607;a1ca62527c3d68d9']} Failed to connect to '192.168.9.106', conn_config_ver='6', err=the user has insufficient access rights

Error in on VM Direct Engine 

Log location: On PowerProtect Data Manager: /opt/emc/vproxy/runtime/logs/recycle/vproxyd/<date> | On external VM Direct Engine: /opt/emc/vproxy/runtime/logs/recycle/vrecoverd/<date>

2025-07-04T13:51:08.255Z ERROR:  [bc870f76a749fa13;93a2a1e374948f99] Unable to open session to backup path device 'ddve01.amer.lan':  [5075] the user has insufficient access rights
2025-07-04T13:51:08.255Z INFO:   [bc870f76a749fa13;93a2a1e374948f99] Disconnected from session on vCenter 'vcsa.amer.lan'.
2025-07-04T13:51:08.255Z ERROR:  [bc870f76a749fa13;93a2a1e374948f99] Unable to recover to a new VM. Unable to open session to backup path device 'ddve01.amer.lan':  [5075] the user has insufficient access rights

The failures documented above result from a restricted client list allowed to access DD Boost on the PowerProtect DD. The peers in this case the ESXI or VM Direct Engines have not been added to the PowerProtect DD restricted client list. These failures are expected and working as designed, to resolve the PowerProtect DD configuration must be corrected.

How to confirm the PowerProtect DD restricted client list is the source of the failure:

1.) Connect to PowerProtect DD over ssh.

2.) Run the command below to show the current configuration and the clients given access. When clients or hosts not on the permitted list attempt to run a backup or restore, PowerProtect DD rejects them as expected.

ddboost client show config

The PowerProtect DD default would be below all clients, represented by * as the client, as seen below. If PowerProtect DD has the below configuration, the issue does not match this article.

Add any host within the PowerProtect Data Manager environment that requires access to PowerProtect DD for backup and restore.

Example:

1.) Connect to PowerProtect DD over ssh.

2.) Run the command below to add any missing hosts the required PowerProtect DD access for backups and restores. PowerProtect Data Manager, VM Direct Engines should be included on the list.

Replace the following parameters to match your environment (including <>):

• <your_hostname> with the FQDN of the host PowerProtect DD is rejected for ddboost access.

ddboost client add <your_hostname>

Any additional questions in relation to PowerProtect DD should be directed to PowerProtect DD Support.