Avamar: Windows VSS backups fail with "code 0x80070005 Access Is denied" error message

Windows VSS Backups Failure

Windows VSS system state backups fail with error messages similar to the following:

2015-12-11 07:17:22 avvss Error <8336>: VSS exception code 0x80070005 thrown creating object - 'code 0x80070005: Access is denied'
2015-12-11 07:17:22 avvss Error <0000>: Failed to allocate VSS client, exiting

• Avagent service might be configured to run with an NT domain account due to Avamar SQL backups also occurring on that same client.
• The NT Authority/SYSTEM account has not been granted the sysadmin role in SQL Server Management Studio, which is required to back up SQL databases.

Root Cause of the Windows VSS Backups Failure

The root cause of failing with "Access is denied" error is due to the Backup Agent (Avagent) service being configured with an NT domain account. This account does not have sufficient permissions for VSS shadow copy operations.

By default, the Avagent service is configured to run with the local SYSTEM account, which has the necessary rights. However, when the service is configured to run with an NT domain account, it lacks the required permissions, leading to the "Access is denied" error.

The specific error code associated with this issue is 0x80070005, which indicates an access denied error.

Error code: 0x80070005
Error message: Access is denied

Contributing Factors

• The NT domain account used to configure the Avagent service does not have the sysadmin role in SQL Server Management Studio, which is required to back up SQL databases.
• The Avamar SQL backups are also occurring on the same client, which may be related to the configuration of the Avagent service.

Resolving Windows VSS Backups Failure

To resolve the Windows VSS backups failure, follow these steps:

• Open regedit on the Windows client to edit the registry and follow best practices to change regedit.
• Browse to the HKLM/System/CurrentControlSet/Services/VSS registry key.
• Right-click the VssAccessControl key and add a new DWORD (32-bit) value.
• Name it with the domain\username of the Avagent service account and set the value to 1.
• Exit the Registry Editor (reboot not necessary).

After completing the above steps, verify that the issue has been successfully resolved by checking the backup logs for any error messages related to VSS backups.

No specific tools or software are required for this resolution beyond the Windows Registry Editor (regedit).

Verify your permissions before editing the registry and adhere to best practices to prevent issues.
Editing the registry can cause system instability if not done correctly. Proceed with caution and consider backing up the registry before making changes.