SureBackup fails with “Invalid change tracker error code” on VMware VMs with VBS enabled

TL,DR

If a VMware VM has Virtualization Based Security (VBS) enabled, SureBackup can fail with “Invalid change tracker error code” during snapshot creation. The underlying cause is that SureBackup, by default, modifies the VMX and disables Virtual Hardware Assisted Virtualization (VHV) by setting vhv.enable to false, but VBS requires VHV. The fix is documented in KB4003: SureBackup for VM With VBS Enabled Fails With “Invalid change tracker error code” and boils down to creating a registry value on the Veeam Backup Server so SureBackup stops flipping vhv.enable.

The symptom

A SureBackup job in one of our customer environments tests multiple VMs, and suddenly one VM consistently fails with:

An error occurred while taking a snapshot: Invalid change tracker error code:

[25.02.2026 16:47:34.391]    <17>    Info (3)    [SureBackup] [SQL 2022] [RegisterVm] > VmRef = vm-469403

[25.02.2026 16:47:34.391]    <17>   Error (3)    [SVmWareCtkHelper] Failed to disable CTK on VM, Ref: VmRef [vm-469403]
[25.02.2026 16:47:34.391]    <17>   Error (3)    SetVmChangeTracking failed, vmRef 'vm-469403', changeTrackingEnabled 'False'
[25.02.2026 16:47:34.391]    <17>   Error (3)    Invalid virtual machine configuration. (Nested Hardware-Assisted Virtualization should be enabled when enabling VBS (Virtualization-Based Security)) (Veeam.Backup.ViSoap.ViServiceFaultException)
[25.02.2026 16:47:34.391]    <17>   Error (3)    VimApi.InvalidVmConfig

In the job log, the failure chain typically includes SureBackup attempting to disable CTK, then hitting a VM configuration error, then the snapshot failing. 

Why it happens

Veeam documents the root cause very explicitly in KB4003:

1. SureBackup modifies the VMX of VMs being tested and sets vhv.enable to false, which disables VHV. 
2. VBS requires VHV, so the VM becomes “invalid configuration”, vSphere reports that nested hardware assisted virtualization must be enabled when enabling VBS. 
3. Because of this invalid configuration, SureBackup cannot disable CTK and the subsequent snapshot creation fails, surfacing as “Invalid change tracker error code”. 

Root cause analysis for our exact symptom points to the same mechanism and the same remediation, including the “Failed to disable CTK” and “Invalid virtual machine configuration” messages in the log excerpt. 

The fix

The solution is a small registry adjustment on the Veeam Backup Server that forces SureBackup to not change vhv.enable to false in the VMX of tested VMs. This is the official workaround in KB4003 and was also the remediation in our case.

Steps

1. On the Veeam Backup Server, open Registry Editor.
2. Create the key if it does not exist:
   HKLM\SOFTWARE\Veeam\Veeam Backup and Replication\SureBackup 
3. Create or set this value:
   Value Name: UseVhvEnable
   Value Type: DWORD (32 Bit)
   Value Data: 0 
4. Rerun the SureBackup job, the change takes effect on the next run.