Unable to add protection group for Microsoft Active Directory Objects

Hi ​@Yanick Q. -

Welcome to the Community! Did you try to use a local admin account of the machine? You’d use the same format as a domain acct → HOSTNAME\username

Try that and see if it works.

Best.

Hi ​@coolsport00, 

Thank you very much for your quick answer.

Yes I tried that. Since the Veeam Server is not on the domain, I need to specify DOMAIN\username to logon to my Active Directory server. From the wizard, with those credentials, I’m able to browse all my AD:

So I supposed my credentials works.

When you said local admin account of the machine are you talking about the Veeam Server local admin?

Thank you very much for your help!

Regards,
Yanick

Is the firewall in Windows enable and if so are the proper ports open?  I assume so.  Maybe check the logs on the Veeam server - C:\ProgramData\Veeam\Backup\folder

If nothing here is working then you might want to open a case with Support.  Seeing you can browse AD it should be working.

Hi Chris!

Thanks you your reply!

The firewall isn’t an issue at this point. I’ve made sure everything is open before configuring the backup. I’m using SSL port 636 to talk with my Active Directory servers and that port is open.

Regarding C:\ProgramData\Veeam\Backup\, that is strange; not all backup jobs seems to create a log file; I’m unable to find anything about the AD server I’m trying to backup, but I never really run a job on it; I just “test” the credentials from the wizard, and with the error I got, I do not ccomplete the creating of that protection group.

But that being said, I have three backup jon so far:

But under folder C:\ProgramData\Veeam\Backup\folder, I only see:

And it seems they weren’t updated singe July 19th while those jobs runs each days… Anyway that may be another strange behaviour!

Thank you for your help!

Regards,
Yanick

Is the firewall in Windows enable and if so are the proper ports open?  I assume so.  Maybe check the logs on the Veeam server - C:\ProgramData\Veeam\Backup\folder

If nothing here is working then you might want to open a case with Support.  Seeing you can browse AD it should be working.

Hi Chris!

Thanks you your reply!

The firewall isn’t an issue at this point. I’ve made sure everything is open before configuring the backup. I’m using SSL port 636 to talk with my Active Directory servers and that port is open.

Regarding C:\ProgramData\Veeam\Backup\, that is strange; not all backup jobs seems to create a log file; I’m unable to find anything about the AD server I’m trying to backup, but I never really run a job on it; I just “test” the credentials from the wizard, and with the error I got, I do not ccomplete the creating of that protection group.

But that being said, I have three backup jon so far:

But under folder C:\ProgramData\Veeam\Backup\folder, I only see:

And it seems they weren’t updated singe July 19th while those jobs runs each days… Anyway that may be another strange behaviour!

Thank you for your help!

Regards,
Yanick

Ok so there is something else going on and at this point I would create a support case then also search the forums as well to see if anyone reported a similar issue - https://forums.veeam.com

Hopefully one of those will get you the answers.  Let us know how you make out.

Is the firewall in Windows enable and if so are the proper ports open?  I assume so.  Maybe check the logs on the Veeam server - C:\ProgramData\Veeam\Backup\folder

If nothing here is working then you might want to open a case with Support.  Seeing you can browse AD it should be working.

Hi Chris!

Thanks you your reply!

The firewall isn’t an issue at this point. I’ve made sure everything is open before configuring the backup. I’m using SSL port 636 to talk with my Active Directory servers and that port is open.

Regarding C:\ProgramData\Veeam\Backup\, that is strange; not all backup jobs seems to create a log file; I’m unable to find anything about the AD server I’m trying to backup, but I never really run a job on it; I just “test” the credentials from the wizard, and with the error I got, I do not ccomplete the creating of that protection group.

But that being said, I have three backup jon so far:

But under folder C:\ProgramData\Veeam\Backup\folder, I only see:

And it seems they weren’t updated singe July 19th while those jobs runs each days… Anyway that may be another strange behaviour!

Thank you for your help!

Regards,
Yanick

Thanks Chris,

I will wait to get my official licences before opening up the case.

I will keep you posted on my findings.

Regards!
Yanick

Hi ​@Yanick Q. 

Above community expert already gave you feedback very well, but I would love to participate in this discussion.

This issue is common when the VBR server is not joined to the AD domain but you're trying to add AD objects using domain credentials and maybe this is the root cause because your VBR server is in a workgroup; it cannot discover or query AD objects even with valid credentials due to DNS, trust, and authentication limitations.

You have to try the below recommendations: Join the server to the AD domain this is the most straightforward and supported approach add the VBR server to your AD domain and reboot, then retry adding the protection group it should now discover OU/computer objects successfully.

(Alternate) Use MANUAL agent-based jobs: If joining to AD is not an option then create a protection group for individual computers instead and use IP/hostname and administrative credentials manually to add servers.

You should have an Evaluation License in your my.veeam.com account portal. Please check it, Evaluation Licenses are eligible for support

Edit: And strongly recommend this route -- I’m extremely doubtful it’s about Firewall or the username format or anything, error is quite clear:

A string got passed to the underlying code when the underlying code was expecting an Object. Unclear how this happened and it’s probably going to require review of the logs to understand which item is throwing this. 

Hi ​@waqasali,

Thanks for your reply!

For security purpose, we internally decided not to add the VBR to our domain. I don’t know if it’s a good practice, but this is what we decided, especially after the CVE-2025-23121 security vulnerability, which was allowing remote code execution (RCE) on the Backup Server by an authenticated domain user, was released earlier this month.

However I would be curious how you guys are configuring it; into the domain or in a workgroup?

I created an agent based backup and it works. The only issue I have with this method, is that Veeam doesn’t support Kerberos authentication and all our “domain admins” users are in the “Protected Users” group, which disable NTLM authentication. I wanna know if I could bypass this problem using the “Microsoft Active Directory Objects”. 

I’m still waiting for get our officials licences to open a case; since my current evaluation license has expired, I cannot open any case under my account. I’ve asked a colleague to get another 30 days licence in the meantime.

I will keep you posted on this (I will be away in August, but I will continue this upon my return in September).

Thank you for your help and suggestion, it is very appreciated.

Regards,
Yanick

​@Yanick Q. -

Actually...a lot of folks I see place Veeam in a workgroup. I am personally against this from a simplicity standpoint; the Veeam Best Practice Guide recommends placing in a separate domain than your main/prod one → a ‘management domain’:

https://bp.veeam.com/security/Design-and-implementation/Hardening/Workgroup_or_Domain.html

Keep us posted on things upon your return.