Skip to main content
Question

Unprotection Errors after DB Import

  • July 31, 2026
  • 4 comments
  • 32 views
S

This is a tough situation I’ve been fighting for a week. 

Our windows server (2016) on which veeam Backup & Replication 12 was running on broke and we were unable to make it boot again.

After much trying, I setup a new Windows Server (2025) and installed Veeam 12 on it. Before installation I installed MSSQL, imported the database from the old server and used that as an existing DB during installation. We don’t have a .bco Backup.

This worked pretty well, all our backups were recognized, our configuration was still there, etc. I managed to restore the connection to our VMWare by re-entering the connection password. 

Now we have a Linux Backup Proxy. I reset the credentials and a connection can be established, but I am getting these errors now (from Util.VolumesHostDiscover.log): 

[31.07.2026 15:52:41.908]    <24>   Error (3)    Failed to unprotect data: the actual generation 1be493dd-f053-4957-86cf-06d604afcbdd does not match the expected generation ad168c2e-58e4-49d5-aa58-747ee032a508
[31.07.2026 15:52:41.908]    <24>   Error (3)      (System.Exception)
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Configuration.DataProtection.CProtectedContainer.Create4UnprotectWithSalt(CSaltContainer saltContainer, Byte[] protectedData, DataProtectionScope protectionScope)
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Configuration.DataProtection.CProtectedContainer.Create4Unprotect(Byte[] protectedData, DataProtectionScope protectionScope)
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Configuration.DataProtection.WindowsDataProtection.UnprotectString(String encrypted, DataProtectionScope protectionScope)
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Common.SWindowsStringProtectionHelper.Decode(String encodedStr, Boolean isLocalProtect)
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Model.CDomTransportClientOptions.FindLinuxClientCertificateRaw()
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Model.CDomTransportClientOptions.FindLinuxClientCertificate()
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Model.CDomTransportClientOptions.GetLinuxClientCertificate()
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Core.STransportServiceConnectionSpecCreator.CreateLinuxTransportSpec(String srvName, IReadOnlyList`1 managementAddresses, CDomTransportClientOptions clientOptions, CNetworkReconnectOptions networkReconnectOptions)
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Core.CLinuxServer.FindTransportSvcAgentSettings(IReadOnlyList`1 managementAddresses, Boolean& isTransportUpgradeRequired)
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Core.CLinuxServer.CreateBackupClientAccessSpec()
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Core.CLinuxServerDiscoverHandler.CreateServerInfoResolver()
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Core.CLinuxServerDiscoverHandler.HandleRequestInternal()
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Core.CLinuxServerDiscoverHandler.HandleRequest()
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Core.CHostDiscoverSubmission.Process()
[31.07.2026 15:52:41.908]    <24>   Error (3)       bei Veeam.Backup.Common.CThreadPoolEx.DoSubmission(CWorker worker)

 

I tried removing the linux server completly, I tried removing the veeam install from the proxy (apt purge veeamtransport), but it won’t connect. I am suspecting something to do with missing host certificates in the windows DPAPI, but I don’t really know what to do about it. 

Does anyone have any ideas on how I can fix this?

    4 comments

    Chris.Childerhose
    Forum|alt.badge.img+22

    Can you deploy a new Proxy server to test with?  My guess is that there is something missing configuration wise as normally, you don’t move the DB this way and use the Configuration Backup (BCO) file to restore your server.

    If a new Proxy is not an option, then open a support case, and they should be able to help resolve it.

    Chris Childerhose (Enterprise Architect) - VMCE+ | VMCA | VMCE | VMCE-SP | Veeam Vanguard 8* | Veeam Legend 5* | VUG Canada Leader | vExpert 7* | Toronto VMUG Leader | VCAP-DCV/VCP-DCV/VCP-VVF | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
    coolsport00
    Forum|alt.badge.img+23
    • coolsport00
    • Veeam Legend
    • July 31, 2026

    Agree with Chris here ​@secmss . Are you able to simply recreate the Proxy. Generally, they’re pretty easy/basic installs...at least as compared to Repos. But probably best to reach out to Support.

    Shane Williford - Veeam VMCA/VMCE+ | Veeam Legend | VUG Leader | VCP-DCV | Twitter: @coolsport00
      S
      • secmss
      • Author
      • New Here
      • August 1, 2026

      Can you deploy a new Proxy server to test with?  My guess is that there is something missing configuration wise as normally, you don’t move the DB this way and use the Configuration Backup (BCO) file to restore your server.

      If a new Proxy is not an option, then open a support case, and they should be able to help resolve it.

      Sadly I installed a new Linux Server and I get the same error when trying to add it, not even as a proxy server, but just as a Linux Server. 

      This is probably more an issue with the host. I hoped that support wouldn’t be my only option, but maybe I have to go there.

      D
      Forum|alt.badge.img+3
      • ddomask
      • Veeam Product Management
      • August 3, 2026

      Hi ​@secmss ,

       

      After much trying, I setup a new Windows Server (2025) and installed Veeam 12 on it. Before installation I installed MSSQL, imported the database from the old server and used that as an existing DB during installation. We don’t have a .bco Backup.

       

      Regrettably this is the cause of the issue. See this consideration here. 

      Support unfortunately will not be able to meaningfully help, the configuration database backup & restore is the only supported way to migrate as there are two elements to consider:

      1. Secrets stored in the database rely on a combination of a local salt & machine key from the original backup server in order to be decrypted, this is a security feature. Manually moving the database files cannot preserve this / carry it over, but an Encrypted Configuration Backup has the necessary data included to ensure that secrets can be decrypted
      2. We use certificate based authentication for virtually all connections in v13, and that is why you’re getting stacktraces about fetching linux certificates

      Is there truly no BCO anywhere? That would be fastest way to get back up and running, else you will essentially be needing to do a fresh install & recreate the jobs from scratch & re-adding all encryption secrets manually. 

      You can check with Support and see if there are other options, but if you can locate a BCO file, even an older one, it will be the “best” way. If the BCO is older it’s not too big of a deal, the first step after configuration restore is to rescan all repositories (& replicas & catalog tapes) to ensure Veeam is aware & up to date with the current state of all backups.

      0x0D 0x0A
      Terms & ConditionsAccessibility statement