Hi ​@ITSupport04072025 -

I have never heard of that behavior before...with Defender and 2TB. Have you reached out to Veeam Support as well to inquire?...or just MS Support?

Can you share what kind of Job you’re using?...agent-based or VM-imaged based? Sounds like image-based..but making sure you’re not using the Agent inside a VM and using VBR.

Not much has come up in my search, besides the following from a month ago. Somewhat similar error to yours (slightly diff):

Maybe best to get ahold of Veeam Support to see if they can help, if you haven’t already.

Hi ​@ITSupport04072025,

Did you make sure that the exclusions are set correctly? Please refer to this article:

https://www.veeam.com/kb1999

I had similar issues without the appropriate rules / exclusions.

In case there is an “oldschool” uninstaller for TrendMicro you should consider running it.

Hope that helps!

Lukas

Hi ​@ITSupport04072025 

Here's what you can do:

Temporarily disable antivirus or endpoint protection on the Veeam Backup Server and the Mount Server during the restore process.

Add exclusions for Veeam folders and processes especially those involved in mounting and instant recovery:

Exclude Veeam executables like VeeamMountSvc.exe, VeeamTransportSvc.exe, VDDK drivers, and your backup repository paths.

Retry the restore. If it succeeds, permanently apply the exclusions in your AV policy.

Thank you for your answers.

We use VM-imaged based. 

We have two VMs with more than 2 TB. The restore doesn't work for these two VMs, but it does for all other VMs with less than 2 TB. I confirm that Trend Micro is completely uninstalled.

Additional information: If I disable Microsoft Defender (for the uninitiated: put the antivirus in Debug mode, disable Tamper Protection, and disable "real-time scanning," etc.), the restore doesn't work either!

I need to completely uninstall (off boarding) the antivirus for the restore to work again!

Did you make sure that the exclusions are set correctly?

Yes !   Microsoft Support teams has reviewed the work we've done several times! As I mentioned, the list of exclusions is phenomenal...and it doesn't change anything!

I'm going to open an "official" ticket with Veeam. Unfortunately, I have to go through the subcontractor... and this process is always cumbersome!

Thank you for your advice!

If we find the solution (I hope!), I will share the solution with you.

Ok...keep us posted on things when you can ​@ITSupport04072025 

Hi ​@ITSupport04072025 ,
 

Some workarounds - to use another mount server, without this AV installed, if it is possible to have 1 vm like this. Using Instant Recovery and manually coping the needed files… 

There is also a registry value from here, which was know to help with some strange mounting issues: https://www.veeam.com/veeam_backup_11_a_release_notes_rn.pdf

ForceVhdMount

Although in what’s new v12 it is stated that it no longer needed, maybe worth a try! 

FYI - I would be highly cautious about implementing **any** registry changes to a prod VBR environment without the consent and approval from Veeam Support.

If you have a test environment to test it out..you could do that to check the behavior at least.

I would typically agree with you, I have spend a couple of years at Veeam Technical Support, but this registry value has been shared online from Veeam's side in their release notes, so it is safe to use, that’s why I made sure to link the official documentation

Hi

(sorry for my lack of follow-up... I was on vacation the last few weeks...)

Since my last reply, things have changed. The registry key Kira suggested seems to have fixed the problem (the second problem...but not the first!).  Thanks Kira !

We've implemented many of Microsoft's recommendations. Microsoft's antivirus solution is excellent...but it lacks maturity! In their solution, there are two antivirus programs that interact on the server. Excerpt from the discussion with the Microsoft specialist:

1. Difference Between MsSense and Defender Antivirus

• MsSense (Sense.exe) is the core process of Microsoft Defender for Endpoint (MDE). It powers the Endpoint Detection and Response (EDR) capabilities, including behavioral sensors, telemetry collection, and advanced threat detection.
• Microsoft Defender Antivirus (MsMpEng.exe) is the traditional antivirus engine responsible for real-time protection, malware detection, and remediation.

In short, MsSense is part of the EDR solution, while Defender Antivirus handles signature-based threat detection and prevention.

2. Difference Between Intune Exclusion Policy and EDR Exclusions via Security Portal

• Intune Antivirus Exclusion Policy: These exclusions apply to Defender Antivirus and prevent specific files, folders, or processes from being scanned or blocked by the antivirus engine.
• EDR Exclusions (via Microsoft 365 Defender portal): These exclusions apply to the EDR component (MsSense) and prevent telemetry collection or alerting on specified paths or processes.

Please note that these exclusions are independent of each other. Antivirus exclusions do not affect EDR behavior, and vice versa. Both should be configured carefully to avoid creating blind spots in your security posture.

I can also add that the two antivirus programs (Defender and MsSense) cannot be configured in the same portal! The exclusions proposed by Microsoft have corrected the following issue:

Backup not opened Agent failed to process method {Mount.QueryVolumesOnMountedDevice}

The successful exclusions were made with MsSense. Therefore, all Veeam services (executable) must be excluded with the EDR portal.

But, another error message started appearing but not on every restore attempt.  The first restore attempt fails, but second restores work for a short time (1 to 2 hours)

The new message:

Unable to mount disk: unsupported disk type

---This is the error that the registry key seems to have fixed---

By the way, we also have implemented the recommendations proposed in KB1883… without any positive results!

Because we applied this fix yesterday, we will wait until next Friday and wait for several test restores before declaring « Victory» !

Thanks for the update ​@ITSupport04072025 

​@ITSupport04072025 I am glad to hear that it helped! Even though only partially :)