Skip to main content
Question

Veeam Backup Service Fails to Start – "ERROR_ACCESS_DENIED" on Desktop Object Creation

G
  • Gabby
  • Not a newbie anymore
  • 2 comments

Hello everyone,

we're experiencing a recurring issue with Veeam Backup & Replication running on Windows Server 2022.
At random intervals, the Veeam.Backup.Service stops unexpectedly and cannot be restarted, except by performing a full server reboot.

IIn the Svc.VeeamBackup.log, we consistently see the following error when attempting to start the service:

Info (3)    ------- Started new session of Veeam Backup Service -------
Error (3)   Failed to start service.
Error (3)   Failed to create desktop VeeamBackupServiceDesktop (ERROR_ACCESS_DENIED) (System.Exception)

Full log is attached for reference.
 

We ran whoami /priv and noticed that the SeCreateDesktopPrivilege is missing from the effective privileges of the LocalSystem account, which Veeam is using to run the service.

From what we understand, this privilege is either:

  • No longer assigned by default on Server 2022,

  • Or possibly restricted due to a GPO or security hardening policy.

We could not find a way to assign SeCreateDesktopPrivilege via secpol.msc or GPO, as it's not exposed in the GUI.

 

Thank you in advance

    6 comments

    matheusgiovanini
    Forum|alt.badge.img+6

    Consider configuring the service to run under a dedicated local administrative account instead of LocalSystem, as this can help bypass the privilege limitation. Additionally, it’s recommended to open a support case with Veeam for further investigation.

    Matheus Giovanini | Senior Backup Analyst | Veeam Legend | Blog: techdirectarchive.com
    G
    1 person likes this
    • G
      Gabby
    Marcel.K
    Forum|alt.badge.img+9
    • Marcel.K
    • Veeam Legend
    • 256 comments
    • May 22, 2025

    please check as well:

    1. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

    PromptOnSecureDesktop =0

     

    1. in Local Policies → User Rights Assignment

    "Allow log on locally" → Ensure the Veeam service account is included.

    "Log on as a service" → Same.

    1. In services

    Locate Veeam Backup Service.

    Properties → Log On tab > Local System account and Allow service to interact with desktop
     

    Marcel Kačmár | VCSP Partner 2022 | VMCE 2024 | VMCA 2024 |
    C
    1 person likes this
    • C
      Claxi
    G
    • Gabby
    • Author
    • Not a newbie anymore
    • 2 comments
    • May 23, 2025

    Thanks for the answers. We opened a case too, the say local System as Service User is recommended. 
    Case # 07678592
    We also increase the desktop heap size mentioned here: KB1909: Job Fails to Start Due to Timeout Caused by Desktop Heap Allocation Failure

    We try now: 

    • PromptOnSecureDesktop =0
    • Properties → Log On tab > Local System account and Allow service to interact with desktop

     

    CMF
    Forum|alt.badge.img+7
    • CMF
    • Veeam Legend
    • 81 comments
    • May 23, 2025

    Do you have any security software running on the system that might interrupt the service? Maybe check on the AV exclusions for example.

    https://www.veeam.com/kb1999

    Chalid Mohamed Fathallah | Veeam Legend | VMCE 2024 | VMCA 2025 | VCP-DCV | VCE-vSan
    C
    • Claxi
    • New Here
    • 1 comment
    • May 27, 2025

    Please update this thread, if the problem is fixed. I seem to have the same issue. Thank you!

    Marcel.K
    1 person likes this
    • Marcel.K
      Marcel.K
    G
    • Gabby
    • Author
    • Not a newbie anymore
    • 2 comments
    • May 28, 2025

    No, it's not fixed yet. It’s possible that some old issues from the day we removed the server from the domain for security reasons are still connected. It might be related to some GPOs. We’re still investigating the problem. It seems to occur occasionally.
    We deployed a second server without joining it to the domain, and it doesn’t have any problems.

    Comment


    Terms & ConditionsAccessibility statement