Veeam Agent for Windows – Backups not working after upgrade to 2.0

When Veeam released their Veeam Agent for Windows 2.0 on May 11th, 2017 I was first in line to go for an upgrade on my main PC (Windows 10 Build 1607) at home. The upgrade went smooth as I expected from Veeam.

Problem:

When I started my first backup with the new version, the backup job stopped with the following error message:

Cannot request cryptocontainer. Win32 error:The data is invalid. Code 13.

That was not the start I expected from the new version. I started troubleshooting and log analysis of this backup job. Backup job log files are located in C:\ProgramData\Veeam\Endpoint\Backup_Job_HOSTNAME. There you can find the log file Job.Backup_Job_HOSTNAME.Backup.log.
I went through this log and found this:

[15.05.2017 09:25:25] Info <13cc> Requesting cryptocontainer ‘VeeamCryptoContainer’…
[15.05.2017 09:25:25] Error <13cc> Cannot create cryptoprovider.
[15.05.2017 09:25:25] Error <13cc> Cannot request cryptocontainer.
[15.05.2017 09:25:25] Error <13cc> Win32 error:The data is invalid.
[15.05.2017 09:25:25] Error <13cc> Code: 13
[15.05.2017 09:25:25] Info <13cc> Creating cryptoprovider ‘Microsoft Base Cryptographic Provider v1.0’ (0x00000001).. Failed.
[15.05.2017 09:25:25] Info <13cc> Releasing cryptoprovider.
[15.05.2017 09:25:25] Info <13cc> Releasing cryptoprovider.. Ok.
[15.05.2017 09:25:25] <01> Error Cannot request cryptocontainer.
[15.05.2017 09:25:25] <01> Error Win32 error:The data is invalid.
[15.05.2017 09:25:25] <01> Error Code: 13 (System.Runtime.InteropServices.COMException)
[15.05.2017 09:25:25] <01> Error at VeeamEndpointSysUtilsDllLib.IVeeamEpIndexingProvider.InitSecuredStrings()
[15.05.2017 09:25:25] <01> Error at Veeam.EndPoint.SysUtils.CEpGuestSubsystem.GetInventoryInfo(CVssHostInfoConfig config, Boolean secure)
[15.05.2017 09:25:25] <01> Error at Veeam.EndPoint.SysUtils.CEpGuestSubsystem.GetInventoryInfo(CCredentials credentials)

This was now the right moment to open a Veeam Case because the error log contains the same message which also shows up in the GUI. It took only 3-4 days until the Veeam support engineer came up with the right solution and in my case it was not an Veeam issue. It was an Windows issue. I assume this is also specific to Windows 10.

Solution:

1. Navigate to the C:\ProgramData\Microsoft\Crypto\RSA folder
2. Rename the folder labelled S-1-5-18 to .old or something else
3. Restart the system

So what is exactly this S-1-5-18 folder? In my case it was the folder for the well-known security identifier of the “Local System” account. The Crypto\RSA folder stores certificate pair keys for both the computer and users. I can only assume that one of this key pairs was corrupted and therefor lead to this error.
After the system was restarted, backups start working again. I also want to give a big thank you to Mike Powell who was the Veeam Support Engineer helping me with this problem.
This concludes the post. Please leave a comment if you have any further question or feedback.