VMware | Data Anomaly scan fails with guest OS access error | Druva

Problem description

During a scheduled or manual VMware backup job, the primary virtual machine backup completes successfully, but the subsequent Data Anomaly scan fails.

Administrators receive the following alert notification in the console or via email:

"Data Anomaly - scan failure on Virtual machines"

This issue occurs on virtual machines configured with Guest VM Credentials in the Druva Management Console for Data Anomaly scanning or SQL app-aware processing.

Cause

The Data Anomaly scan fails due to one or more of the following guest OS configuration issues:

The guest credentials assigned in the Druva Management Console lack local administrative privileges on the target guest VM.
The assigned user account lacks the "Log on as a batch job" right under Windows Local Policies.
Windows User Account Control (UAC) in "Admin Approval Mode" prevents Druva from creating temporary execution directories (C:\Program Files\Druva\Hybrid-Workload\VMware\<jobid>\) on the guest operating system.

Traceback

Job logs report the following execution error during the scan phase:

Plaintext

[2024-01-23 23:04:38,663] [ERROR] Could not create directory: C:\Program Files\Druva\Hybrid-Workload\VMware\<jobid>\ in guest os: (vim.fault.CannotAccessFile) {     dynamicType = <unset>,     dynamicProperty = (vmodl.DynamicProperty) [],     msg = 'Unable to access file C:\Program Files\Druva\Hybrid-Workload\VMware\<jobid>\',     faultCause = <unset>,     faultMessage = (vmodl.LocalizableMessage) [],     file = 'C:\Program Files\Druva\Hybrid-Workload\VMware\<jobid>\' }

Resolution

Step 1: Assign Guest VM Credentials in Druva Console

Log in to the Druva Management Console.
Navigate to Enterprise Workloads > Protect > VMware > All virtual machines.
Locate the affected VM and click its name.
Click Assign Guest VM Credentials.
Enter valid credentials for an account that has local administrative privileges on the guest VM.

Step 2: Configure Local Permissions & Policies on Guest VM

A. Add Account to Local Administrators Group
1. Press Win + R, type compmgmt.msc, and press Enter.
2. Navigate to System Tools > Local Users and Groups > Groups.
3. Double-click Administrators.
4. Click Add... and add the guest credential account configured in Step 1.
B. Grant "Log on as a batch job" Right
1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to:
  Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment
3. Double-click Log on as a batch job.
4. Verify the account (or Administrators group) is listed. If missing, click Add User or Group... and add the account.
C. Disable UAC for Administrators
1. In gpedit.msc, navigate to:
  Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
2. Locate User Account Control: Run all administrators in Admin Approval Mode.
3. Set this policy to Disabled.
4. Reboot the target VM for the security policy changes to take effect.

Step 3: Rerun the Backup Job

Run a manual backup or wait for the next scheduled backup run.
Confirm that both the backup job and the Data Anomaly scan complete without errors.

Verification

To verify that the resolution has resolved the issue:

Log in to the Druva Management Console.
Go to Enterprise Workloads > Protect > VMware > All virtual machines.
Check the affected VM status.
The warning status message "Insufficient permissions for Data Anomaly or SQL app aware processing" will automatically clear following a successful scan.

VMware | Data Anomaly scan fails with guest OS access error