Cyber Security News

Windows 11 24H2 Update Breaks Connection to the Veeam Backup Server

A critical issue affecting Windows 11 24H2 users has emerged, disrupting the connection between Veeam Recovery Media and backup servers. 

The problem, linked to Microsoft’s February update (KB5051987), is preventing organizations from performing data recovery operations, potentially compromising business continuity plans for affected enterprises.

Connection Failure Details

The issue specifically affects systems running Windows 11 24H2 (build 26100.3194 or higher). When users attempt to restore data using Veeam Backup & Replication via Veeam Recovery Media, they encounter a series of network connection failures. 

The error messages include “Failed to establish connection: no valid IP addresses were found,” Unable to establish an authenticated client-server connection, and A call to SSPI failed, see inner exception”:

Additionally, users receive the error message when trying to recover data from SMB network shares: “The remote procedure call failed and did not execute”. 

These issues prevent data restoration when recovery operations are most needed at critical moments.

The underlying cause appears to be linked to changes introduced in the KB5051987 February update for Windows 11 24H2.

Stop attacks before they start, powered by a 97% precise neural Network to Detect Cyber Attacks

While Microsoft and Veeam are still investigating the exact technical mechanism, the issue seems to affect the Windows Recovery Environment (Windows RE) on which Veeam Recovery Media is built.

This problem is particularly perplexing because affected systems can still establish basic network connectivity. 

Users report they can ping both the name and IP address of their Veeam backup servers from the recovery environment’s command prompt, yet the Veeam recovery application itself cannot establish a proper connection.

This disruption is significant for the over 550,000 organizations worldwide that rely on Veeam for their backup and recovery solutions. 

For enterprises depending on timely data restoration capabilities, this issue represents a serious risk to disaster recovery plans and compliance requirements.

IT administrators attempting to resolve the issue have found that traditional troubleshooting approaches such as using different network adapters, configuring static IP addresses, or adjusting secure boot settings do not resolve the connection problems.

Available Workaround

Veeam advises customers to use Recovery Media generated on systems running older Windows 11 builds (26100.3037 or earlier) as a temporary solution. 

This workaround acknowledges that recovery media created on machines with earlier Windows 11 versions does not exhibit connection problems.

Recovery media made on one system can be used on another, however proprietary drivers such as network, WLAN, and RAID controllers may not be present if the hardware configurations differ.

Both Veeam and Microsoft have confirmed they are jointly investigating the issue. 

For organizations planning recovery operations with Veeam in a Windows 11 environment, creating recovery media on computers running Windows 11 builds earlier than 26100.3194 is advisable until a permanent solution is available. 

System administrators should monitor Veeam’s official communications for updates on a permanent fix for this critical issue.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

Guru Baran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Decoding PIN-Protected BitLocker Through TPM SPI Analysis To Decrypt And Mount The Disks

BitLocker keys without PIN protection, where attackers could exploit stolen laptops, researchers now delve into…

16 minutes ago

New Caminho Malware Loader Uses LSB Steganography and to Hide .NET Payloads Within Image Files

A sophisticated malware operation has emerged from Brazil, leveraging advanced steganographic techniques to conceal malicious…

38 minutes ago

CISA Warns of Hackers Actively Exploiting Windows Server Update Services RCE Vulnerability in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned organizations worldwide about active exploitation…

6 hours ago

New Malware Attack Using Variable Functions and Cookies to Evade and Hide Their Malicious Scripts

A sophisticated malware campaign targeting WordPress sites has emerged, utilizing PHP variable functions and cookie-based…

7 hours ago

Threat Actors Tricks Target Users Via Impersonation and Fictional Financial Aid Offers

An international ecosystem of sophisticated scam operations has emerged, targeting vulnerable populations through impersonation tactics…

8 hours ago

TransparentTribe Attack Linux-Based Systems of Indian Military Organizations to Deliver DeskRAT

TransparentTribe, a Pakistani-nexus intrusion set active since at least 2013, has intensified its cyber espionage…

11 hours ago