How to resolve "Data protection manager Error ID: 33623" for Azure MABS

Makoto Tsukada 1

Hello

I am currently trying to install Azure MABS and back up VM machines on ESXi by looking at the following two sites.
I have installed Azure MABS on win2019 and am trying to backup VM machines on ESXi.
https://learn.microsoft.com/en-us/azure/backup/backup-azure-microsoft-azure-backup
https://learn.microsoft.com/en-us/azure/backup/backup-azure-backup-server-vmware

In the #8 in "Add the vCenter Server" section of the second URL, I typed the credential to login to the ESXi along with the section.
However the following error message appears.

============

Data protection manager Error ID: 33623
Internel error code: 0x80990EF2

=============

To find out more about this error, I did the following research
C:\Program Files\Microsoft Azure Backup Server\DPM\DPM\Temp
DPMRACurr.errlog
And I found out the following in the log.

=======================

0504 1CBC 01/09 20:48:21.764 22 VMWareServer.cs(237) NORMAL Calling VMWareAPI:RetrieveServiceContent with argument serviceReferenceMOR:MOR = type:ServiceInstance, value:ServiceInstance and URL:https://172.17.1.2XX:443/sdk
0504 1CBC 01/09 20:48:21.764 22 VMWareServer.cs(233) WARNING FMBlock: Unknwon exception caught! Calling exception transformer now OperationCode:Login,
0504 1CBC 01/09 20:48:21.764 22 VMWareServer.cs(233) WARNING OperationStartTime:1/9/2022 8:47:50 PM,CurrentAttempt:4, Exception:System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send.---> System.IO.IOException: IOException: Authentication failed because the remote party has closed the transport stream.

=======================

172.17.1.2xxx is my ESXi server.

On the Backup server, I copied this https://172.17.1.2XX:443/sdk to chrome URL fileld, I get an immediate error.

===========

This 172.17.1.246 page can’t be foundNo webpage was found for the web address: https://172.17.1.246/SDK
HTTP ERROR 404

==============

But I can access with https://172.17.1.2XX:443 or https://172.17.1.2XX on the chrome.

I think that the "sdk" part of this URL(https://172.17.1.2XX:443/sdk) is wrong.
But I cannot change this parameter from the MABS Application.

Note that the ESXi server(6.7) uses self-certification, and in order to skip the certificate validation, I did the following section in the second Microsoft URL,
Disable HTTPS certificate validation
to skip the certificate validation.

Also, in the Add the account on Azure Backup Server section, I set the Credential to login in to the ESXi.
Since this ESXi is not in the domain, I set .\root for the credential.

Could you please give me some advice on the above?
I've spent more than 10 hours on this part alone, and I'm not making any progress.

SadiqhAhmed-MSFT 37,686 Reputation points Microsoft Employee

2022-01-11T10:34:53.73+00:00
Hello @Makoto Tsukada - Welcome to Microsoft Q&A community forum!

Sorry for the inconvenience this must have caused. Few things to be noted about MABS:

You cannot install MABS on a computer running domain controller.

Always join Azure Backup Server to a domain.

You cannot use a Network Attached Storage for MABS storage pool.

Try the following:

To bypass the certificate requirement for the VMWare Backup using MABS, you can add a registry “IgnoreCertificateValidation" =”dword:00000001” at
the following location: “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Data Protection Manager\VMWare”
Recommended to backup the registry before performing regedit operations.

Add/update the vCenter credentials in the MABS where you need to add the vCenter administrator credentials.

Let us know how it goes!
Makoto Tsukada 1 Reputation point

2022-01-11T12:39:31.423+00:00
Hello SadiqhAhmed-MSFT
Thank you very much for your answer.

You cannot install MABS on a computer running domain controller.

No, I did not install MABS on a domain controller machine.
I just created a new win2019 server and joined to our domain during MABS installation.

Always join Azure Backup Server to a domain.

Yes, I did.

You cannot use a Network Attached Storage for MABS storage pool.

No, I am using a local storage (E drive) on the win2019 server.
There is no error around the storage pool.

To bypass the certificate requirement for the VMWare Backup using MABS, you can add a registry “IgnoreCertificateValidation" =”dword:00000001” at

the following location: “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Data Protection Manager\VMWare”
Recommended to backup the registry before performing regedit operations.

I already did this before my question, and I surely confirmed the parameter was set on the regedit.

Add/update the vCenter credentials in the MABS where you need to add the vCenter administrator credentials.

I did not change the MABS configration....

I do not use vCenter, I am using ESXi, which does not join in the domain.
In that case, the username of the credential is .\root.
Is my understanding correct?
From the MABS, I can login using user name=root and the correct password via web browser.

Could you tell me if there is anything else suspicious?
SadiqhAhmed-MSFT 37,686 Reputation points Microsoft Employee

2022-01-11T14:40:30.29+00:00

The query needs a further deeper dive technically.

I recommend you to create a technical support ticket. The ticket enables you to work closely with the support engineers and get a quick resolution to your issue.

Here is the link - https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request to create support case.
Darren Walton 0 Reputation points

2023-08-07T14:04:26.08+00:00

When specifying the server, do NOT put anything other than the server's FQDN or IP address. That means no https:// or http:// and nothing after the FQDN or IP address.Screenshot 2023-08-07 150242.png
Peter Kedzierski 5 Reputation points

2023-08-08T11:12:07.1366667+00:00

Have same problem in my environment. Disabled https verification, also adjusted tls for all .net framework. Credentials are ok and can open esxi (6.7) with url. Firewall 443 and 902 open both ways (disabled fw for testing - no luck). Is there other suggestion?
SadiqhAhmed-MSFT 37,686 Reputation points Microsoft Employee

2023-08-09T08:18:26.7166667+00:00

Have you installed (MABS V4)?

Peter Kedzierski 5

newest MABS V4, installed last week on a fresh OS (win serv 2022 std)

Standalone and licenced ESXI is not in the domain but MABS server is. Tried different cred too including domain name of the host and w/o it.

Tried main admin logins too with full permissions.

I'm trying to connect w/o HTTPS (using port 443) - already disabled using regedit.

Both are in same subnet and can open webpage.

I've got zabbix server monitoring setup via /sdk too - and this is working correctly. But MABS server cannot talk to it.

VMware version:	 Error:	Data Protection Manager Error ID: 33623 	Unable to communicate with VMware Server 192.168.0.230. Detailed error code:	Internal error code: 0x80990EF2 Recommended action:	             Please ensure that the specified VMware server is up and running and reachable from DPM Server.             Also, ensure that right credentials are specified for interacting with specified VMware Server.          
            Please ensure that the specified VMware server is up and running and reachable from DPM Server.
            Also, ensure that right credentials are specified for interacting with specified VMware Server.

DPMRACurr.errlog:

WARNING	FMBlock: Unknwon exception caught!! Calling exception transformer now OperationCode:Login,
1904	16E8	08/09	08:18:25.248	22	FMComponent.cs(0)			WARNING	                OperationStartTime:09/08/2023 08:17:46,CurrentAttempt:5, Exception:System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IOException: Authentication failed because the remote party has closed the transport stream.

SadiqhAhmed-MSFT 37,686 Reputation points Microsoft Employee

2023-08-09T10:26:52.6133333+00:00

@Peter Kedzierski Have you added the registry for TLS 1.2?
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Peter Kedzierski 5 Reputation points

2023-08-09T12:55:17.28+00:00

@SadiqhAhmed-MSFT

Yes, checked them also manually

Disable cert check:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Data Protection Manager\VMWare]

"IgnoreCertificateValidation"=dword:00000001

Both 32/64 .nets:
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft.NETFramework\v2.0.50727] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft.NETFramework\v4.0.30319] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v2.0.50727] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v4.0.30319] "SystemDefaultTlsVersions"=dword:00000001 "SchUseStrongCrypto"=dword:00000001

The only thing is mine ver. of OS is 2022 - somewhere in the documentation I've seen that it runs on 2016/19 - not sure if this matter. Also hosted on prem
Peter Kedzierski 5 Reputation points

2023-08-10T21:03:00.37+00:00

Apparently this regedit is not enough for host to force TLS 1.2 followed this guide and finally got it working. https://charbelnemnom.com/how-to-enable-tls-1-2-protocol-in-system-center-data-protection-manager-dpm-scdpm-tls1-2/

2 answers

Jesse Oldfield 6 Reputation points

2022-11-15T18:48:05.407+00:00

Since I had this same issue and I haven't seen an answer posted here yet, the solution for me was to enforce .net to use TLS 1.2. Not sure why there hasn't been a patch yet that does this automatically but such is life.

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001
Please sign in to rate this answer.

1 person found this answer helpful.
SadiqhAhmed-MSFT 37,686 Reputation points Microsoft Employee

2022-11-16T09:33:07.05+00:00

Thank you for sharing the solution that worked for you. I will be taken care in the next release (MABS V4).
Sign in to comment
Amardeep Saini 835 Reputation points Microsoft Employee

2023-08-09T10:26:12.5866667+00:00
@Makoto Tsukada - I would request to check if below mentioned registry is applied on MABS Server.

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v2.0.50727]
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\v4.0.30319]
"SystemDefaultTlsVersions" = dword:00000001
"SchUseStrongCrypto" = dword:00000001
Please sign in to rate this answer.
Peter Kedzierski 5 Reputation points

2023-08-10T21:06:53.97+00:00

Got it working by (only) using both of PS scripts from this web: https://charbelnemnom.com/how-to-enable-tls-1-2-protocol-in-system-center-data-protection-manager-dpm-scdpm-tls1-2/ Changing tls for .net in registry is not enough it seems.

SadiqhAhmed-MSFT 37,686 Reputation points Microsoft Employee

2023-08-11T10:50:49.32+00:00

Thanks for the update! Glad to hear it is resolved :)

Andrea Longhitano 40 Reputation points

2024-03-28T16:26:46.7733333+00:00

Did you solve the issue running the script? Is it working with MABS v4?

Peter Kedzierski 5 Reputation points

2024-04-02T08:07:58.3466667+00:00

I'm using MABS v4 - this link i provided did work for me

SadiqhAhmed-MSFT 37,686 Reputation points Microsoft Employee

2024-04-02T09:05:10.3933333+00:00

@Peter Kedzierski Thanks for sharing your experience!
Sign in to comment