Share via

Failed logon event generated by Veeam ONE on Windows computers

Matthew Cancio 0 Reputation points
2025-06-20T17:20:47.1666667+00:00

Having the issue, listed at this site: https://www.veeam.com/kb2276

Which brings me to https://support.microsoft.com/en-us/help/2816192/failed-logon-event-generated-when-running-remote-wmi-command 

However, the article states: "Applies to:   Windows 7 Service Pack 1, Windows Server 2012 R2**"**

I'm trying to verify if this is accurate, or if the documentation needs to be updated.

If it does need to be updated, does it also encompass Windows 11 and Windows Server 2025?

If yes, helps find a resolution to the problem.

If not, well then I guess I'm SOL haha.

I would love Windows support, however I'm not admin so, this is the route I must take.

Any help is greatly appreciated.

Thank you!

Windows for business | Windows Server | Performance | Application technologies and compatibility
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Smith Pham 2,700 Reputation points Independent Advisor
    2025-06-23T08:07:39.63+00:00

    Dear Team,

    While the failed logon event itself is expected behavior, ensuring that Veeam ONE can successfully collect data requires proper configuration of WMI and DCOM permissions on the target Windows computers. If these are not set correctly, you will see persistent data collection failures in your Veeam ONE console in addition to the initial failed logon events.

    To resolve this and ensure reliable data collection, you must grant the Veeam ONE service account the necessary permissions on each monitored Windows machine.

    Here are the key permissions to configure:

    • WMI Namespace Security: The Veeam ONE service account needs "Enable Account" and "Remote Enable" permissions for the "Root" WMI namespace and all its sub-namespaces.
    • DCOM Permissions: The service account requires "Remote Launch" and "Remote Activation" permissions for DCOM.
    • Membership in Local Groups: Adding the Veeam ONE service account to the "Performance Monitor Users" and "Event Log Readers" local groups on the target machine is also recommended for comprehensive data collection.

    Step-by-Step Guide to a Quieter Logbook:

    For detailed, step-by-step instructions on how to configure these permissions, refer to the official Veeam documentation

    By following these instructions, you will ensure that while the initial (and expected) failed logon event may still be generated, Veeam ONE will have the necessary access to perform its monitoring tasks successfully, leading to a stable and reliable monitoring environment.

    Best Regards,

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.