Backing up a virtual SharePoint 2013 environment using Veeam and MS System Center Data Protection Manager 2012 SP1 (SCDPM) failed with VSS errors.  Veeam is being used to create VM image based backups and SCDPM is being used to provide SharePoint backups with item level recovery.

The Veeam backup failed with:

Unable to create snapshot (Dell EqualLogic VSS HW Provider) (mode: Veeam application-aware processing). Details: Writer ‘Microsoft Hyper-V VSS Writer’ is failed at ‘VSS_WS_FAILED_AT_PREPARE_SNAPSHOT’. The writer experienced a non-transient error. If the backup process is retried, the error is likely to reoccur. –tr:Failed to verify writers state. –tr:Failed to create VSS snapshot. –tr:Failed to perform pre-backup tasks.
Make sure VM does not have ‘iSCSI Software Target Storage Provider’ feature installed.

The SCDPM backup ran, but logged the warning:

Backup metadata enumeration failed

DPM could not obtain backup metadata information for SharePoint Farm Sharepoint Farm\%SQL_SERVER%\SharePoint_Config on %SHAREPOINT_SERVER%. If the data source is a SharePoint farm then a valid recovery point has been created. However, content databases from this recovery point can be recovered using the alternate location option only. (ID 3134)

The SharePoint web front end server had two VSS errors in the Windows Application Event Log:

Event ID 8194

Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.
. This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
PrepareForSnapshot Event

Context:
Execution Context: Writer
Writer Class Id: {da452614-4858-5e53-a512-38aab25c61ad}
Writer Name: SharePoint Services Writer
Writer Instance ID: {e3f3a187-6600-4750-b96d-b5579dc09e9d}

Event ID 8193

Volume Shadow Copy Service error: Unexpected error calling routine RegOpenKeyExW(-2147483646,SYSTEM\CurrentControlSet\Services\VSS\Diag,…). hr = 0x80070005, Access is denied.
.

Operation:
Initializing Writer

Context:
Writer Class Id: {da452614-4858-5e53-a512-38aab25c61ad}
Writer Name: SharePoint Services Writer
Writer Instance ID: {4d6e7cca-8810-41f2-a56f-ac87156c426f}

One of two SharePoint servers running SharePoint Search had one VSS error in the Windows Application Event Log:

Event ID 8213

Volume Shadow Copy Service error: The process that hosts the writer with name OSearch15 VSS Writer and ID {0ff1ce15-0201-0000-0000-000000000000} does not run under a user with sufficient access rights. Consider running this process under a local account which is either Local System, Administrator, Network Service, or Local Service.

Operation:
Initializing Writer

Context:
Writer Class Id: {0ff1ce15-0201-0000-0000-000000000000}
Writer Name: OSearch15 VSS Writer
Writer Instance Name: OSearch15 Replication Service

When configuring SCDPM SharePoint protection you have to run the ConfigureSharePoint.exe command, see here for more details.  You provide this command with the SharePoint Farm Administrator account and this account is not normally an Windows Administrator on the server.  Event ID 8193 indicated that permissions were an issue.

In order to resolve the VSS errors, open registry editor on the web front end and search servers.  Navigate to HKLM\SYSTEM\CurrentControlSet\Services\VSS\Diag right-click on the key and choose permissions.

On the web front end server I granted the SharePoint Farm Administrator account full control to the key.

On both SharePoint Search servers I granted the SharePoint Search and the SharePoint Farm Administrator accounts full control to the key.  On one of the search servers under HKLM\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl, both the SharePoint Farm Administrator account and the the SharePoint Search were listed, but on the other only the SharePoint Search account was listed.  I added a REG_DWORD key under HKLM\SYSTEM\CurrentControlSet\Services\VSS\VssAccessControl and set the value to 1 for the SharePoint Farm Administrator account.

Following a reboot of the servers the backups worked correctly in both Veeam and SCDPM and the Event Log errors disappeared.