Issue description
DataContainer backups to Synology NAS devices may start to fail with BA4801 error, due to Windows updates released in April
Affected environments
BackupAssist Classic versions up to v11.0.0 running on all Windows OS with the updates listed here:
- Windows Server 2019 & Windows 10 releases 2004, 20H2 – KB5001330
- Windows Server 2019 & Windows 10 release 1909 – KB5001337
- Windows Server 2016 release 1607 – KB5001402
- Windows Server 2019 release 1809 – either of two KB5001342, KB5001404
- Windows 2012R2 – KB5001382
- Windows 2012 – KB5001387
Cause
The above windows updates have changed the way permissions are handled using SMB protocol on Synology NAS devices. In particular, the user that Windows uses to mount disks over SMB can be assigned differently, so access rights for the virtual disk file may need to be altered to allow access for the different user, until Synology have a fix.
4 Solutions
Solution 1: Workaround
If you are not maintaining BackupCare and are running an older version than v11, follow these steps:
- Use Windows Explorer to open the Security properties for the DataContainer.vhdx, and Edit to assign “Full Control” to the “Everyone” group.
- Note: Please do NOT change the permission controls for the SMB share, as this may leave your backups vulnerable to hackers, and it will not solve the issue anyway. Changing the ACLs behind the share permissions does not affect the attack surface of the share, as long as the share is only accessible to the backup machine.
- Run a Check Destination to test the change, and double check the settings is the backup still fails. It may also be that you are experiencing a different problem.
- The security implications of this change are mild because SMB permissions are not changed, however you can reduce the scope of the ACL change by using individual user accounts instead of “Everyone”.
Solution 2: Fixed release
If you have BackupAssist v11 you can simply upgrade to the new BackupAssist 11.0.1 release to automatically work around the issue.
- You can also upgrade to 11.0.1 from an older version of BackupAssist if you have valid BackupCare.
Solution 3: Uninstall the windows updates
If you don’t want to change permissions then you can alternatively just uninstall the windows updates that caused the issue in the first place. See the Windows documentation for the hotfix numbers noted above, for instructions on how to do this.
Solution 4: Contact Synology
We know that Synology have a fix available, so you can contact their team to see if their solution is applicable and available for your device.
