Veeam Agent Windows: Push-Deploy Physical Box to Backup Repository

Problem: physical Windows machine sits outside virtualisation stack. Need to back up a folder to Veeam repository. No vCenter. No Hyper-V host. Just bare metal. How?

Veeam Backup & Replication handles VMs effortlessly. But add a physical Windows box? Two paths exist. One works clean. One bites back. Here’s both paths — and the exact stack of firewall, UAC, and credential traps that block the clean one.

Two paths to backup

Path A — Central push (clean): Veeam B&R console on server. Physical machine added to Protection Group. Agent pushed automatically via SMB/RPC. Backup job created in console. All management central. All monitoring central.

Path B — Manual install (messy): Download Veeam Agent for Windows installer. Run on physical box. Configure standalone. Point at repository. Then import into B&R console as pre-installed agent. Works. But two places to check. Version drift risk. Extra step every maintenance cycle.

Path A is the right answer. Here’s what blocks it.

Prerequisites — what Veeam needs

Network: B&R server must reach the target machine on SMB (TCP 445), RPC (TCP 135), and Veeam Installer Service (TCP 6160, 11731). If machines sit on different subnets — or behind Tailscale like ours — these ports must be open both directions. Use Test-NetConnection to verify before touching the console.

Credentials: B&R needs a local admin account on the target machine. Built-in Administrator preferred — avoids UAC quirks. Must be enabled (disabled by default on Windows 10/11). Must have a password (blank password = blocked for network logon). Must be in the local Administrators group (obvious, but verify).

Firewall: Windows Firewall blocks inbound SMB/RPC by default on Public networks. If the target machine’s network profile shows Public (common with VPNs and Tailscale), File and Printer Sharing won’t be active for that profile. Fix: set network to Private, or add explicit inbound rules for TCP 135, 445, 6160, 11731, 6184-6194.

The trap: UAC remote restrictions

Everything above looks right. Admin account enabled. Password set. Ports open. Firewall rules in place. B&R console sees the machine. Protection Group created. Hit rescan. Error: Access is denied.

This is the silent killer. Windows has a security feature called User Account Control (UAC) remote restrictions. When a local account connects over the network, Windows strips the administrator token from the session. Result: the account authenticates correctly — but receives a filtered, non-admin token. Every operation requiring admin rights fails with “Access is denied” — same error you’d get with wrong credentials. Misleading.

The fix is one registry key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
New DWORD: LocalAccountTokenFilterPolicy
Value: 1

Set it. No reboot needed. Rescan protection group. Agent pushes instantly.

Note: this applies to non-domain-joined machines using local accounts. Domain-joined machines with domain admin accounts are not affected. But in a homelab or small office without Active Directory? Every Windows 10/11 box hits this.

Complete checklist

On the target Windows machine (the one to be backed up):

1. Enable built-in Administrator: net user Administrator /active:yes
2. Set password: net user Administrator YourPassword
3. Verify Admin group membership: net localgroup Administrators
4. Check network profile is Private (or add explicit firewall rules for TCP 135, 445, 6160, 11731, 6184-6194)
5. Verify SMB service running: Get-Service LanmanServer
6. Set LocalAccountTokenFilterPolicy = 1 in registry
7. Test ports from B&R server: Test-NetConnection TargetMachine -Port 445

On the Veeam B&R server:

1. Inventory → Physical Infrastructure → Add Protection Group
2. Type: Individual Computers. Enter hostname (use full Tailscale DNS name if over VPN).
3. Credentials: Administrator / password from step 2
4. Run rescan. Agent installs automatically.
5. Create Agent Backup Job → File Level Backup → add folder path → select repository → schedule

Why file-level backup over volume-level

Veeam Agent offers two backup modes for Windows: entire computer (volume-level) and file-level. For a single folder on a workstation, file-level is the right call. Smaller backup chains. Faster increments. No need to snapshot the OS volume. Filters available for file types and exclusions. Restore is a simple file browse in the Veeam console.

Volume-level makes sense when you want bare-metal recovery capability — restoring the entire machine from scratch. For folder backup of a physical workstation? File-level. Less storage. Less time. Same reliability.

Tailscale note

If both machines are on Tailscale, use the full MagicDNS name (machine.tailc4fdc.ts.net) when adding the computer to the protection group. Short hostnames may resolve through local DNS instead of Tailscale, causing connection failures. Tailscale encrypts the traffic between machines — no additional VPN or port forwarding needed. Just make sure the Tailscale interface is on the Private firewall profile, not Public.

Result

Physical Windows machine backed up to Veeam repository. Central management. Incremental backups. File-level restore from the console. All nine checklist items above took about 20 minutes — and 18 of those minutes were hunting the UAC registry key. Skip the hunt. Use the checklist.