SFR from backup copy is a partial success with ERROR: 'WNetAddConnection2', 'Authentication failed because NTLM authentication has been disabled

Problem

NetBackupSingle File Restore (SFR) from backup copy is partially successful with ERROR: 'WNetAddConnection2', 'Authentication failed because NTLM authentication has been disabled.

Error Message

Mar 07, 2025 8:56:32 PM - begin Restore
Mar 07, 2025 8:56:32 PM - Info bprd (pid=295916) Found (164,360) files in (1) images for Restore Job ID 269.xxx
Mar 07, 2025 8:56:33 PM - restoring from image azure-vm-adad98bf-cc55-45ec-a27b-e0af4a70e58f_1741344472
Mar 07, 2025 8:56:33 PM - requesting resource @aaaab
Mar 07, 2025 8:56:34 PM - granted resource 
MediaID=@aaaab;DiskVolume=PureDiskVolume;DiskPool=msdp-dp;Path=PureDiskVolume;StorageServer=<server>;MediaServer=<server>
Mar 07, 2025 8:59:45 PM - Info bprd (pid=295916) MSDP live mount access SPWS_MOUNT_ID: 630b5d25-17fc-499b-b959-9b0522e9de34
Mar 07, 2025 8:59:45 PM - Info bprd (pid=295916) Using Snapshot Manager: <name>
Mar 07, 2025 8:59:45 PM - Info bprd (pid=295916) Restoring from copy 2 of image created Fri Mar  7 10:47:52 2025 from policy 
BACKUPNOW+e50a8d83-16f5-409d-b768-2eb7613b8321
Mar 07, 2025 8:59:46 PM - Info nbcs (pid=298705) Start
Mar 07, 2025 8:59:46 PM - Info nbcp (pid=298705) Snapshot Manager Task ID: 2ee85dc1-cea8-4bb2-9ee5-2f3ab55d3f6d for sfr from backup operation started.
Mar 07, 2025 9:00:56 PM - Warning nbcs (pid=298705) Failed to restore file(s) / folder(s) from snapshot/backup. Internal status code: 2060017
Mar 07, 2025 9:00:56 PM - Error nbcs (pid=298705) Invalid operation for asset: azure-vm-adad98bf-cc55-45ec-a27b-e0af4a70e58f
Mar 07, 2025 9:00:56 PM - Error nbcs (pid=298705) \\upgradenbu\630b5d25-17fc-499b-b959-9b0522e9de34 cannot be made available due to (1937, 'WNetAddConnection2', 
'Authentication failed because NTLM authentication has been disabled.')
Mar 07, 2025 9:00:56 PM - Info nbcs (pid=298705) End
Mar 07, 2025 9:00:57 PM - Warning bprd (pid=295916) Automatic Granular Restore from backup completed with error. Copy the files manually from instant access 
mount: \\<server>\630b5d25-17fc-499b-b959-9b0522e9de34. Note that the instant access retention interval is configurable and, by default, it is available only for 24 hrs.
Mar 07, 2025 9:00:57 PM - end Restore; elapsed time 0:04:25
the requested operation was partially successful(1)

Cause

This failure occurs when the target VM is a Windows 2025 system. In Windows 2025, NTLM Authentication support has been deprecated as part of security enhancements carried out by Windows. It is disabled by default. For SFR in the Windows 2025 target VM, attempts to access the SMB Share created by Instant Access (IA) for the file and folder reads are unable to create a secured connection to the share, causing this failure.

Solution

Steps:

1. Restore the file/folders to a target Windows VM where NTLM is enabled (the Windows version less than 2025).
2. Copy these files manually from the VM where files and folders are restored in step 1 to the target VM (Windows 2025 system).

Note: If the automatic restore in step 1 fails, then log in to the target Windows VM where the files were being restored to and attach / mount the VHD shared at the path provided in the activity monitor logs to restore the files manually:

• Copy the files manually from the instant access mount: (i.e. in the example above  \\<msdp hostname>\630b5d25-17fc-499b-b959-9b0522e9de34)
  • The instant access retention interval is configurable and, by default, it is available only for 24 hrs.
  • The mount path might be different for different paths using the mount path populated in the Activity monitor.
• Then carry out step 2 and copy the file/folders to the target Win2025 system.