Skip to main content

Agent & Endpoint Offline

Audience: T1 / T2 / T3
Version: 1.0
Last Updated: April 2026

Overview

This guide addresses scenarios where a Veeam Agent or backup-managed endpoint shows as offline or not communicating in the Veeam console.

Common symptoms:

  • Agent shows "Offline" or "Unavailable" in Veeam console
  • Agent installed but last contact time is hours/days ago
  • Jobs fail with "Unable to connect to agent" or "Host is offline"
  • Agent was working previously but stopped responding

Tier Definitions

Tier Scope Expected Resolution
T1 Basic connectivity checks, service verification 10-15 minutes
T2 Firewall, network troubleshooting, reinstall agent 30-45 minutes
T3 Persistent issues, policy conflicts, architectural fixes 1+ hours

T1 — Basic Connectivity & Service Checks

1. Verify the Endpoint is Online

From your workstation or the BDR:

Test-Connection -ComputerName [TARGET_HOSTNAME_OR_IP] -Count 2
  • If ping fails: The endpoint is offline, powered off, or network-disconnected. Check physical connectivity, power state, or VPN connection.
  • If ping succeeds: Proceed to check Veeam services.

2. Verify Veeam Agent Services are Running

RDP/console to the target endpoint:

Get-Service Veeam* | Select Name, Status, StartType

Expected services:

  • VeeamAgent - Should be Running, Automatic
  • VeeamTransportSvc (if present) - Should be Running, Automatic

Action:

  • If stopped → Start the service: Start-Service VeeamAgent
  • If disabled → Set to automatic: Set-Service VeeamAgent -StartupType Automatic

3. Check Last Contact Time in Veeam Console

In Veeam Backup & Replication console:

  1. Navigate to Inventory → Physical & Cloud Infrastructure
  2. Find the endpoint
  3. Check Last Seen timestamp
  • If last seen within 1 hour: Likely a temporary network blip. Retry the job.
  • If last seen > 24 hours ago: Escalate to T2.

T2 — Network & Firewall Troubleshooting

1. Test Veeam Agent Ports from BDR

The Veeam Agent communicates back to the BDR on specific ports.

From the BDR:

Test-NetConnection -ComputerName [TARGET_IP] -Port 6160  # Veeam Installer Service
Test-NetConnection -ComputerName [TARGET_IP] -Port 2500  # Veeam Agent (default)

If port tests fail:

  • Windows Firewall on the target may be blocking
  • Intune-managed devices: Firewall rules may be overridden by policy (see Veeam Troubleshooting Playbook - Scenario 4)
  • Network firewall/ACL may be blocking if BDR and endpoint are on different subnets

2. Check Windows Firewall Rules

On the target endpoint:

Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*Veeam*"} | Select DisplayName, Enabled, Direction, Action

Expected: Inbound rules for Veeam Agent services should be Enabled, Allow.

If missing or disabled:

# Re-enable Veeam firewall rules (if they exist but are disabled)
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*Veeam*"} | Enable-NetFirewallRule

# If rules are missing, reinstall the agent (it should recreate them)

3. Check for Intune/MDM Management

On the target endpoint:

dsregcmd /status

Look for:

  • AzureAdJoined: YES → Device is Intune-managed
  • MDMUrl: → Confirms MDM enrollment

If Intune-managed: Local firewall changes may be overridden by policy. See Veeam Troubleshooting Playbook - Scenario 4 for Intune firewall exception requirements.

4. Reinstall the Veeam Agent

If services are running, ports are open, but the agent still won't communicate:

Manual reinstall:

  1. Download the Veeam Agent installer from the BDR console or from \\[BDR_IP]\VeeamBackup
  2. On the target endpoint, run the installer
  3. Point to the BDR during setup
  4. After install, verify the agent appears in Veeam console

Scripted reinstall via NinjaRMM: (If available)

# Uninstall existing agent
$app = Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*Veeam Agent*"}
if ($app) { $app.Uninstall() }

# Install new agent
Start-Process "\\[BDR_IP]\VeeamBackup\Veeam.Agent.Windows.x64.exe" -ArgumentList "/silent /accepteula /server=[BDR_IP]" -Wait

T3 — Persistent Offline Issues & Policy Conflicts

1. Review Event Viewer on the Target

On the target endpoint:

Get-EventLog -LogName Application -Source Veeam* -Newest 50 | Select TimeGenerated, EntryType, Message

Look for:

  • Connection refused → Firewall/network issue
  • Authentication failed → Credential issue (check if BDR has correct credentials for the endpoint)
  • Service failed to start → Dependency or corruption issue

2. Verify BDR Has Valid Credentials

In Veeam console:

  1. Main Menu → Credentials Manager
  2. Verify there's a credential set for the endpoint (domain account or local admin)
  3. Test the credential: Right-click → Test Now

If credentials are invalid or expired: Update them and retry the connection.

3. Check for Defender for Endpoint Interference

On the target endpoint:

Get-Service webthreatdefsvc | Select Name, Status

If running: Defender for Endpoint's network protection may be silently blocking Veeam traffic. See Veeam Troubleshooting Playbook - Scenario 4 for resolution.

4. Network Segmentation / Cross-Subnet Issues

If the endpoint and BDR are on different subnets/VLANs:

5. Agent Corruption or Windows Issues

If all else fails and the agent won't communicate despite services running and firewall open:

Option 1: Repair install

  • Rerun the Veeam Agent installer on the target
  • Choose Repair option

Option 2: Full uninstall/reinstall

  • Uninstall via Control Panel
  • Delete C:\Program Files\Veeam and C:\ProgramData\Veeam
  • Reboot
  • Fresh install

Option 3: Check for Windows networking corruption

# Reset Windows networking stack
netsh winsock reset
netsh int ip reset
# Reboot required

Quick Reference — Common Causes

Symptom Likely Cause Quick Fix
Agent offline after Windows Update Service disabled or firewall rule removed Restart VeeamAgent service, verify firewall
Agent offline after Intune enrollment Intune firewall policy blocking Add Veeam firewall exceptions to Intune
Agent offline after subnet change BDR can't reach new subnet Update BDR routing or add firewall rule
Agent shows offline but service is running Credential expired or network issue Test credentials in Veeam console, check ports
Agent offline after BDR IP change Agent still pointing to old BDR IP Reconfigure agent to point to new BDR IP

Document History:

Version Date Author Changes
1.0 April 2026 DTC Initial creation - agent offline troubleshooting
Back to top