KB4885 release notes and known issues

Summary

Windows 11 24H2/25H2 | Server 2025 - Recovery Media Restore Fails with: The Local Security Authority cannot be contacted KB ID: 4885 Product: Veeam Agent for Microsoft Windows Published: 2026-07-28 Last Modified: 2026-09-10 Issue Resolved in September 8 2026 Windows Updates The underlying issue documented in this article was resolved by Microsoft in the September 8 2026 security updates for Windows 11 (KB5124008) and Windows Server 2025 (KB5122871). After applying the update, the Veeam Recovery Media must be recreated. Challenge When attempting to perform a restore using the Veeam Recovery Media , the restore fails while establishing the connection to the local VeeamAgent.exe process, and the following error occurs: The Local Security Authority cannot be contacted Because the failure occurs before a recovery operation can begin, it prevents restoring from any backup location, including local storage, a network shared folder or Veeam backup repository, and cloud repositories. Cause This issue occurs due to a regression introduced by the Microsoft June 2026 security update for Windows 11 and Windows Server 2025. The update changed the behavior of the Windows security subsystem (Local Security Authority and Schannel) within the Windows Recovery Environment (WinRE), on which the Veeam Recovery Media is based. As a result, the TLS handshake that secures the connection between the restore wizard and the local VeeamAgent.exe process cannot be completed. This behavior has been confirmed with the following Microsoft Windows updates for Windows 11 (versions 24H2 and 25H2) and Windows Server 2025, and later updates released before September 2026: KB5094126 (OS builds 26100.8655 and 26200.8655) KB5099536 (OS build 26100.33158) Recovery media created from a system running an earlier update (for example, KB5089549, OS build 26200.8457, or earlier) is not affected. Solution This issue was resolved by Microsoft in the September 8 2026 security updates. To resolve the issue, install the applicable update on the machine where the Veeam Recovery Media is created: Windows 11 (versions 24H2 and 25H2): KB5124008 (OS builds 26200.9445 and 26100.9445) Windows Server 2025: KB5122871 (OS build 26100.33438) After the update has been installed, the Veeam Recovery Media must be recreated . Recovery media created before the update was installed remains affected. Workaround If the September 8 2026 update cannot be installed, the Veeam Recovery Media can be built using the Windows Assessment and Deployment Kit (Windows ADK) instead of the Windows Recovery Environment (WinRE). Recovery media built using the Windows ADK is not affected by this issue. Ensure that the Windows Assessment and Deployment Kit (Windows ADK) and the corresponding Windows PE add-on are installed on the machine where the Veeam Recovery Media will be recreated. Create the following registry value on the machine where Veeam Agent for Microsoft Windows is installed to configure it to build the Veeam Recovery Media using the Windows ADK: Location: HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Endpoint Backup Value Type: DWORD (32-Bit) Value Value Name: ForceUseAdkForRecoveryMedia Value Data: 1 Alternatively, the registry value can be created using the following PowerShell command: New-ItemProperty - Path "HKLM:\SOFTWARE\Veeam\Veeam Endpoint Backup" - Name "ForceUseAdkForRecoveryMedia" - PropertyType DWORD - Value 1 - Force Copy Recreate the Veeam Recovery Media . If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case. To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Improvements and security content

• Windows 11 24H2/25H2 | Server 2025 - Recovery Media Restore Fails with: The Local Security Authority cannot be contacted KB ID: 4885 Product: Veeam Agent for Microsoft Windows Published: 2026-07-28 Last Modified: 2026-09-10 Issue Resolved in September 8 2026 Windows Updates The underlying issue documented in this article was resolved by Microsoft in the September 8 2026 security updates for Windows 11 (KB5124008) and Windows Server 2025 (KB5122871). After applying the update, the Veeam Recovery Media must be recreated. Challenge When attempting to perform a restore using the Veeam Recovery Media , the restore fails while establishing the connection to the local VeeamAgent.exe process, and the following error occurs: The Local Security Authority cannot be contacted Because the failure occurs before a recovery operation can begin, it prevents restoring from any backup location, including local storage, a network shared folder or Veeam backup repository, and cloud repositories. Cause This issue occurs due to a regression introduced by the Microsoft June 2026 security update for Windows 11 and Windows Server 2025. The update changed the behavior of the Windows security subsystem (Local Security Authority and Schannel) within the Windows Recovery Environment (WinRE), on which the Veeam Recovery Media is based. As a result, the TLS handshake that secures the connection between the restore wizard and the local VeeamAgent.exe process cannot be completed. This behavior has been confirmed with the following Microsoft Windows updates for Windows 11 (versions 24H2 and 25H2) and Windows Server 2025, and later updates released before September 2026: KB5094126 (OS builds 26100.8655 and 26200.8655) KB5099536 (OS build 26100.33158) Recovery media created from a system running an earlier update (for example, KB5089549, OS build 26200.8457, or earlier) is not affected. Solution This issue was resolved by Microsoft in the September 8 2026 security updates. To resolve the issue, install the applicable update on the machine where the Veeam Recovery Media is created: Windows 11 (versions 24H2 and 25H2): KB5124008 (OS builds 26200.9445 and 26100.9445) Windows Server 2025: KB5122871 (OS build 26100.33438) After the update has been installed, the Veeam Recovery Media must be recreated . Recovery media created before the update was installed remains affected. Workaround If the September 8 2026 update cannot be installed, the Veeam Recovery Media can be built using the Windows Assessment and Deployment Kit (Windows ADK) instead of the Windows Recovery Environment (WinRE). Recovery media built using the Windows ADK is not affected by this issue. Ensure that the Windows Assessment and Deployment Kit (Windows ADK) and the corresponding Windows PE add-on are installed on the machine where the Veeam Recovery Media will be recreated. Create the following registry value on the machine where Veeam Agent for Microsoft Windows is installed to configure it to build the Veeam Recovery Media using the Windows ADK: Location: HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Endpoint Backup Value Type: DWORD (32-Bit) Value Value Name: ForceUseAdkForRecoveryMedia Value Data: 1 Alternatively, the registry value can be created using the following PowerShell command: New-ItemProperty - Path "HKLM:\SOFTWARE\Veeam\Veeam Endpoint Backup" - Name "ForceUseAdkForRecoveryMedia" - PropertyType DWORD - Value 1 - Force Copy Recreate the Veeam Recovery Media . If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case. To submit feedback regarding this article, please click this link: Send Article Feedback To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Official publisher evidence