ReFS file restore issue with Nakivo – some files inaccessible

[Thibaut Watrisse]

Hello everyone,

I’m facing an issue with Nakivo file-level recovery from ReFS volumes and I’d like to know if anyone else has experienced the same situation and found a solution or workaround.

Context

• Backup solution: Nakivo

• Hypervisors tested: Proxmox (production) and ESXi (lab)

• Guest OS: Windows Server 2019 with ReFS 3.4 volumes

• Transporter OS: Windows Server 2019 Standard (same build as source VM).

Problem

When performing a File Level Recovery (FLR) on ReFS volumes, some files cannot be accessed.
Error message in Windows:

“The file cannot be accessed by the system”

Even after taking ownership and resetting ACLs with takeown and icacls, the files remain inaccessible and copy operations fail.

How to reproduce

The problem seems related to ACLs from Active Directory users being preserved in the backup.
To reproduce:

1. On a Windows Server joined to an AD, create a file.

2. Remove all permissions from the file until it cannot be opened in Explorer anymore (no effective rights).

3. Perform a backup and then a file-level restore with Nakivo.
   • Result: restored file shows “The file cannot be accessed by the system”.

4. Perform the same test with Competitor on the same environment.
   • Result: Competitor restores the file and it can be opened without issue.

Tests performed

• Compared with Competitor on the same VM in ESXi → Competitor restores work fine, Nakivo restores fail.

• Tested both with and without Active Directory domain → issue happens in both cases.

• Tried resetting ACLs, stripping permissions, changing ownership → no success.

• Tried using a clone of the original VM as a transporter → in this case all files are accessible, but this is not a viable solution in production (clone VM and install it as a transporter is long).
• Tried using an agent in the original VM -> in this case all files are accessible, but this is not a viable solution in production (We don't want our production VMs to directly access the backup network)

Conclusion so far

• Looks like an issue with how file ACLs/metadata are handled during restore.

• Since the same transporter VM works fine with Competitor, it seems specific to how Nakivo processes the restore.

Question :

Has anyone else encountered this with ReFS file restores in Nakivo?

• Any workaround to make files accessible without having to use a cloned VM as transporter?

• Any transporter configuration or option that forces stripping/resetting ACLs during restore?

• Any known limitation with ReFS that could explain this?

Any insight would be very helpful.

Thanks!
Thibaut