Error: Tevo Library Error Exception. TevoMountReplay failed when mounting recovery points - The user name or password is incorrect (4036481)

When attempting to mount recovery points for all agents on a Core, the following error appears:

Rapid Recovery uses a temporary, ephemeral user account to mount recovery points. If this account lacks the required Local Security Policy permissions, the mounting process will fail, producing the error above.

Ensure the ReplayCoreEphemeralAccounts local group has the following permissions on the Core server:

• Access this computer from the network
• Allow logon locally

⚠️ Note: Disabling or restricting these group policies will also cause the error.

Step-by-Step Instructions

1. Check and Update Local Security Policy Permissions on the Core Server

   • Run gpedit.msc as Administrator
   • Navigate to:
     Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment
   • Open the following policies:
     • Access this computer from the network
     • Allow logon locally
   • Confirm that ReplayCoreEphemeralAccounts is listed. If it is not, add it.
   • After making changes, apply the updated policy by running the following command in an elevated Command Prompt:
     gpupdate /force
   • Note: After applying the policy, return to the same policy paths and verify that the changes were not reverted. If they were, the settings are likely controlled by a domain-level policy.

2. If the options are greyed out, this means the permissions are enforced by domain-level Group Policy.

3. If Domain Policy is blocking the permissions:

   • In Active Directory Users and Computers, create a new Organizational Unit (OU) for the Core server.
   • Move the Core server to this new OU.
   • On a Domain Controller, open the Group Policy Management Console (gpmc.msc).
   • Navigate to:
     Group Policy Management > Forest > Domains > your_domain.com > [Your OU]
   • Right-click the OU and select Create a GPO in this domain and Link it here.
   • Right-click the new GPO and choose Edit.

4. Edit the GPO to Assign the Required Permissions

   • In the Group Policy Editor, navigate to:
     Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment
   • Open and edit the following policies:
     • Access this computer from the network
     • Allow logon locally
   • Add the group: ReplayCoreEphemeralAccounts (you may need to type it manually).

5. Apply the Domain Policy Changes

   • On the Core server, open an elevated Command Prompt and run:
     gpupdate /force
   • Note: After applying the domain policy, verify that the ReplayCoreEphemeralAccounts group still appears in the two required policies. If it is missing, another higher-precedence GPO may be overriding your settings.