By default, VBR does a configuration backup every day at 10:00.
It is obvious that this backup should also follow the 3-2-1(-1-0) rule. A easy way to do this is to copy these restore points to a machine that is already backed up be Veeam and therefore covered by the 3-2-1(-1-0) rule. This can be done with a Veeam File Copy job. This job can copy files between systems part of Managed Servers.
Lets do it and create a File Copy job:
and select the path to the configuration backup as source
For destination select the server system you want to copy files to. As mentioned, this system should be part of backup job. Finally select your preferred time schedule. I would recommend to run this job just after the configuration backup.
Done? Almost! It is important to know, File Copy job copies files respectively a directory, but is does not synchronize. Therefore the amount of files at the destination will increase. So they should also get deleted after some time otherwise partition runs full. A easy way to do so is to schedule a PowerShell script like this:
$DeleteData = (Get-Date).AddDays(-14).Date
Get-ChildItem -Path E:\Copy_VeeamBackupConfig\VeeamConfigBackup\*\*.bco | Where-Object {$_.CreationTime -lt $DeleteData} | Remove-Item
To not ignore security at this step, the user that runs this scheduled task should not be a local administrator of the machine - a normal user-account is sufficient. Keep in mind, Veeam File Copy job also copies file permissions (ACL)! To enable a user-account at the destination system to delete copied files, files at the both (source and destination) must have write/modify permission for the users-group.
I hope this helps to keep configuration restore points safe!
if you don't schedule a cleaning task 
