Blogs and Podcasts

 V13 upgrades cleanly when the VBR server is already cleaned up first. Most delays come from legacy backup-copy jobs, old agent deployments, nested repositories, removed job settings, or unsupported infrastructure that was still tolerated before the upgrade. Check the starting build first, clear blockers before mounting the ISO, and validate backup plus restore behavior afterward. 1. Supported starting pointDirect to v13.0.1 only from:v12.3.1 build 12.3.1.1139 or later v12.3.2If the server is on an earlier v12.3.x build:patch to v12.3.1 build 1139 firstIf the server is on v12.2.x or older:stage through v12.3.1 first2. Installer blockers to clear before the ISO is mountedThese stop the upgrade:backup metadata not upgraded to v12 format legacy backup-copy jobs Veeam Agent for Windows before v6 using LocalDB nested repository paths UNC path still configured in Export VBK File Copy jobs targeting the backup server jobs still using "Transform previous chains into rollbacks"Do not wait for t

When working with tape environments in Veeam Backup for Tape, cleaning is often treated as a routine task.However, in practice, it plays a much bigger role than most people expect.Over time, I’ve seen stable environments suddenly start presenting errors, performance degradation, or unexpected behavior — and in many of these cases, the root cause was simply a lack of proper tape drive cleaning.In this post, I’ll share how tape drive cleaning actually works in practice, what is often overlooked, and why this small maintenance task can have a major impact on reliability. What Is a Cleaning TapeAt first glance, a cleaning tape looks just like a regular data cartridge.It follows the same physical format but uses a specific label, typically CLN or CLNU, depending on the vendor.The difference is internal.Instead of storing data, the cartridge contains a specialized cleaning material — typically a controlled, non-abrasive fabric — designed to safely interact with the drive’s read/write heads.F

Managed BCDR with Veeam Delivering Resilient Business Continuity & Disaster Recovery as a Managed ServiceProviding Business Continuity and Disaster Recovery (BCDR) as a managed service requires far more than “running backups.”Customers expect guaranteed recovery outcomes, predictable recovery times, and protection even when the backup infrastructure itself is compromised.This article walks through a real‑world MSP architecture for delivering Managed BCDR with Veeam using:Active/Standby Veeam Backup & Replication (VBR) Veeam Cloud Connect Veeam Data Cloud Vault (immutable object storage) Microsoft Azure as the disaster recovery execution platformWe’ll cover the business problem, architecture decisions, operational flows, DR activation, and practical configuration guidance, concluding with clear pros, cons, and limitations.The Business Problem MSPs Must SolveModern customers don’t buy backups — they buy recovery confidence.They require:Predictable RPO and RTO Protection against r

As a follow-up to my last article, “Lab View: How to Air-Gap Veeam without breaking operation,” in this article, I will discuss common mistakes with Air-Gap and how they break you Air-gapping your backups is one of the smartest moves you can make.Done right, it protects you from:Ransomware Insider threats Accidental deletion Catastrophic failureBut here’s the reality:Most air-gap strategies fail—not because they don’t exist, but because they’re implemented wrong.I’ve seen environments with “air-gapped backups” that looked secure on paper…and completely fell apart during recovery.Let’s break down the most common mistakes—and why they matter. 1. “We Have Immutability—We’re Good”This is the #1 misunderstanding.Immutability is powerful.But it’s not the same as an air gap.The mistake:Relying solely on immutable storage Assuming it covers all attack scenariosThe problem:Credentials can still be compromised Access paths still exist Attackers can still disrupt operationsThe fix:Combine immutab

Dear all, this is just a quick guide, but maybe helpful for some of you!I had this behaviour with the latest release from yesterdays ISO, to patch to the latest release… After mounting the ISO and click on Setup.exe I received the following error:Unable to run the installer because files from this ISO are blocked for security reasons. Use the “Unblock” option in the file properties to proceed.  It’s an easy step, but keep in mind, this you have to do on the ISO file itself, not on the Setup.exe file 😉So right-click on the ISO, and choose Unblock under Security. Hit OK/Apply and have fun, while applying your urgent updates!  Take care, stay up2date and have a great weekend!    

I hear it all the time: my customers are looking for a backup solution they can set and forget, basically run itself. This article will focus on that - every backup solution needs to be monitored and troubleshoot issues. “Set it and forget it.”It sounds like the dream.You deploy your backup platform, configure your jobs, see everything turn green… and move on to the next project.No noise.No issues.No need to touch it.Until something goes wrong. The Illusion of “Everything Is Fine”In a lot of environments, backups quietly run in the background.Jobs complete Reports look clean Storage is filling (as expected… mostly)So naturally, attention shifts elsewhere.That’s the trap.Because backup environments don’t usually fail loudly at first.They drift. What “Set It and Forget It” Actually Looks Like Over TimeIt doesn’t break on Day 1.It slowly turns into:Jobs that run longer than they used to Warnings that get ignored (“it’s just a warning”) Storage growing faster than expected New workloads ad

 When working with tape environments, tape backup troubleshooting in Veeam is often more complex than it initially appears. Many professionals associate errors directly with faulty media. However, in real-world scenarios, issues often originate from hardware behavior, environmental conditions, or subtle physical problems.In this article, I will share real troubleshooting cases and, more importantly, explain the reasoning behind each analysis. The goal is to demonstrate how to identify the root cause instead of relying only on error messages. Case 1 – Mechanical obstruction during tape movementScenarioBackup jobs started failing during tape movement operations between slots and drives.Observed symptomsFailures during load and unload operations Errors affecting a specific range of slots Intermittent behavior that initially appeared randomExample error:Unexpected slider block, cartridge is not pushed far enough into the slot(ROB_SLIDER_UNEXPECTED_BLOCK_DURING_INSERT) TroubleshootingManual

Air-gapping your backups sounds simple in theory:“Just isolate them so nothing can touch them.”But in practice?That’s where things get tricky.Because the moment you start locking things down too aggressively, you risk:Breaking backup jobs Slowing down restores Creating operational headaches Or worse—making recovery harder when you actually need itI’ve seen environments go too far:Backups fully isolated… but unusable Processes so manual they never get tested Security so tight it blocks recovery workflowsThat’s not resilience. That’s friction.So let’s talk about how to air-gap Veeam the right way—without breaking operations. First: What “Air-Gap” Actually MeansAir-gap doesn’t have to mean physically unplugged (although it can).In modern environments, it usually means:Logical isolation Controlled access Separation from production riskThe goal isn’t to make backups unreachable.The goal is to make them untouchable by attackers—while still usable by you. The Core PrincipleBackups should be e

TL,DRIf a VMware VM has Virtualization Based Security (VBS) enabled, SureBackup can fail with “Invalid change tracker error code” during snapshot creation. The underlying cause is that SureBackup, by default, modifies the VMX and disables Virtual Hardware Assisted Virtualization (VHV) by setting vhv.enable to false, but VBS requires VHV. The fix is documented in KB4003: SureBackup for VM With VBS Enabled Fails With “Invalid change tracker error code” and boils down to creating a registry value on the Veeam Backup Server so SureBackup stops flipping vhv.enable. The symptomA SureBackup job in one of our customer environments tests multiple VMs, and suddenly one VM consistently fails with:An error occurred while taking a snapshot: Invalid change tracker error code:[25.02.2026 16:47:34.391]    <17>    Info (3)    [SureBackup] [SQL 2022] [RegisterVm] > VmRef = vm-469403[25.02.2026 16:47:34.391]    <17>   Error (3)    [SVmWareCtkHelper] Failed to disable CTK on VM, Ref: VmRef

Veeam Community Hackathon banner. Alfred is sitting in the middle of a desk. He is about to press the run button with his paw. Binary code and a slider are shown on the left of Alfred. In the middle, the word Hackathon is shown with arrowed lines pointing to icons and text describing several aspects of the Hackathon: Development, Brainstorm, Time, Presenting, Goal, Teamwork, and Community.🚀 Join the 4th Annual Veeam Community Hackathon (2026)!We’re excited to announce that the Veeam Community Hackathon 2026 kicks off on October 7, 2026 at 15:00 CEST / 9:00 AM EST — and registrations are now open! 👉 Sign up here: https://my.veeamhackathon.com⏳ Sign-ups close on September 30, 23:59 CEST / 5:59 PM EST 🌍 What is it about?This is a global, community-driven event where teams of 12–18 participants collaborate to build innovative solutions that enhance and complement existing Veeam products.💡 Your mission:Create something that makes life easier for end users — whether that’s a dashboard, t

With this post I want to highlight the community again as we held our 1st in-person Veeam User Group event in Cologne yesterday. This was a curious one for us, because it was the first time we rotated and went way north in Germany and leave our sweet South and Southwest spot. However, it turned out we almost had 60 in-person attendees and only 4 no show attendees which is a huge success and the biggest success in our eyes. This means the Veeam community is really working, people love to attend the VUGs and get together. We couldn’t be more proud !A HUGE THANK YOU to our sponsor Scality who made sure we can have such an amazing venue, food, catering, a barista (!) and drinks throughout the day. A simple amazing effort which we highly appreciate ! Furthermore a huge thank you to Veeam, especially to everyone who supports the Veeam Usergroup behind the scenes. We also had a massive representation from the german Veeam100 people which is always a blessing to see !Special thanks also go out

Greetings friends! Today I want to share something that has been on my mind for a while, and I finally decided to tackle it head-on. If you're running Veeam Backup for Microsoft 365 with object storage (Wasabi, AWS S3, Azure Blob, or any S3-compatible provider), you've probably asked yourself:"How much space is each user actually consuming in my VB365 backup repository?"And if you're like me, exploring the Object Storage, you've also asked:"Wait... who is that GUID? And why is there data from an organization I deleted months ago still sitting there?"Spoiler alert: I found several GB of orphaned backup data that I could safely delete. But more on that little adventure later. Let's go!The Challenge: Understanding What's Really in Your Object StorageHere's the thing. Veeam Backup for Microsoft 365 stores backup data in object storage using a folder structure based on GUIDs. If you've ever opened your S3 bucket or Azure container and looked inside, you'll see something like this:Veeam/Back

When running self-hosted applications in a homelab or on-premises environment, HTTPS is often the first thing to fall through the cracks. Self-signed certificates trigger browser warnings, and public certificate authorities like Let's Encrypt require your services to be internet-accessible. The solution? Run your own internal Certificate Authority.However, this is not a difficult problem to solve. Just setup an internal PKI using Step CA running as a rootless Podman container, then extend it to issue certificates for services on your network. In this first part, we'll focus entirely on getting Step CA up and running — initializing the CA, configuring automated certificate issuance, and setting up a systemd timer to handle renewals without any manual intervention.Create a new podman network for step-capodman network create ca-servicespodman network lsCreate a CA volume and Quadlet (quadlets are the preferred method for starting Podman containers:podman volume create step-camkdir -p ~/.c

With the High Availability feature in Veeam Software Appliance 13.0.1, Veeam provides a neat way to make the backup server highly available. In this blog post I’ll briefly show how to configure HA, which prerequisites must be met, and what alternatives exist if HA cannot be used. Intro - The Basics The feature itself reduces downtime of the backup server in the Veeam Software Appliance. In general, two nodes are required; they can synchronize even across relatively high latencies. A manual switchover is possible, and a major advantage is automatic updates for both nodes. The goal is to offer fast disaster recovery without the need to keep a dedicated standby backup server, and then finally to restore the configuration backup. (https://helpcenter.veeam.com/docs/vbr/userguide/high_availability_hiw.html?ver=13) Requirements The following components are required for this feature:  Two Veeam Software Appliances At minimum, Veeam Data Platform — Premium licensing (the package that includes

In the final article of this three-part series, we’ll explore how proactive operations with Veeam can help organizations reduce downtime and enhance data protection.By the time you reach this point, things feel different.You’re no longer chasing failures.You’re no longer guessing recovery times.You’re not constantly reacting to alerts.Instead, your Veeam environment starts to feel… predictable.That’s the goal.But scaling proactive operations isn’t just doing the same things on a bigger environment.It’s about operating with intention, consistency, and confidence—no matter how large things get.This is what that actually looks like in practice. 1. Health Is Measured, Not AssumedAt scale, you don’t rely on “it looks fine.”You rely on metrics and trends.What you know at any given time:Job success and warning rates Backup window utilization Repository performance and latency Growth trends across all storage tiersThe difference:You’re not asking:“Are backups okay?”You already know.Because you

Microsoft BitLocker Administration and Monitoring (MBAM) and Advanced Group Policy Management (AGPM), both part of the Microsoft Desktop Optimization Pack (MDOP), have officially reached end of support as of 14 April 2026 (today). From this point forward, Microsoft will no longer provide security updates, bug fixes, or compatibility assurances for these tools, similar to the lifecycle outcome observed with Microsoft Deployment Toolkit (MDT).Organizations that continue to rely on MBAM and AGPM must now assess risk exposure, validate operational dependencies, and define a transition strategy toward supported alternatives to maintain security, compliance, and long-term manageability.To help you transition away from MBAM and AGPM, I have outlined practical and supported alternatives in the following guides. These articles provide a deeper dive into modern solutions and implementation approaches you can adopt moving forward.https://techdirectarchive.com/2026/04/14/agmp-extended-support-ends

IntroductionTo enable monitoring of your Veeam Software Appliance (VSA) with VeeamONE, the Veeam Analytics Service needs to be deployed on the VSA.The Veeam Analytics service not only enables communication with Veeam Backup & Replication servers to collect data but also allows to send remediation commands.Since the VSA is secure by design (hardened Linux-based OS, DISA STIG compliance, automated patching…) and that it enforces Zero Trust principles with role-based access control, SAML SSO, and certificate-based pairing, it is important to know what are the available options to connect VeeamONE securely. In this article, we will cover 2 methods of connection and highlight their pros and cons:Via the Veeam Analytics Service Offline BundleORManaged by VeeamONE via the Data Source Wizard Connecting to the VSA with the Offline BundleThe advantage of using the offline bundle is that you don’t need to store VSA credentials anywhere. Simply hand off the bundle to your Veeam Backup and Repl

Choosing the right object storage for backup and ransomware protection is not just about capacity — it’s about immutability, compliance, operational simplicity, and cost predictability.Here’s a clear comparison of three common approaches when using Veeam Backup & Replication: ✅ Veeam Vault (AWS/Azure)Designed as a managed STaaS offering, Veeam Vault delivers always‑on immutability, built‑in encryption, and a logical air‑gap by design. It integrates natively with SOBR and Capacity Tier, offers predictable per‑TB pricing, and removes infrastructure management overhead from the customer. ✅ Native AWS S3 / Azure BlobProvides strong integration and scalability, including Object Lock / immutable containers and support for compliance mode. However, immutability and air‑gap depend heavily on correct configuration, IAM design, and governance. Pricing is consumption‑based, which can introduce cost variability (“bill shock”). ⚠️ OCI Object Storage (S3‑compatible)While usable as an S3‑compatib

Backups without notifications are like monitoring without alerting: you can live with it—until the day you can’t.Veeam Backup & Replication (VBR) and Veeam Backup Enterprise Manager (VEM) can send automated emails, for example when an event is triggered, like:Job success/warning/failure  Infrastructure warnings Licensing/support notificationsThe goal: you find out about problems as soon as they happen.(And yes: “no news” are also news—but only if you’re sure your email delivery is actually working.) Veeam Doku: E-Mail-Settings & Notifications (VBR v13)https://helpcenter.veeam.com/docs/vbr/userguide/pve_email_settings.html?ver=13VEM Doku: Email-Settings & Notification (v13)https://helpcenter.veeam.com/docs/vbr/em/notifications_ms365.html?ver=13 “Can’t I just enter an SMTP server + username/password and be done with it?” For several years, that was actually the only way—and of course it can still work today. This classic approach is called SMTP server (basic authentication).V

In Part 1, we talked about the difference between reactive and proactive Veeam operations.But knowing the difference is the easy part. The real question is:How do you actually make the transition—without overhauling everything at once?Because most environments can’t just stop and rebuild.They have to evolve.This is how you do it—step by step, without creating more chaos in the process. Step 1: Get Visibility (You Can’t Fix What You Can’t See)Before you change anything, you need a clear picture of where you are.Start with:Job success vs warning vs failure rates Backup job durations (are they increasing?) Repository capacity and growth rate Restore success history (if any exists)The goal:Understand your baseline.Not what you think is happening—what’s actually happening.Proactive operations start with awareness. Step 2: Clean Up the NoiseMost reactive environments have one thing in common:Too many alerts. Too many warnings. Too much noise.Do this next:Review all current warnings Fix what

 Introduction: A Journey That Started with 3-2-1-1-0Five years ago, I published my first Veeam community post about the 3-2-1-1-0 golden backup rule. That post marked the beginning of my journey as a Veeam Legend.Back then, the rule was already considered best practice. Today, it is still relevant — but no longer sufficient on its own.The threat landscape has evolved. So our backup strategies need to follow.The Foundation Still MattersThe 3-2-1-1-0 rule remains the baseline:3 copies of your data 2 different media types 1 offsite copy 1 immutable or air-gapped copy 0 errors (verified recoverability)✔️ This model protects against hardware failure✔️ It addresses human error✔️ It covers traditional disaster scenariosBut here’s the reality:⚠️ Attackers now design their operations specifically to break this model.What Changed? (And Why It Matters)1. Backups Are the First TargetModern ransomware attacks:Target backup servers first Delete or corrupt backup chains Exploit APIs and credentialsBa

 In a recent customer project, I was allowed to perform a new installation of the Veeam Recovery Orchestrator (VRO). The installation itself was initially completely inconspicuous – but on a German-language Windows Server operating system, which later turned out to be a decisive factor.Immediately after the installation, we authorized the local administrator group within the Onboarding-Wizard to access the VRO system. So far, so good. Or so we thought! The result: No user who was a member of the local administrators group was able to log on to the VRO system.  Error: Access denied for the user 'User-within-local-Administrators-Group': the provided credentials are invalid or the user has insufficient privileges.This meant that we were locked out immediately after installation.   Troubleshooting: A look behind the scenesAfter a short analysis, it was clear: We won't get anywhere with the web UI at this point. So we decided without further ado to take a targeted look at VRO's SQL database

Hello, veeamazing community,I am back with another Veeam Vanguard Newsletter packed with tons of great content! Go and check yourself what articles published our veeamazing Vanguards during the month of March!  Across these articles and videos, the authors cover a broad set of Veeam platform operations, security, and community themes: from urgent Veeam Backup & Replication (VBR) patching and remediation of critical CVEs (including guidance to update promptly) to platform upgrade and maintenance tasks such as upgrading embedded PostgreSQL and step-by-step Veeam v13 suite upgrades (Veeam ONE, Enterprise Manager, Recovery Orchestrator, and VBR). Several posts dive into v13 architecture and hardening, including Veeam Software Appliance / VSA customization via config files (instead of Windows registry), port customization concepts, and High Availability with VSA HA cluster setup plus Veeam ONE monitoring using alarms/dashboards and REST API automation. The list also includes practical h

You might have missed it but this week Mr. Cloud Connect published a blog about setting up a test KMS server! Exactly a Month ago I was thinking the same thing and found it to be a world of pain. At the time I tried PyKMIP and Cosmian but had major issues. Then I tried vibe coding a KMS DIY server with my buddy Claude (well at times buddy at others arch enemy!!). I got to the point where Veeam accepted the KMS server but then the job would fail. ​@LDelloca did what folks at his level simply do, forked the old PyKMIP and added the bits and pieces needed! He is not known as Mr. Cloud Connect for nothing, see his blog here: https://www.virtualtothecore.com/fixing-pykmip-for-veeam-integration/My home lab is not big so I try to do everything in containers and for this I looked at his forked github repo and with the help of claude containerized it. THIS IS NOT MEANT FOR PRODUCTION! Just for Lab Learning! Clone Luca’s repo on your podman host: git clone https://github.com/dellock6/pykmip-veea

 1. Two Backup Methods, One Recovery Console Veeam provides two distinct methods for backing up Oracle databases. The first is image-level backup with application-aware processing, where VBR takes a VM-level or agent-level backup and handles Oracle archived redo logs as a guest processing subtask. The second is the Veeam Plug-in for Oracle RMAN, which integrates directly with Oracle's native Recovery Manager and sends backup data to a Veeam repository through the RMAN SBT (System Backup to Tape) interface.Both methods feed into the same recovery tool: Veeam Explorer for Oracle. Explorer can restore databases from either backup type through a single interface. The key difference is what each method captures and what recovery options each enables.  Capability Image-Level Backup RMAN Plug-in Backup scope Entire VM or volume (includes OS, Oracle binaries, database) Database only (data files, control files, archived logs) Point-in-time restore