I recently worked on another project with a major customer where we unfortunately reached the limits of Veeam Backup & Replication’s out-of-the-box features for Scale-Out-Repositories and had to find a workaround.
Our Challenge
Our challenge: The customer has over 100 scale-out repositories, each with different permissions depending on the application and operating system. We had to migrate the VBR server to a new Windows Server. However, this also meant that the users created locally on the old server were no longer available. In principle, this wasn’t a problem—we simply recreated the same users on the new server.
However, this is where the problem comes in. The SOBR permissions include the old user as “OLDSERVERNAME\USERNAME,” which we then have to replace with “NEWSERVERNAME\USERNAME.” If we didn’t replace these, our Enterprise Plugins would no longer have permissions to write their backups.
Unfortunately, there is no function to change permission settings across multiple repositories simultaneously.
If I only have two or three repositories, I can just click through and switch users, but with so many repositories, that’s not possible.
What did we do?
We’ve been thinking about what the best approach would be. Since we know both the old and new users, it would be helpful to have a script where I could specify the old and new users, and the script would read the permissions and then replace them with those of the new user.
Building a script and how does it works:
So we built a script that does the following:
- Loads the Veeam.Backup.PowerShell module and connects to the local Veeam Backup Server if no session is active.
- Interactively prompts the operator for the OLD user (to be removed) and the NEW user (to be added). Both must be entered in the DOMAIN\Name format (DOMAIN\User or DOMAIN\Group or SERVERNAME\User or SERVERNAME\Group).
- Enumerates all Scale-Out Backup Repositories via Get-VBRBackupRepository -ScaleOut and reads each SOBR’s access permissions via Get-VBREPPermission.
- Filters the result to SOBRs whose PermissionType is “OnlySelectedUsers” AND whose user list contains the old user. SOBRs set to “Everyone” or “NoOne” are skipped because they do not maintain a user list.
- Prints a preview of the planned changes per SOBR (which user will be removed, which user will be added, and the current user list).
- Asks the operator to confirm (Y/N) before any modification is made.
- On confirmation, calls Set-VBREPPermission for every affected SOBR with the rebuilt user list (old user removed, new user appended if not already present), keeping the PermissionType at “OnlySelectedUsers”.
- Re-reads the permissions from Veeam after the run and prints the resulting state of every processed SOBR so the operator can verify the outcome without opening the Veeam console.
Example
I recreated the whole thing in my lab to take some screenshots.
1. Old user:
2. Script run
3. New/Changed User
Link to the script
I’ve made the script available on my GitHub. Feel free to test and use it.
🔗 petersteffan/Swap-VeeamSOBRUser: Replaces a user (or group) across the access permission lists of all Veeam Scale-Out Backup Repositories (SOBR).
Disclaimer
I expressly state that neither I nor Veeam provide support for this script, and you run it at your own risk
Original post on my blog: Veeam: Swap-VeeamSOBRUser - petersvirtualworld.de
