Events
Groups
Leaderboard

EN

VeeamON 2024 - Use Code "COMMUNITY10" for 10% Off!

3 months ago

Community
Search

Topics started by SteveHeart

34 Topics

Recently active

Most views Most replies

SteveHeartVeeam MVP

posted in YARA and Script Library

Powershell - VBR 12.1 - Guest Index Data Scan Manager

IntroFirst of all: Happy new year to everyone!With Veeam Backup & Replication 12.1, many new security features have been added. One of these is the Guest Index Data Scan. For this, Veeam Backup & Replication uses a signature-based approach. During/after the backup job, the following malware activity can be detected:- Malware signatures specified in the "C:\Program Files\Veeam\Backup and Replication\Backup\SuspiciousFiles.xml" on the backup server- Multiple files renamed by malware- Multiple files deleted by malwarePlease read the Help Center documentation to learn more about the details and how it works.In addition to the XML file, manual customization is also possible. You can add a malware signature that is marked as suspicious (Suspicious files) or that should be skipped (Trusted files) during the scan. See here. Questions you might askBut how do you know how many "built-in" and how many manually entered entries there are? Of course you can check the manual settings in the

SteveHeartVeeam MVP

posted in YARA and Script Library

Powershell - OneDrive for Business File Scanner

Hello Community!It's been two years since I published a script for a OneDrive for Business file check in this community. And even back then I had the code ready that also checks recovered files for possible malware. Of course, Microsoft 365 also has certain mechanisms, which are documented here.Trust is good, control is betterI have now taken up my idea again and packed it into a new script. The script restores files from the lastest OneDrive for Business restore point and scans them for threats using Windows Defender. A single file can also be restored and scanned.There is a "beautiful" listing when the scan has detected something.Please read the README document on my GitHub for more details on how to use the script.⛔Important!⛔ Make sure that there is sufficient disk space in the directory where the files are to be restored. Also use an empty directory to save the data, as the script cleans everything up after execution.Question to the communityWhat do you think of a script that rest

SteveHeartVeeam MVP

posted in YARA and Script Library

Powershell - Automating Tape Verification in Veeam Backup & Replication

A tape verification a day….😉Tape backups are an essential part of data protection strategies as they provide reliable security and offline storage capabilities. However, ensuring the reliability and consistency of tape backups can be critical for regulatory compliance and ensuring data integrity.So I wrote a Powershell script (which has been floating around in my head for a long time) that uses the available Powershell cmdlet "Start-VBRTapeVerification" to regularly check tapes available in a media pool and marks them as checked with time stamps and checks the tapes again after a certain time (default 270 days). It also helps to increase data reliability and reduces the manual effort involved in managing tape backups. The script can be downloaded here.The following parameters can be utilized to customize the tape verification:MediaPool: Specifies the media pool from which tapes will be selected for verification. This parameter is mandatory. NumberofTapes: Determines the number of tape

SteveHeartVeeam MVP

posted in YARA and Script Library

Powershell - VBR Backup Scan - Updates

Hello community,you probably know my many scripts on the subject of backup data scanning? I am happy to share with you what I am currently working on.Secure Restore / Scan BackupCurrently "only" Microsoft Windows machines can be scanned using Secure Restore or Scan Backup (see here). However the Disk Publishing (Data Integration API) allows us to publish a disk from different types of backups to a Windows or Linux host. The disk can have a Microsoft Windows, Linux, Unix or other file system. On top Veeam Backup & Replication v12.1 gives us many more options for scanning backup data. For example we now also can mark restore points as clean, suspicious or infected using a PowerShell cmdlet. What if i were to extend one of my scripts with this function? Said and done!New Script - New FeaturesThe new script presents all existing restore points from a Linux VM, Windows VM or Agent backup to a Linux host, scans the specified restore point and marks the selected restore point as infected

SteveHeartVeeam MVP

posted in YARA and Script Library

Powershell - VBR Backup Scan - YARA ready

Hi Community,after Rick's announcement (thanks for the initiative), I couldn't resist creating another script for the community.As documented, you can add one YARA rule file to the scan process. But what if you want to use multiple YARA rules? Of course you could work with a so-called index file, which refers to the individual YARA rules, but this brings a problem with it, because the YARA rules are stored on the VBR server, but the scan process provides the backups on the mount server and only one YARA rule can be used (This is a topic for another blog post - stay tuned). What if we would like to use all YARA rules from Rick's Top 10 Ransomware Threats blog post for a scan? And we don’t want to click so many times in the UI? This Powershell script can help. You can select all YARA rules, only selected YARA rules or all YARA rules if no selection has been made after 30 seconds. The script needs the backup job name and the hostname which has to be scanned. .\vbr-scan-backups.ps1 -Jobn

SteveHeartVeeam MVP

posted in YARA and Script Library

Powershell - Restore VBR Configuration Database - V12.1

With Veeam Backup & Replication (VBR) 12.1 it is possible to restore the Configuration Database using Powershell. Basically a simple task, if there weren't a few things to consider. Challenge accepted!My SetupLet's prepare for the scenario where the primary VBR is no longer available and the configuration database needs to be restored on another system with a different hostname (standby VBR). On the primary VBR, the configuration backup was encrypted according to the best practices and MFA was also activated for part of the users. The configuration database runs on PostgreSQL.I had the following thoughts before creating the scriptCheck that only the necessary Veeam services are running on the standby VBR server Check if the response file has the proper entries (e. g. not automatically starting the Veeam services after the restore) When MFA is enabled/used, updates must currently be made to the database after restoring the configuration DB (see here) The encryption password should n

SteveHeartVeeam MVP

posted in YARA and Script Library

Veeam Backup for Microsoft 365 - Azure/Entra Application Creation Script

A long time ago, my colleague @StefanZi had provided a Powershell script to create the necessary Azure/Entra appplicaton to be used in Veeam Backup for Microsoft 365. In the meantime, new permission requirements have been added to this application and the Powershell cmdlet AzureAD will also be retired next year (see here), and one of my Powershell scripts also requires the automated creation of an application in Azure/Entra.These were enough reasons for me to update the script. So what's new?- Use of the Microsoft Graph Powershell Module- Revise and add permissions- Adaptations to the text (e.g. adapted product name)- Optimize outputAnd the good news are. Script is ready to use. More details in my GitHub repository here.Enjoy!Steve

SteveHeartVeeam MVP

posted in YARA and Script Library

Entra ID Protector - A new Powershell script on the horizon

NewsI would like to share with you a recipe from my "Script Kitchen" that I'm in the process of matching ingredients to. The question I asked myself: Do you really need to protect your Entra ID tenant(s)? My answer: see below ;) IntroEntra ID stores a variety of settings and policies that are important to the continuity of your business. Anything that compromises your Entra ID configuration can result in an immediate loss of access to data and applications. So how about exporting the information to another location so it can be analyzed and imported or reconfigured if something bad happens? And how about adding a retention to the exported data?Microsoft provides some built-in retention mechanisms (Recycle Bin), but these mechanisms are not enough to meet the needs of most organizations. The Recycle Bin stores deleted objects such as users and groups for 30 days. Some limitations which I associate with it:- After 30 days the deleted objects are permanently deleted and cannot be recovere

SteveHeartVeeam MVP

posted in VUG Switzerland

HALLOVEEAM 2023 - 31. Oktober 2023 -14:00 Uhr

Hallo zusammen,eine Möglichkeit, sich wieder physisch zu treffen (Nein, ich werde nicht dabei sein). Die Veranstaltung findet im sektor11 and der Siewerdtstrasse 71 in Zürich statt. Die Agenda sowie die Anmeldung zum Event hier! Steve

SteveHeartVeeam MVP

posted in YARA and Script Library

Veeam Backup & Replication - File Level Restore - Hash Scanner

Hello community,the Backup Scanning Tools Web Console got a new buddy: 📃🔎 File Level Restore - Hash Scanner 📃🔎 This Powershell script scans specific subfolders within a Veeam File Level Recovery session and checks if any of the scanned files match a SHA256 value by comparing the values to a list of known hash values. Common locations for temporary Internet files in Windows systems are scanned. The list can be supplemented at any time.The following subdirectories in the Users folder are scannedDownloads AppData\Local\Temp AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data AppData\Local\Google\Chrome\User Data\Default\Cache AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupThe script has been integrated into the Backup Scanning Tools Web Console, but can also be run manually. On top you'll also get this script:vbr-flr-auto-hashscanner.ps1This script automates the execution of the scans Windows VM included in a specific backup job. The number of VMs to be scan

SteveHeartVeeam MVP

posted in YARA and Script Library

Backup Scanning Tools Web Console

🌟 Introducing the Backup Scanning Tools Web Console! 🌟You wanted it! - I got it! How to Get Started The Backup Scanning Tools Web Console is also downloaded from the installation script (see original post).Before you start the script, you must open the backup-scanning-tools-webmenu.ps1 script file with a text editor and adjust the following variables:$scanningToolsPath Set this variable to the path where the individual scanning scripts were installed, e.g., "D:\Scripts\vbr\scanningtools".$LogFilePath Specify the path for the log file (default is "C:\Temp\log.txt"). The script includes optional parameters that you can customize according to your preferences. These parameters are as follows:$Port Set the port number for the web server (default is 8080). $RefreshInterval Define the interval (in seconds) for refreshing the web page (default is 300 seconds)You can also pass the parameters when starting the script. More details in the README document.And Y

SteveHeartVeeam MVP

posted in YARA and Script Library

Backup Scanning Tools Menu

As already announced (see here), the first draft of the Backup Scanning Tools Menu has just been made available in my GitHub repository. This script is designed to provide a user-friendly, menu-driven interface for triggering the various backup scan tools that I have provided in the past. It allows the user to choose from a number of options, each corresponding to a specific type of backup scan. The script provides detailed descriptions of each scan operation before prompting the user to enter the required parameters for execution.Besides the actual Scanning Tool Menu script I also created an installer script that "installs" all necessary scan scripts into the selected directory.InstallationFollow these steps:Download the Installer Script Download the backup-scanning-tools-installer.ps1 script to your local machine. Open a PowerShell terminal with administrator privileges Run the Installer script Execute the backup-scanning-tools-installer.ps1 script with the required parameter -Instal

SteveHeartVeeam MVP

posted in Cyber Security Space

Backup Scanning Tools - Part II

Hello community,take a look at the first draft here. Feedback welcome!Happy scanning!Steve

SteveHeartVeeam MVP

posted in VUG Switzerland

Sommer, Sonne, Scanning!

Hallo VUG Switzerland,Sommer, Sonne, Scanning! Um wieder ein bisschen Aktivität in diese Gruppe zu bringen, möchte ich gerne ein wenig Werbung für diesen Post machen. Eine Veeam100 Online Session is gelant. Stay tuned!Cheers,Steve

SteveHeartVeeam MVP

posted in YARA and Script Library

Veeam Backup & Replication - SureBackup - HTTP Proxy Configuration for Linux Virtual Machines

IntroductionOne of the standout features of Veeam Backup & Replication is SureBackup, which allows for the automated testing and verification of backups. SureBackup creates isolated environments, called Virtual Labs, to ensure the recoverability of your virtual machines. During a SureBackup session, it sometimes would be helpful to connect the virtual machines to the Internet By default, the VMs within the Virtual Lab run in an isolated environment and do not have access to the Internet. If you want the VMs in the Virtual Lab to access the Internet, select the Allow proxy appliance to act as an Internet proxy for virtual machines in this lab check box. See Setup Proxy Appliance and Veeam KB1165.With the HTTP proxy settings in place, you can easily download security patches, update antivirus definitions, and install software updates on your Linux VMs. With this you can enhance your software testing and patching processes, streamline deployment workflows, verify compatibility, and

SteveHeartVeeam MVP

posted in YARA and Script Library

vbr-staged-restore.ps1 - Powershell script for Staged VM Restore

SummaryAnother powerful PowerShell script that leverages Veeam Backup & Replication to simplify the process of restoring virtual machines. With this script, you can perform staged VM restores. The script automates the entire process, from connecting to the Veeam server and listing available restore points to selecting a restore point and initiating the restore process. The script Download hereThe script is highly customizable and utilizes several parameters to tailor the restore process to your specific needs. Let's take a closer look at these parameters:ESXiServer: Specify the name of the target ESXi server where the VM will be restored. This allows you to choose the appropriate destination for the restore operation.VMName: Provide the name of the VM that you want to restore. This ensures that the script locates the correct VM during the restore process.Jobname: Enter the name of the Veeam backup job that contains the VM you wish to restore. This parameter helps the script identif

SteveHeartVeeam MVP

posted in Cyber Security Space

Backup Scanning Tools

Hello community,in the past months I've shared a few scripts in the community script library, which among other things could scan the backups for threats. Now that there is another tool/script in the pipeline I thought it might be useful to control all the "scanning scripts" via a selection menu. In this way, the corresponding parameters can also be queried for the various script functions.Down below a picture of the first attempt (Menu items not complete yet 😉 ). Now I would like to hear from you if the tools are used and if the menu would be helpful. Feedback welcome! And before I forget: The new script in the pipeline uses Instant VM Disk Recovery to present disk(s) to an "empty" VM, which then starts a Rescue CD. This allows different scan scenarios to be run. Sounds cool?Happy Monday!

SteveHeartVeeam MVP

posted in YARA and Script Library

VeeamONE - Suspicious Increment Size - Remediation Action Script

IntroYou know the stories: Sometimes an incorrect keyboard layout can lead to incorrect entries. Or while coding, , you must make sure that you use the correct special characters such as ' or ", etc. But let's focus on the main topic - Veeam ONE AlertsVeeam ONE Alert - Suspicious incremental backup sizeYou probably know this Veeam ONE Alert: Veeam ONE Alert - Suspicious incremental backup size. What many may not know is that you can configure Veeam ONE to perform remediation actions when alerts are triggered. These actions can be performed automatically or after manual approval.Veeam ONE offers the following types of remediation for alarms:Predefined actions that are configured for the most commonly used out-of-the-box alarms. Custom scripts that you can specify in the settings of any alarm. For each severity level, Veeam ONE can run one or more custom scripts.For the Suspicious incremental backup size alert we do have a predefined action available: Predefined RemediationA SureBackup

SteveHeartVeeam MVP

posted in VUG Switzerland

A must read - Veeam Hardened Repository

Hello everyone,presented at VeeamON in Miami:All-Demo Session for Veeam Hardened Repository Playlist Steve

SteveHeartVeeam MVP

posted in YARA and Script Library

vbr-securerestore-lnx.ps1 - Secure Restore for Linux VM

As the proverb says, "A script a week keeps the doctor away". This week, we'll turn our attention to the Veeam Data Integration API. The idea for the script was to program a kind of SecureRestore for Linux VMs. There are many blog posts about the Data Integration API together with Linux, but nowhere could I find a script that covers the following requirement:Restore a Linux VM with prior AVscan. Abort the process if a virus is found, otherwise do the restoreLet's start…PrerequisitesInstall the latest Win OpenSSH package on the host where the script will be used Win32-OpenSSH Generate a public/private key pair using PuTTYgen A Linux server with ClamAV installed (I used Ubuntu 22.04 LTS) Add the Linux server to Veeam Backup & Replication using the generated key: Add Linux Server A Backup Job protecting the Linux VM as well as a restore point (the script uses the latest for the Restore)How to install ClamAVA quick guide to install ClamAV on the Ubuntu serverUpgrade your package listsu

SteveHeartVeeam MVP

posted in YARA and Script Library

vbr-nasjob-scanner.ps1 - VBR- Report unexpectedly high number of files that have been backed up

Good Monday everyone! Another week, another script 😉 This time for the Veeam file share backup jobs.IntroAlso last Friday another script was ready for release, but I didn't want to "interrupt" the World Backup Day celebrations with a dull script ;) And my last script also caused quite some buzz in our backup world:vbr-job-scanner-ps1And I promised that more will come... The scriptIn my GitHub repository you can find a script that checks if a unexpectedly high number of files have been backed up via file share backup compared to the last times. There are two versions of this script:vbr-nasjob-scanner.ps1 - For manual checks vbr-nasjob-scanner-post-script.ps1 - For use in the Backup Job as a post-script Details and instructions on the readme page.Feedback welcome!

SteveHeartVeeam MVP

posted in YARA and Script Library

vbr-get-jobcfg.ps1 - Quickly show Veeam Backup Job Configuration Settings

Spring is here 💐 and with it comes another script. This time for Veeam Backup & Replication.The script shows different job configuration settings and can be used to quickly identify differences in job settings.The Readme and code lines can be found in GitHub:Bits & BytesMore to come depending on your feedback (I already got one related to NAS backup)

SteveHeartVeeam MVP

posted in YARA and Script Library

vbr-job-scanner.ps1 - Veeam Backup & Replication - Report Suspicious Backup File Size

IntroIn the past I’ve shared some scripts with the community which were related to security stuff. Among my many ideas (I should put down on paper everything that is buzzing around in my head), someone recently asked in our internal Teams Veeam MVP chat the following question: "Can somebody please integrate VONE's Suspicious Backup file size and job duration alarm into VBR?" Friday MoodI try to keep every Friday afternoon free for some exciting projects. Most of the projects are related to customer or partner requests that can’t be handled directly with Veeam products. So, last Friday's slogan was "It's Friday again.....". (Who knows the song?)My approach was to create two scripts. One for manual execution, the other for integration into existing backup jobs with the possibility to display the result in the backup job statistics. The ResultPlease have a look into Brad's post, who was asking for the possibility to identify this in VBR: Linch TipsRelease v1.1 of the script will include t

SteveHeartVeeam MVP

posted in YARA and Script Library

vb365-exo-recovery.ps1 - A delicious recipe for many occasions

Hello Community,imagine you no longer have access to your most important Exchange Online mailboxes? Or you want to perform some checks, but you don't want to touch the productive mailboxes and your production Microsoft 365 tenant? What if a script and Veeam Backup for Microsoft 365 could help you?Down below is a simple recipe.IngredientsVeeam Backup for Microsoft 365 An Exchange Online backup job protecting the mailboxes A second Microsoft 365 tenant with already configured (target) mailboxes A configured Azure AD application in the second Microsoft 365 tenant A CSV file with the mailboxes to be copiedThe script with all information can be downloaded here: ScriptIf the destination mailbox is empty, all objects are restored. If the objects already exist, only missing objects will be restored.Please share what else could be achieved using this script.

SteveHeartVeeam MVP

posted in Discussion Boards

Configure Exchange Online Certificate Based Authentication to automate the Exchange Online PowerShell scripts

Hello Community,you probably already use the Powershell scripts shared with the community and run them unattended. In the past, unattended sign-in required you to store the username and password in a local file or in a secret vault/txt-file that’s accessed during run-time. But, as we all know, storing user credentials locally is not a good security practice. Microsoft will also disable access via Remote Powershell (RPS). See the following link for more details: https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-deprecation-of-remote-powershell-rps-protocol-in/ba-p/3695597So why not hit two birds with one stone?The MissionThis post will talk about how to configure Exchange Online Certificate Based Authentication (CBA) to automate Exchange Online PowerShell scripts. PrerequisitesPlease make sure you meet the following requirements:Access to a Microsoft 365 tenant with Global Admin permissions A certificate. You can use a self-signed certificate A Windows system with Po

1
2

Page 1 / 2

Badge winners

tarik.yeniseyhas earned the badge Veeam University Pro
messherhas earned the badge VMCE Certified
bojanthas earned the badge Veeam University Pro
mohammad.zubairhas earned the badge Veeam University Pro
benharmerhas earned the badge Vanguard

Show all badges

Powered by Gainsight

Terms & Conditions

Sign up

Already have an account? Login

Log in with your Veeam account

Login to the community

Log in with your Veeam account

Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.

Username or e-mail

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK