YARA and Script Library

[Array]$RepoList = Get-VBRBackupRepository | Where-Object {$_.Type -ne "SanSnapshotOnly"} [Array]$ScaleOuts = Get-VBRBackupRepository -ScaleOutif ($ScaleOuts) { foreach ($ScaleOut in $ScaleOuts) { $Extents = Get-VBRRepositoryExtent -Repository $ScaleOut foreach ($Extent in $Extents) { $RepoList = $RepoList + $Extent.repository } }}$RepoList | Select-Object Name, Path, `@{Name="CachedTotalSpaceGB"; Expression= {[Math]::Round([Decimal]$_.info.CachedTotalSpace/1GB,2)}}, `@{Name="CachedFreeSpaceGB"; Expression= {[Math]::Round([Decimal]$_.info.CachedFreeSpace/1GB,2)}} | Format-Table -AutoSize 

Hi guys, I was wondering if it is possible to enable the encrypt option for all backup jobs using powershell. I already have created the encryption key/password.  Your help would be appriciated. 

Hi, Good evening.I am analyzing different Veeam Backup & Replication instances and I would like take all parameters for every backup job present on every VB&R instances that I am analyzing.I would like to know if is possible launch one powershell script  for retrieve these values for example: start time for every schedule job, servers involved, backup modality (full, incremental, reverse incremental, etc) aware setting if exist, etc.Thanks in advance.Best regardsRicardo

Hi all, I am looking for the way to manage the number of concurrent tasks on repository. Two questions regarding it.I was expecting it to be the option of CBackupRepository object but doesn’t seems so. So how to retrieve the current configured number? Whats the difference between LimitConcurrentJobs and MaxConcurrentJobs options in Set-VBRBackupRepository commandlet and which on is actually reflect the option in UI?Cheers,Alexey

Hi all, I’ve been toying around with the idea of a cli tool that works with everything and is related to the other post I put up today on the Go-Veeam-Auth that does authentication for all Veeam APIs. Anyway, I’ve come up with vcli a simple terminal app written in Go, allowing you to switch between APIs with minimal effort quickly. All the authentication is set up, so all you need to do is set some environmental variables, and off you go (no pun intended).The main output is JSON, but you can switch it over to YAML via a --yaml switch.The tool only does GET requests at the moment, as I wanted to gauge the interest before committing any more time to the project. Where the power really comes in when it is coupled with “nushell” which is a data-centric approach to shells. It makes manipulating json response objects a breeze and also allows conversion to other data formats. It also has a whole module system which I go into a bit on my GitHub. GitHub page: https://github.com/shapedthought/vc

Special thanks to our dear Veeam Support Team Members Cosmin Ciobanu and Marius Nita for the following trick! Veeam Support is _always_ looking for ways to make everyone’s lives easier.Currently, to generate an HTML report for many sessions at once you need to go to the Session tab in the UI and ctrl / shift + click on desired sessions; not always convenient, and for Transaction Log backup sessions in particular you may have hundreds (if not thousands) of sessions.With Powershell and a bit of prep work, you can do this automagically: Preparatory Step:From a Windows-based backup server, copy the following filesCopyC:\Program Files\Veeam\Backup and Replication\Backup\SessionReport.xsltC:\Program Files\Veeam\Backup and Replication\Backup\SqlSessionReport.xsltto the following path on the machine where you will generate the report with Powershell:Windows:C:\Program Files\PowerShell\7\Linux:/opt/microsoft/powershell/7/Both xslt files should be in the powershell/7 directory. Then run the foll

IntroIn the past I’ve shared some scripts with the community which were related to security stuff. Among my many ideas (I should put down on paper everything that is buzzing around in my head), someone recently asked in our internal Teams Veeam MVP chat the following question: "Can somebody please integrate VONE's Suspicious Backup file size and job duration alarm into VBR?" Friday MoodI try to keep every Friday afternoon free for some exciting projects. Most of the projects are related to customer or partner requests that can’t be handled directly with Veeam products. So, last Friday's slogan was "It's Friday again.....". (Who knows the song?)My approach was to create two scripts. One for manual execution, the other for integration into existing backup jobs with the possibility to display the result in the backup job statistics. The ResultPlease have a look into Brad's post, who was asking for the possibility to identify this in VBR: Linch TipsRelease v1.1 of the script will include t

One thing I’ve found as a Veeam customer is you often have to restart the VSS services on your SQL and other VSS aware servers. Here’s a script I wrote to do just that.# Name: Restart-VSS.ps1# Description: Restarts list of services in an array on VMs with a given vSphere tag. Helpful for Veeam B&R processing# For more info on Veeam VSS services that may cause failure see https://www.veeam.com/kb2041Import-Module VMware.PowerCLI$vcenter = "vcenter.domain.com"$services = @("SQLWriter","VSS")$tag = "myAwesomeTag"Connect-VIServer $vcenter$vms = Get-VM |where {$_.Tag -ne $tag}ForEach ($vm in $vms){ ForEach ($service in $services){ If (Get-Service -ComputerName $vm -Name $service -ErrorAction SilentlyContinue) { Write-Host $service "on computer" $vm "restarting now." Restart-Service -InputObject $(Get-Service -Computer $vm -Name $service); } }} 

The project announced here became even bigger. However, the Veeam Data Integration API remains the "main actor", except that many new options have now been added, as "my ideas factory" and feedback on a similar script have been incorporated. Let’s look at what’s NEW.📑 SearchThe host2scan parameter scans a selected restore point of the specified host. The repo2scan parameter can display all hosts with supported restore points in the specified Backup Repository. Then select a host and start the scan. NEW Or with repo2scan and the option all to scan the latest restore point for all found and supported host types in the specified Backup Repository. NEW🔍 Scan & StoreThe scan parameter triggers the malware and LOLBAS detection scan. The store parameter collects the metadata for all relevant binary files (ideal for hash analysis). NEW The yaramode parameter triggers a YARA scan using the stored rule(s). NEW📊 Display NEWThe data is displayed in a wonderful Streamlit Dashboard. In the pi

Hi thereI’ve been working on a module to make connecting to Veeam APIs a bit easier when using Python (yes I am a big fan).https://github.com/shapedthought/veeam-easy-connectComments, issues and pull requests welcome.Cheers, Ed

Not too long ago I had a customer who only had a Standard license which meant he didn’t have access to SureBackup, but had a need to validate a highly critical SQL database’s backups on a near daily basis. I figured it wouldn’t be too hard to write up a PS script that’d take some basic information about the source job name and database and where it needed to be restored and quickly sort by most recent and selecting it and kicking off the restore. That way he could just fire up the script when necessary. He ended up setting up a scheduled task where each day his DBAs would have the previous day’s backup restored next to the production database and they could do whatever verifications they needed. Easy peasy!Note: Tested and working in v10 & v11 (Should work just fine in v9.x as well, but not tested)<### Un-comment to enable debug output when troubleshooting script ###>#$DebugPreference = "Continue"<### Included for backward compatibility for servers still running pre-v10. #

Hi, everyone!   I have a PowerShell script that I use to retrieve some information about the daily backup sessions.  It works well, but I was trying to transition it from the Get-VBR-Job command to the Get-VBRBackup command.  Everything works but the newer script is very slow;  it went from a few seconds with the old script to 5-10 minutes with the new.  I was wondering if anyone could give me pointers on a more efficient way to get the session information or otherwise speed it up. Thanks in advance!!RobbOriginal script#backup JobsForeach ($JobObject in Get-VBRJob){ #write-host "loop number ${$jobobject.indexof()}" $session=$jobobject.FindLastSession() if (!($JobObject.JobType -eq "BackupSync")) { $JobOutput = New-Object -TypeName PSObject if (((get-date).AddDays(-1) -lt $session.Progress.StopTimeLocal) -or ($session.Result -in "Failed","None")) { $JobOutput | Add-Member -Name "Job Name" -MemberType Noteproperty -Value $JobObject.Name $JobOutput | Add-Membe

Hi Everyone, I'm sharing the script to collect the latest Malware Detection logs from specific lists of Veeam Backup servers in their default directory as the attachment with the server name at the end.When there is no new malware detection log file generated on the day, then no email will be sent out.You can update the $Servers and the $ParamSendmailMessage accordingly to suit your needs, as well as the CSS styling.$Servers = 'VBR01', 'BACKUP01', 'BKP-SVR', 'VBRSVR02'$LocalIPAddress = (Resolve-DnsName -Name $ENV:COMPUTERNAME | Where-Object { $_.Type -eq 'A' } | Select-Object -ExpandProperty IPAddress) -join ', '$Filter = '*.LOG'$paramSendMailMessage = @{ From = "$ENV:COMPUTERNAME@$env:userdnsdomain" To = 'your.email@veeam.com' Subject = "Malware report summary as of $(Get-Date -Format 'F')" SmtpServer = 'smtp.domain.com' BodyAsHtml = $true Priority = 'High'}$HtmlHead = @"<style> body { font-family: Calibri; }

Hello, This is a script to audit VBM365. Feel free to say what you would like if it’s missing :) I know it’s not “complete” # =======================================================# NAME: VBM365audit.ps1# AUTHOR: Commenge Damien, Axians Cloud Builder# DATE: 11/07/2022## VERSION 1.0# COMMENTS: This script is created to Audit Veeam backup for microsoft 365# <N/A> is used for not available# =======================================================$date = (get-date -Format "dd_MM_yyyy_HH_mm")#Create directoryNew-Item -ItemType Directory -Path "C:\temp\VBM365Audit\$date" -Force | Out-Null#ReportPath$ReportPath="C:\temp\VBM365Audit\$date"#Report file HTML path$htmlReportPath = "$ReportPath\VeeamBackupMicrosoft365.html"$HTMLCSS = @'<style>body{color:black;font-family:Vinci Sans Light;font-size:0.79em;line-height:1.25;margin:5;}a{color:black;}H1{color:white;font-family:Verdana;font-weight:bold;font-size:20pt;margin-bottom:50px;margin-top:40px;text-align:center;background-color:#005E

I hope you're all doing well.I'm reaching out to the community for some guidance. As a test, I recently used Veeam intelligence to scan our infrastructure.Based on the scan, Veeam intelligence created  the following rule:[rule CommonRansomware{    meta:        description = "Detects common ransomware families"        author = "Veeam Support Assistant"        date = "2023-10-01"    strings:        $locky = "Locky"        $wannacry = "WannaCry"        $petya = "Petya"        $notpetya = "NotPetya"        $cerber = "Cerber"        $cryptolocker = "CryptoLocker"        $cryptowall = "CryptoWall"        $badrabbit = "BadRabbit"        $ryuk = "Ryuk"        $maze = "Maze"        $revil = "REvil"        $darkside = "DarkSide"    condition:        any of them}the results scared me since it’s a bunch on files detected by this rule.  thanks in advance for reading 

is it possible to extract a single file from the most recent backup of a hyperV VM from a commandline utility?   It tried “extract.exe” and it appears to only extract EVERYTHING and actually restores the vhdx file.  Which I would then have to mount the vhdx somehow and extract the file I need. I’d like to run this from cmdline on a daily schedule. Any help greatly appreciated.

Hey All,I’ve tried to get some automation for the backup of my Citrix base images.  I have a script that adds a machine to the backup job based on the name.  Of course, these machines get created and deleted like flies, and I was wanting to automatically remove them if they’ve been removed from vCenter.  I guess I could use tags, but then I’d have to rely on my Citrix admin to use the tags, and if it’s forgotten then there’s no backup, so I’ve decided a script is the way to go. So adding machines to the jobs works wonderfully, but I can’t seem to nail the way to remove the machines that aren’t in vCenter inventory. I also have the auto delete from backups turned on to prune the base images after x days.   Here’s the snippet of powershell causing issues:#Searches the backup job to find any VM that don't have a size associated with the VM and assigns it to the variable  ie. VM is still in the job but the VM is deleted.$NullVM = Get-VBRJobObject -job $Citrixbackupjob | Where-Object -Prope

Hi Everyone, I’m sharing this script to find where the Veeam Agent is running in the AD domain.It uses ADSI so there is no need for the Active Directory module installation.You can change the first two lines to suit your needs in finding some other resources and the service name to check the status as well.$SPNKeyword = 'VeeamAgentWindows'$ServiceKeyword = 'Veeam' Try { $adsiSearcher = [adsisearcher]"(&(objectCategory=computer)(servicePrincipalName=*$($SPNKeyword)*))" $propList = 'CanonicalName', 'description', 'name', 'operatingSystem', 'ServicePrincipalName' ForEach ($prop in $propList) { [void]$adsiSearcher.PropertiesToLoad.Add($prop) } $adsiSearcher.FindAll() | ForEach-Object { Write-Host "Processing $($_.Properties['name'][0]) " -ForegroundColor Yellow [PSCustomObject]([ordered]@{ Name = $_.Properties['name'][0] Description = $_.Properties['description'][0] OperatingSystem = $_.Properties['operatingSystem'][0] IPAddresses

While presenting our powerful file share protection and recovery capabilities, I often show the Instant File Share Recovery feature. One possible purpose for this feature is scanning the share with an AV solution. For this, I created this script to be able to quickly show it to our customers and partners:https://github.com/yetanothermightytool/powershell/blob/master/vbr/vbr-nas-scanner/More to come....stay tuned 

Since I was tired to click roles together in vCenter server, I wrote a simple script on creating a vCenter role for Veeam with PowerCLI.This PowerShell / PowerCLI script lets you create a new vCenter server role with all the cumulative privileges and permissions to use them with Veeam Backup & Replication V10.The privileges used are based on the recommendations out of the Veeam Help Center which you can find here: Cumulative Permission for VMware vSphere – Veeam Help CenterSimply execute the script and follow the steps to fill in the relevant data like your vCenter server name, the username and your password. The script will then ask you to choose a name for your new role and automatically creates it. The script in actionThe script was successfully tested against:VMware vCenter 6.5 VMware vCenter 6.7 VMware vCenter 7.0You can read about this on my blog:https://www.virtualhome.blog/2020/04/22/creating-a-vcenter-role-for-veeam-with-powercli/The script is online at github: https://git

Last year Veeam Backup for Microsoft Office 365 v5 added purpose-built backup and recovery for Microsoft Teams. Since then many customer and partners asked me "How can we protect all of our teams and exclude specific teams objects based on names automatically?".As there is no filter logic within the UI for the Backup Job object exclusion list, I solved this "problem" using the script down below. First we store the credentials (encrypted) in a txt file:$credential = Get-Credential$credential.Password | ConvertFrom-SecureString | Set-Content <path to secure.txt>And here's the script. Just change the values for the following variables: $organizationname Name of the tenant - Only needed if more than one is configured$backupjob            Name of existing the Backup Job$filter                    Name of the team that needs to be excluded. Regular expressions can be used$userName            Username for retrieving the existing Teams in M365$passwordText       Path to the secure.txt fil

Hello Community!Your input is needed. Almost two years ago, I created a PowerShell script that checks if one of the scanned files matches a SHA256 value by comparing the values to a list of known hash values. It only searched in specific directories.What would be better than using file-level restore? Right, Data Integration API!Since version 12.3.1, Veeam offers the possibility of working with the Data Integration API via the REST API. To improve the whole thing, I have created a Python script that scans the mounted backup file system for suspicious files by comparing their hash values against known threats stored in a local database. The database uses data from Malware Bazaar and the LOLBAS project (“Living Off The Land Binaries and Scripts”), a catalog with legitimate Windows system binaries that attackers often abuse. The script can detect such files when they appear in unusual locations. The analysis is performance-optimized through parallel processing and will export the result in

This is me being a bit lazy, so apologize in advance. Does anyone have a script, or know of a VBR type report which retrieves change rate for VMs in a Backup Job? Obviously I know about VONE, but we don’t use that (maybe I can do a temp 30-day trial install...but would like something a bit quicker and temporary). I’ve run into a situation since last wk where 1 or a few VMs in a job have changed the backup rate significantly since last wk, by almost 10-fold, causing me to run out of space not only on this Job Repo, but my storage array! I’m trying to work through it, but would like to know the culprit(s) to let the app owners know to chill! haha There was a couple app VMs with updates, etc since last wk, so I have an idea a little bit of what’s going on. But, I’d like to pinpoint things a bit better.Thank you Community!

Here’s a sample PowerShell script to enforce Restore Point configuration for both VMware Backup Jobs & vCloud Backup Jobs. The script retrieves the job’s current retention setting (Restore Points), compares it against the standard defined in a CSV file, and adjusts the configuration where needed. For more detailed information, please follow the VeeamHub link:https://github.com/VeeamHub/powershell/tree/master/BR-EnforceJobRetention

hello, Small trick following a bad handling. The objective is to restore on a Windows file server the ACLs of the files without restoring the files.For this we will start by opening the console restore guest files. Once done, click on any file, then explore to find the path to the FLR mount.To get the list of ACLs you can run a single command. This command will save all subfolders and files as a plain text. The text file (acl.txt) will be saved on your current user folder.icacls c:data /save acl.txt /t /cWhere “C:data” is the FLR path, “T” is added to get all subfolders and files on that drive, and “C” allows to ignore all the access errors.If the number of folders and files are too large, then the command will take a long time to complete its execution. At the end of execution, you will get the list of total files which is processed successfully, and the number of files which don’t get success in processing.If you want to restore the lists, execute the following commandIcacls c: /rest