Skip to main content
  • EN

YARA and Script Library

Download featured YARA rules, browse code samples or contribute your own scripts

  • 166 Topics
  • 904 Comments
166 Topics
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Powershell - Restore VBR Configuration Database - V12.1

With Veeam Backup & Replication (VBR) 12.1 it is possible to restore the Configuration Database using Powershell. Basically a simple task, if there weren't a few things to consider. Challenge accepted!My SetupLet's prepare for the scenario where the primary VBR is no longer available and the configuration database needs to be restored on another system with a different hostname (standby VBR). On the primary VBR, the configuration backup was encrypted according to the best practices and MFA was also activated for part of the users. The configuration database runs on PostgreSQL.I had the following thoughts before creating the scriptCheck that only the necessary Veeam services are running on the standby VBR server Check if the response file has the proper entries (e. g. not automatically starting the Veeam services after the restore) When MFA is enabled/used, updates must currently be made to the database after restoring the configuration DB (see here) The encryption password should n

3023
Chris.Childerhose
11 months ago
M
MikeLeoneComes here often
asked in YARA and Script Library
Using Powershell to query for online only tapes

Hello. We have a policy to export all tapes currently in a library that are marked FULL. I can get a list of all FULL tapes in a media pool like this:[String] $LibraryName         = Get-VBRTapeLibrary | Select -Expandproperty Name$TapesToBeEjected     = Get-VBRTapeMedium -Library $LibraryName | Where {$_.IsFull -eq "TRUE"} | Select Name, LastWriteTime, MediaPoolID | Sort -Property Name (there’s more to my script, but that is the relevant querying section) However, that gives me *all* tapes in the pool that are FULL, and I want only the tapes in a pool that are currently ONLINE in a library that are FULL (so it can send an email to the tape operators and tell them to go export the tape(s)). And I have not found a way to do that - I don’t see any property that is returned that shows ONLINE or OFFLINE of a specific tape. Am I just missing it? Is there way to query for this, so I can send an alert email (as a scheduled task)? Or is there some other way to do it? (we don’t have a license fo

1793
JMeixner
11 months ago
L
louis_bab99New Here
asked in YARA and Script Library
Veeam V12 PostgreSQL Config DB SQL Queries fail

Hello, we are monitoring the customer backups via PRTG.Till now, we had a SQL Skript, wich got the latest result and reported it to PRTG:SELECT latest_result FROM bjobs WHERE name = @prtg;That worked fine with MSSQL Express, but now with PostgreSQL we have to use a PostgreSQL Sensor in PRTG. Thats no problem, but it always failes with: “GSS/SSPI authentication but IntegratedSecurity not enabled” when I try to use the postgres user, or with: 28000: SSPI-Authentication for user Administrator failed”. For debugging I tried to change the access settings in the pg_hba.conf file but nothing seems to work.Is there a way I can still run queries to the config database? Or do I have to go via the PowerShell Snappin from Veeam?PS: We don’t use the Enterprise Manager, because you need the Enterprise Plus license for that and our customers don’t have that license. Thanks alot.

31904
L
11 months ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Veeam Backup for Microsoft 365 - Azure/Entra Application Creation Script

A long time ago, my colleague @StefanZi  had provided a Powershell script to create the necessary Azure/Entra appplicaton to be used in Veeam Backup for Microsoft 365. In the meantime, new permission requirements have been added to this application and the Powershell cmdlet AzureAD will also be retired next year (see here), and one of my Powershell scripts also requires the automated creation of an application in Azure/Entra.These were enough reasons for me to update the script. So what's new?- Use of the Microsoft Graph Powershell Module- Revise and add permissions- Adaptations to the text (e.g. adapted product name)- Optimize outputAnd the good news are. Script is ready to use. More details in my GitHub repository here.Enjoy!Steve

1041
Chris.Childerhose
1 year ago
Bastiaan van Haastrecht
Bastiaan van HaastrechtNew Here
posted in YARA and Script Library
Get Veeam for Azure pending updates from API

Hi all, Currently there's no indication other then on the VBA appliance itself that there are pending updates. Therefore I created a PS script which we integrated into our monitoring system (N-Central) that pulls this data from the appliance. We get notified for pending updates and we can proceed to deploy them. You can find the script on my gist page: https://gist.github.com/BasvanH/cc7cb3974657bde5926af69869e73b0b Two variables are filled with the status:$pendingUpdates is a integer and filled with the pending update count$updateCategories is a string and filled with the categories of the pending updates. You can adjust the script to your needs. All the best, regards,Bastiaan

271
Chris.Childerhose
1 year ago
vAdmin
vAdminInfluencer
posted in YARA and Script Library
Get All Computer which runs Veeam Agent in the AD Domain and show the result.

Hi Everyone, I’m sharing this script to find where the Veeam Agent is running in the AD domain.It uses ADSI so there is no need for the Active Directory module installation.You can change the first two lines to suit your needs in finding some other resources and the service name to check the status as well.$SPNKeyword = 'VeeamAgentWindows'$ServiceKeyword = 'Veeam' Try { $adsiSearcher = [adsisearcher]"(&(objectCategory=computer)(servicePrincipalName=*$($SPNKeyword)*))" $propList = 'CanonicalName', 'description', 'name', 'operatingSystem', 'ServicePrincipalName' ForEach ($prop in $propList) { [void]$adsiSearcher.PropertiesToLoad.Add($prop) } $adsiSearcher.FindAll() | ForEach-Object { Write-Host "Processing $($_.Properties['name'][0]) " -ForegroundColor Yellow [PSCustomObject]([ordered]@{ Name = $_.Properties['name'][0] Description = $_.Properties['description'][0] OperatingSystem = $_.Properties['operatingSystem'][0] IPAddresses

1287
vAdmin
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Entra ID Protector - A new Powershell script on the horizon

NewsI would like to share with you a recipe from my "Script Kitchen" that I'm in the process of matching ingredients to. The question I asked myself: Do you really need to protect your Entra ID tenant(s)? My answer: see below ;) IntroEntra ID stores a variety of settings and policies that are important to the continuity of your business. Anything that compromises your Entra ID configuration can result in an immediate loss of access to data and applications. So how about exporting the information to another location so it can be analyzed and imported or reconfigured if something bad happens? And how about adding a retention to the exported data?Microsoft provides some built-in retention mechanisms (Recycle Bin), but these mechanisms are not enough to meet the needs of most organizations. The Recycle Bin stores deleted objects such as users and groups for 30 days. Some limitations which I associate with it:- After 30 days the deleted objects are permanently deleted and cannot be recovere

8296
Geoff Burke
1 year ago
vNote42
vNote42On the path to Greatness
posted in YARA and Script Library
PowerShell Script to show running Veeam jobs at point or period of time

Recently I had to troubleshoot a Veeam Backup & Replication (B&R) problem. There the question popped up which are the running Veeam jobs at point or period of time. The GUI is not a big help to answer this question. Therefore I wrote a small script that show these jobs.The following PowerShell script snippet is quite simple. First, start- (tStart) and end-date/time (tEnd) are asked for input. The following query selects all running Veeam jobs at point or period of time that matches input dates.# Ask for start- and end-date and timeWrite-Host "Enter date in format " ($(get-date).ToString("dd.MM.yyyy HH:mm"))$tStart = Read-Host "Enter start-time (Enter for now)"$tEnd = Read-Host "Enter end-time (Enter for equal to start-time)"if ($tStart -eq '') {$tStart = get-date -Format "dd.MM.yyyy HH:mm"}if ($tEnd -eq '') {$tEnd = $tStart}# Check input datatry {$tStart = [DateTime]::Parse($tStart)}catch {Write-Host "start-time wrong input"; continue}try {$tEnd = [DateTime]::Parse($tEnd)}cat

37285
R
1 year ago
JMousqueton
JMousquetonVeeam Vanguard
posted in YARA and Script Library
Introducing a Veeam Backup & Replication Log Anonymization Script

Hello Veeam Community! I'm excited to introduce a Python script that I've developed for anonymizing Veeam Backup & Replication logs. Protecting sensitive information in log files is crucial, and this script simplifies the process while maintaining the integrity of your logs. Veeam Log Anonymizer logo Acknowledgments:Before diving into the details, I'd like to express my gratitude:Bertrand: Thank you for the original idea that inspired this script and for your valuable improvement suggestions. Your input was instrumental in making this script more robust and feature-rich. Eric: A big thank you for your unwavering support and encouragement throughout the development process. Your feedback and insights helped shape this tool. Disclaimer:I want to clarify that I'm not a developer by profession, but rather a member of the Veeam community who saw the need for a tool like this. The script has been created out of a passion for data privacy and a desire to contribute to our community.Key Fe

78216
HannesK
1 year ago
Michael Melter
Michael MelterVeeam Legend
posted in YARA and Script Library
SQL log-shipping, but only on certain days - find out how

In a customer project I just stumbled across the requirement to do SQL log-shipping with VMs. A simple task, I thought at first. But this time the request included a so-called division by zero - at least from a VBR perspective. With VBR (at least until V12), it is not possible to restrict log-shipping to certain days of the week. You can only set the overall frequency of log backups: Microsoft SQL Server Transaction Log Settings - User Guide for VMware vSphere (veeam.com)You can set a schedule for image-level backups of course. But in between, log backups are performed continuously as defined by the above setting.It came in very handy that @SteveHeart recently published another script that can determine which VBR backup job a PS script was started out of. The code in mention to actually determine the process ID of the VBR job above goes back to @tsightler. So the script can be used flexibly as you don’t have to hard code job names etc. So I “borrowed” this code and enriched it with tog

812
Chris.Childerhose
1 year ago
k00laidIT
k00laidITVeeam Vanguard
posted in YARA and Script Library
Revised kb3067.ps1 script

<#.SynopsisFor VB365 will migrate all data from one repository to another, based on the Veeam KB 3067. This version brings some sanity to the selection of proxies and repos while also providing information on what is to be moved (storage and user counts)..NotesVersion: 1.0Author: Jim Jones, @k00laidITModified Date: 5/23/2022.EXAMPLE.\iland-kb3067.ps1#>Import-Module Veeam.Archiver.PowerShell#Organization selection$orgs=Get-vboorganization | Sort-Object Namefor($i=0; $i -lt $orgs.count; $i++){write-host $i. $orgs[$i].name}$organisationNum = Read-Host "Enter organisation number"$vboOrg = $orgs[$organisationNum]$orgjobs = $vboOrg | get-vbojob[System.Collections.ArrayList]$orgrepos = @()foreach ($orgjob in $orgjobs) { $repo = $orgjob.repository $output = [PSCustomObject]@{ repoName = $repo } $orgrepos += $output }#Source Repository selection$sourcerepo = $orgreposfor($i=0; $i -lt $sourcerepo.count; $i++){write-host $i. $sourcerepo[$

4075
FrankCL2
1 year ago
S
SC SupportNot a newbie anymore
asked in YARA and Script Library
Managing the maximum concurrent tasks on repository level.

Hi all, I am looking for the way to manage the number of concurrent tasks on repository. Two questions regarding it.I was expecting it to be the option of CBackupRepository object but doesn’t seems so. So how to retrieve the current configured number? Whats the difference between LimitConcurrentJobs and MaxConcurrentJobs options in Set-VBRBackupRepository commandlet and which on is actually reflect the option in UI?Cheers,Alexey

84610
S
1 year ago
C
clk01New Here
asked in YARA and Script Library
List VMS written to a tape

HelloI'm looking for some command or script that returns me:VM name -> Tape on which the backup was saved.Similar to the process obtained via the Home >> Backups >> Tape (Properties in a tape job).  

1181
Chris.Childerhose
1 year ago
R
RadhakrishnanNew Here
asked in YARA and Script Library
Add servers to VBRcomputerbackupjob

Hello All, Could someone help me with adding servers to agent-based backup jobs via powershell/commandline. In the below command i get error while mentioning Job  and backupobject.Set-VBRComputerBackupJob -Job <VBRComputerBackupJob> [-Name <string>] [-Description <string>] [-BackupObject <Object[]>]. Where RKTest is an existing Job, I’m trying to add objects or servers to the backup job RKTest.  Error:cmdlet Set-VBRComputerBackupJob at command pipeline position 1Supply values for the following parameters:Job: "RKTest"Set-VBRComputerBackupJob : Cannot bind parameter 'Job'. Cannot convert the ""RKTest"" value of type "System.String" to type "Veeam.Backup.PowerShell.Infos.VBRComputerBackupJob".At line:1 char:1+ set-vbrcomputerbackupjob+ ~~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : InvalidArgument: (:) [Set-VBRComputerBackupJob], ParameterBindingException    + FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Veeam.Backup.PowerShell.Cmdlets.SetVBRCompu

1245
O
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Veeam Backup & Replication - File Level Restore - Hash Scanner

Hello community,the Backup Scanning Tools Web Console got a new buddy:  📃🔎 File Level Restore - Hash Scanner 📃🔎 This Powershell script scans specific subfolders within a Veeam File Level Recovery session and checks if any of the scanned files match a SHA256 value by comparing the values to a list of known hash values. Common locations for temporary Internet files in Windows systems are scanned. The list can be supplemented at any time.The following subdirectories in the Users folder are scannedDownloads AppData\Local\Temp AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data AppData\Local\Google\Chrome\User Data\Default\Cache AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupThe script has been integrated into the Backup Scanning Tools Web Console, but can also be run manually. On top you'll also get this script:vbr-flr-auto-hashscanner.ps1This script automates the execution of the scans Windows VM included in a specific backup job. The number of VMs to be scan

2113
Scott
1 year ago
A
Ahmed ShakranNot a newbie anymore
posted in YARA and Script Library
Create VM Backup jobs by script

Creating many backup jobs for new environment or new project which has many VMs, it’s boring in addition you may make a mistake because of repeating.To avoid that you can use scripts to create them simultaneously and only change the value for some variables.Below script is for creating VMware VM backup job with almost all required options (VM selection, repo, proxy, retention , GFS, schedule , retries ….etc) moreover the recommended Advanced settings for Dell Data Domain repository.You can also use part of script to edit or modify existing backup jobs simultaneously.{{#Specify the name you want to assign to the backup job$JobName = "backup job name" #Specify the array of VMware VMs you want to add to the job.#If you want to search by part of VM name use *$VMsNames = Find-VBRViEntity -Name "VM1", "VM2", "VM3" #Specify the backup repository where the created backup will be stored. Default: default backup repository#If you want to search by part of repo name use *$BackupRepo = Get-VBRBack

40810
Moustafa_Hindawi
1 year ago
D
damien commengeVeeam Legend
posted in YARA and Script Library
Veeam 365 v7 Audit script

Hello, I attach script to make VBM 365 audit.I hope to have some feedback to know if I forget something, if there are some error or just if you like it ! Sample here :  Thanks

1471
Iams3le
1 year ago
F
FrankBNew Here
asked in YARA and Script Library
VEM API QuickBackup

Hi all!I’ve tried to initiate a QuickBackup via VEM API. After starting my Script everything looks good and the response is 202. But when i take look into the VBR Console, there was no QuickBackup started.Did i missed anything in my Script? Does anyone have a idea? #API_QuickBackup_singelVMAdd-Type @"    using System.Net;    using System.Security.Cryptography.X509Certificates;    public class TrustAllCertsPolicy : ICertificatePolicy {        public bool CheckValidationResult(            ServicePoint srvPoint, X509Certificate certificate,            WebRequest request, int certificateProblem) {            return true;        }    }"@[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy$server = "https://ourvemserver:9398/api/"$authPath = 'C:\temp\myadmincred.xml'$Credentials = IMPORT-CLIXML -path $authPath$RESTAPIUser = $Credentials.UserName$RESTAPIPassword = $Credentials.GetNetworkCredential().Password$usrpwd = "$($RESTAPIUser):$($RestAPIPassword)"$encode

711
SteveHeart
1 year ago
J
Jeff JewsonNew Here
asked in YARA and Script Library
single windows file restore from command line

is it possible to extract a single file from the most recent backup of a hyperV VM from a commandline utility?   It tried “extract.exe” and it appears to only extract EVERYTHING and actually restores the vhdx file.  Which I would then have to mount the vhdx somehow and extract the file I need. I’d like to run this from cmdline on a daily schedule. Any help greatly appreciated.

857
J
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Backup Scanning Tools Web Console

🌟 Introducing the Backup Scanning Tools Web Console! 🌟You wanted it! - I got it! How to Get Started The Backup Scanning Tools Web Console is also downloaded from the installation script (see original post).Before you start the script, you must open the backup-scanning-tools-webmenu.ps1 script file with a text editor and adjust the following variables:$scanningToolsPath Set this variable to the path where the individual scanning scripts were installed, e.g., "D:\Scripts\vbr\scanningtools".$LogFilePath            Specify the path for the log file (default is "C:\Temp\log.txt").  The script includes optional parameters that you can customize according to your preferences. These parameters are as follows:$Port                      Set the port number for the web server (default is 8080). $RefreshInterval  Define the interval (in seconds) for refreshing the web page (default is 300 seconds)You can also pass the parameters when starting the script. More details in the README document.And Y

4816
matheusgiovanini
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Backup Scanning Tools Menu

As already announced (see here), the first draft of the Backup Scanning Tools Menu has just been made available in my GitHub repository. This script is designed to provide a user-friendly, menu-driven interface for triggering the various backup scan tools that I have provided in the past. It allows the user to choose from a number of options, each corresponding to a specific type of backup scan. The script provides detailed descriptions of each scan operation before prompting the user to enter the required parameters for execution.Besides the actual Scanning Tool Menu script I also created an installer script that "installs" all necessary scan scripts into the selected directory.InstallationFollow these steps:Download the Installer Script Download the backup-scanning-tools-installer.ps1 script to your local machine. Open a PowerShell terminal with administrator privileges Run the Installer script Execute the backup-scanning-tools-installer.ps1 script with the required parameter -Instal

46212
Chris.Childerhose
1 year ago
K
KWCorkComes here often
asked in YARA and Script Library
Restoring OneDrive via PowerShell cannot find Online library

I’m using Veeam Backup for Microsoft Office 365 version 4.0 and want to copy all of the OneDrive data from users into their new accounts $DestinationSubfolder = 'Restored Work'$VeeamBackupJobName = 'BMC_M365_Data'$M365Credentials = Get-Credential$Job = Get-VBOjob -Name $VeeamBackupJobName$Session = Start-VEODRestoreSession -Job $Job -LatestState$UserToRestore = Get-VEODUser -Session $Session -Name 'Joe Bloggs'$UserDocuments = Get-VEODDocument -User $UserToRestoreif($UserDocuments){ $TargetUserName = 'Joe Bloggs 2' Restore-VEODDocument -User $UserToRestore -RestoreChangedItems -RestoreDeletedItems -Credential $M365Credentials -TargetUser $TargetUserName -TargetFolder $DestinationSubfolder}Else{ 'No OneDrive content found.'}Get-VEODRestoreSession | Stop-VEODRestoreSession The commands return this error though:“Restore-VEODDocument : Failed to find Online OneDrive library for: Joe Bloggs 2”I’ve added the second account to the original backup job to ensure Veeam can see it. Any id

1344
K
1 year ago
Scott
ScottVeeam Legend
posted in YARA and Script Library
Get Daily backup size for previous 2 weeks.

This works great for me using forever forward incremental jobs. If you are using synthetic fulls, or reverse you may get unexpected results as your latest job will show as the full size. I took my previous script and modified it so I can look at the previous 2 weeks, and see the size of the backup for each day.  If you change the (-14) you can make this weekly, monthly, daily with ease. # Location of the Veeam backup folder$BackupFolderPath = "f:\Backups"# Start and end dates$EndDate = Get-Date$StartDate = $EndDate.AddDays(-14)# Function to convert bytes to GBfunction ConvertTo-GB { param ( [Parameter(Mandatory=$true)] [int64] $bytes ) return "{0:N2}" -f ($bytes / 1GB) + " GB"}# Go through each day from the start date to the end datefor ($Date = $StartDate; $Date -le $EndDate; $Date = $Date.AddDays(1)) { # Date in the format 'yyyy-MM-dd' $DateString = $Date.ToString('yyyy-MM-dd') # Get all backup files for this date $BackupFiles = Get-ChildItem

3992
Chris.Childerhose
1 year ago
Scott
ScottVeeam Legend
posted in YARA and Script Library
Get the size of a daily incremental

For those doing forever forward incremental jobs, this is a handy scrip to see the size of your jobs each day. If you use Synthetic jobs, or reverse incremental you may get unexpected results as your latest file will be the full backup file.  While doing some planning for new storage I wanted to see how big a daily backup of all jobs on a proxy was.Here is a little script I came up with that you can modify the section “Current.Date.AddDays(-1)” to look back further. I may modify the code at a later time to fine tune this.  This worked well to go back a few days, then see the average daily size. Add that to your total full backup size and you can predict out the space needed to meet your retention policies. # Location of the Veeam backup folder$BackupFolderPath = "F:\Backups"# Current date$CurrentDate = Get-Date# Date of the day before$PreviousDay = $CurrentDate.AddDays(-1).ToString('yyyy-MM-dd')# Function to convert bytes to GBfunction ConvertTo-GB { param ( [Parameter(Mandat

4241
Chris.Childerhose
1 year ago
K
KWCorkComes here often
asked in YARA and Script Library
Remove-VBOEntityData takes ages

I’m trying to delete some user to data to free up licences and it seems to be taking forever to complete. I’m testing with a user who only has a few 100 emails but the command seems to have hung up. Here is the relevant part of the script:$RepositoryName = 'My_M365Repository'$UsersToRemove = @( 'Joe.Bloggs@MyDomain.com')$Repository = Get-VBORepository -Name $RepositoryNameforeach($UserToRemove in $UsersToRemove){ $UserToRemove $UserData = Get-VBOEntityData -Type 'User' -Repository $Repository -Name $UserToRemove if(-not($UserData)) { 'No user data found' } Else { # Use $UserData to see which backup types exist, and then only remove those. if($UserData.IsMailboxBackedUp) { Write-Host 'Removing Mailbox data' Remove-VBOEntityData -Repository $Repository -User $UserData -Mailbox -Confirm:$false } }}Any idea if I’m doing something wrong, or that cmdlet really does just take ages? Thanks.

2153
K
1 year ago

Badge winners

Show all badges
Terms & Conditions