YARA and Script Library

Hello community,you  probably know my many scripts on the subject of backup data scanning? I am happy to share with you what I am currently working on.Secure Restore / Scan BackupCurrently "only" Microsoft Windows machines can be scanned using Secure Restore or Scan Backup (see here). However the Disk Publishing (Data Integration API) allows us to publish a disk from different types of backups to a Windows or Linux host. The disk can have a Microsoft Windows, Linux, Unix or other file system. On top Veeam Backup & Replication v12.1 gives us many more options for scanning backup data. For example we now also can mark restore points as clean, suspicious or infected using a PowerShell cmdlet. What if i were to extend one of my scripts with this function? Said and done!New Script - New FeaturesThe new script presents all existing restore points from a Linux VM, Windows VM or Agent backup to a Linux host, scans the specified restore point and marks the selected restore point as infected

 Hi Community,YARA Scans, one of the exciting new features in V12.1 that I really wanted to start using.YARA is a great tool to help you search and detect malware like ransomware and alert you before it can do any damage.In Veeam Backup and Replication V12.1 you can only select one .yar/.yara file to use for scanning from the "C:\Program Files\Veeam\Backup and Replication\Backup\YaraRules" directory on the Backup Server.After uploading some YARA Rules to my Backup Server, I created an index.yar to include all the individual files/rules so I can run scans using all my YARA rules instead of a single YARA rule.A Yara rule looks like this:Where a Yara index file looks like this:If you select a file with an actual YARA rule the scan works fine, but since the file I selected was my index.yar file, the scan failed!After taking a close look at the YARA-Volume0.log file in (my case in) "C:\ProgramData\Veeam\Backup\FLRSessions\Windows\FLR__vb365.veeam.lab_\Antivirus" on the Mount Server I found

Last month I created a topic for a script I had created using Veeam Service Provider Console API to automate the upgrade of Veeam Agents (Automate Veeam Agent Upgrades via VSPC | Veeam Community Resource Hub) which also got featured in the last recap of 2023 which was a very nice end to the year for my first post! I was already planning on working on a script to automate the process of bulk updating VBR servers, but after it was mentioned a couple of times, I thought I would share what I have so far. If, like me, you work for an MSP, we have multiple tenant VBR’s kicking around it can be very time consuming when a new upgrade for Veeam comes out, to get this deployed on all of our tenants servers. Luckily, in recent updates, VSPC has improved the process of remotely upgrading VBR via VSPC. However, it is still a manual process that can still be time consuming going through each tenant VBR Server one by one. I wanted to find a way to automate this process.I could of wrote a script that

Doc Veeam validatorKB2086: How to Use the Veeam Backup ValidatorVeeam Backup Validator - Veeam Backup Guide for vSphere It is essential to verify the status of the backups at the CRC level on the storage and the possibility of restoring them via Surebackup.During the wizard for creating a backup job you can enable "Storage backup files healt check (detect and auto-heals corruption. https://helpcenter.veeam.com/docs/backup/vsphere/backup_health_check.html?ver=110I prefer to automate the validation process to have a detailed report every 2 weeksCopy past and save .ps1 format <#.SYNOPSIS    Performs a validation of all server backups.DESCRIPTION  .NOTES    File Name      : veeam_validator.ps1    Author         : Me and my colleague    Prerequisite   : PowerShell V2 , VeeamPSSnapIn installed#>#------------------------------------------ VARIABLES TO CHANGE -------------------------$email_infoTO = "yourmail@yourdomain.com"$email_infoFrom = "$($env:COMPUTERNAME)@ yourdomain.com "$email_

Hello,I want to share with you the last script I make to get hardening configuration of the VBR server and then remediate some of them.The script need to be executed on the VBR server itself.It's built with Veeam 12.1 beta. That means some checks can break on GA version.I seperate it into 4 choices when you execute it :choice 1 = Apply Level 1 security (security check done by veeam product itself when you execute security and compliance on the VBR console)choice 2 = Apply Level 2 security (best practice about hardening Veeam product)choice 3 = Remove VBR console (Carreful, you can't use anymore Veeam powershell after this action)choice 4 = Get HTML security report That means choice 1 or 2 or 3 will performs modifications on the system.Choice 4 will not do any modifications, it just make the HTML report.Some sample available on fresh installation, fresh installation + L1 applied, fresh installation + L1 + L2 appliedIf you want to see report on fresh installation + after doing choice 1 +

I’m happy to announce that the storage report script, by @Jim Jones, has been updated for Veeam Service Provider Console v8 and is now available on VeeamHub.This script will return usage and metadata for all backup repositories for the specified VSPC server. It will also provide the name and UID of the provider/reseller/company to whom the repository belongs.Be on the lookout for the BackupSizeGB metric which was added in Veeam Service Provider Console v8. This metric is the total size of all restore points and is a useful chargeback metric for service providers.On top of that, this report could be used by operations to see the current status of all backup repositories in their environment.For more detailed information, please follow the VeeamHub link.https://github.com/VeeamHub/powershell/tree/master/VSPC-StorageReport

One of the things I have been looking at recently is automating the process of upgrading Veeam Agents. The great thing with Veeam Service Provider Console is how easy we can bulk update agents from one place. However, I wanted to take it a step further and have this totally automated - mainly because I am lazy. To do so, I have used the VSPC API to do this for me. I am not the most proficient with PowerShell, someone can probably make this run more efficiently. However the below script works just fine for me, so thought I would share it with the community. I use this via an Azure Function that runs every morning and kicks off an upgrade of any agents that require it, however you could schedule this from a RMM product etc, whatever works best for yourself. At the moment there is no property in the VSPC API to show if an agent requires an upgrade, so it starts by adding this property by comparing the installed version to the current released version (this part you manually have to update

With Veeam Backup & Replication (VBR) 12.1 it is possible to restore the Configuration Database using Powershell. Basically a simple task, if there weren't a few things to consider. Challenge accepted!My SetupLet's prepare for the scenario where the primary VBR is no longer available and the configuration database needs to be restored on another system with a different hostname (standby VBR). On the primary VBR, the configuration backup was encrypted according to the best practices and MFA was also activated for part of the users. The configuration database runs on PostgreSQL.I had the following thoughts before creating the scriptCheck that only the necessary Veeam services are running on the standby VBR server Check if the response file has the proper entries (e. g. not automatically starting the Veeam services after the restore) When MFA is enabled/used, updates must currently be made to the database after restoring the configuration DB (see here) The encryption password should n

Hello. We have a policy to export all tapes currently in a library that are marked FULL. I can get a list of all FULL tapes in a media pool like this:[String] $LibraryName         = Get-VBRTapeLibrary | Select -Expandproperty Name$TapesToBeEjected     = Get-VBRTapeMedium -Library $LibraryName | Where {$_.IsFull -eq "TRUE"} | Select Name, LastWriteTime, MediaPoolID | Sort -Property Name (there’s more to my script, but that is the relevant querying section) However, that gives me *all* tapes in the pool that are FULL, and I want only the tapes in a pool that are currently ONLINE in a library that are FULL (so it can send an email to the tape operators and tell them to go export the tape(s)). And I have not found a way to do that - I don’t see any property that is returned that shows ONLINE or OFFLINE of a specific tape. Am I just missing it? Is there way to query for this, so I can send an alert email (as a scheduled task)? Or is there some other way to do it? (we don’t have a license fo

Hello, we are monitoring the customer backups via PRTG.Till now, we had a SQL Skript, wich got the latest result and reported it to PRTG:SELECT latest_result FROM bjobs WHERE name = @prtg;That worked fine with MSSQL Express, but now with PostgreSQL we have to use a PostgreSQL Sensor in PRTG. Thats no problem, but it always failes with: “GSS/SSPI authentication but IntegratedSecurity not enabled” when I try to use the postgres user, or with: 28000: SSPI-Authentication for user Administrator failed”. For debugging I tried to change the access settings in the pg_hba.conf file but nothing seems to work.Is there a way I can still run queries to the config database? Or do I have to go via the PowerShell Snappin from Veeam?PS: We don’t use the Enterprise Manager, because you need the Enterprise Plus license for that and our customers don’t have that license. Thanks alot.

A long time ago, my colleague @StefanZi  had provided a Powershell script to create the necessary Azure/Entra appplicaton to be used in Veeam Backup for Microsoft 365. In the meantime, new permission requirements have been added to this application and the Powershell cmdlet AzureAD will also be retired next year (see here), and one of my Powershell scripts also requires the automated creation of an application in Azure/Entra.These were enough reasons for me to update the script. So what's new?- Use of the Microsoft Graph Powershell Module- Revise and add permissions- Adaptations to the text (e.g. adapted product name)- Optimize outputAnd the good news are. Script is ready to use. More details in my GitHub repository here.Enjoy!Steve

Hi all, Currently there's no indication other then on the VBA appliance itself that there are pending updates. Therefore I created a PS script which we integrated into our monitoring system (N-Central) that pulls this data from the appliance. We get notified for pending updates and we can proceed to deploy them. You can find the script on my gist page: https://gist.github.com/BasvanH/cc7cb3974657bde5926af69869e73b0b Two variables are filled with the status:$pendingUpdates is a integer and filled with the pending update count$updateCategories is a string and filled with the categories of the pending updates. You can adjust the script to your needs. All the best, regards,Bastiaan

Hi Everyone, I’m sharing this script to find where the Veeam Agent is running in the AD domain.It uses ADSI so there is no need for the Active Directory module installation.You can change the first two lines to suit your needs in finding some other resources and the service name to check the status as well.$SPNKeyword = 'VeeamAgentWindows'$ServiceKeyword = 'Veeam' Try { $adsiSearcher = [adsisearcher]"(&(objectCategory=computer)(servicePrincipalName=*$($SPNKeyword)*))" $propList = 'CanonicalName', 'description', 'name', 'operatingSystem', 'ServicePrincipalName' ForEach ($prop in $propList) { [void]$adsiSearcher.PropertiesToLoad.Add($prop) } $adsiSearcher.FindAll() | ForEach-Object { Write-Host "Processing $($_.Properties['name'][0]) " -ForegroundColor Yellow [PSCustomObject]([ordered]@{ Name = $_.Properties['name'][0] Description = $_.Properties['description'][0] OperatingSystem = $_.Properties['operatingSystem'][0] IPAddresses

NewsI would like to share with you a recipe from my "Script Kitchen" that I'm in the process of matching ingredients to. The question I asked myself: Do you really need to protect your Entra ID tenant(s)? My answer: see below ;) IntroEntra ID stores a variety of settings and policies that are important to the continuity of your business. Anything that compromises your Entra ID configuration can result in an immediate loss of access to data and applications. So how about exporting the information to another location so it can be analyzed and imported or reconfigured if something bad happens? And how about adding a retention to the exported data?Microsoft provides some built-in retention mechanisms (Recycle Bin), but these mechanisms are not enough to meet the needs of most organizations. The Recycle Bin stores deleted objects such as users and groups for 30 days. Some limitations which I associate with it:- After 30 days the deleted objects are permanently deleted and cannot be recovere

Recently I had to troubleshoot a Veeam Backup & Replication (B&R) problem. There the question popped up which are the running Veeam jobs at point or period of time. The GUI is not a big help to answer this question. Therefore I wrote a small script that show these jobs.The following PowerShell script snippet is quite simple. First, start- (tStart) and end-date/time (tEnd) are asked for input. The following query selects all running Veeam jobs at point or period of time that matches input dates.# Ask for start- and end-date and timeWrite-Host "Enter date in format " ($(get-date).ToString("dd.MM.yyyy HH:mm"))$tStart = Read-Host "Enter start-time (Enter for now)"$tEnd = Read-Host "Enter end-time (Enter for equal to start-time)"if ($tStart -eq '') {$tStart = get-date -Format "dd.MM.yyyy HH:mm"}if ($tEnd -eq '') {$tEnd = $tStart}# Check input datatry {$tStart = [DateTime]::Parse($tStart)}catch {Write-Host "start-time wrong input"; continue}try {$tEnd = [DateTime]::Parse($tEnd)}cat

In a customer project I just stumbled across the requirement to do SQL log-shipping with VMs. A simple task, I thought at first. But this time the request included a so-called division by zero - at least from a VBR perspective. With VBR (at least until V12), it is not possible to restrict log-shipping to certain days of the week. You can only set the overall frequency of log backups: Microsoft SQL Server Transaction Log Settings - User Guide for VMware vSphere (veeam.com)You can set a schedule for image-level backups of course. But in between, log backups are performed continuously as defined by the above setting.It came in very handy that @SteveHeart recently published another script that can determine which VBR backup job a PS script was started out of. The code in mention to actually determine the process ID of the VBR job above goes back to @tsightler. So the script can be used flexibly as you don’t have to hard code job names etc. So I “borrowed” this code and enriched it with tog

<#.SynopsisFor VB365 will migrate all data from one repository to another, based on the Veeam KB 3067. This version brings some sanity to the selection of proxies and repos while also providing information on what is to be moved (storage and user counts)..NotesVersion: 1.0Author: Jim Jones, @k00laidITModified Date: 5/23/2022.EXAMPLE.\iland-kb3067.ps1#>Import-Module Veeam.Archiver.PowerShell#Organization selection$orgs=Get-vboorganization | Sort-Object Namefor($i=0; $i -lt $orgs.count; $i++){write-host $i. $orgs[$i].name}$organisationNum = Read-Host "Enter organisation number"$vboOrg = $orgs[$organisationNum]$orgjobs = $vboOrg | get-vbojob[System.Collections.ArrayList]$orgrepos = @()foreach ($orgjob in $orgjobs) { $repo = $orgjob.repository $output = [PSCustomObject]@{ repoName = $repo } $orgrepos += $output }#Source Repository selection$sourcerepo = $orgreposfor($i=0; $i -lt $sourcerepo.count; $i++){write-host $i. $sourcerepo[$

Hi all, I am looking for the way to manage the number of concurrent tasks on repository. Two questions regarding it.I was expecting it to be the option of CBackupRepository object but doesn’t seems so. So how to retrieve the current configured number? Whats the difference between LimitConcurrentJobs and MaxConcurrentJobs options in Set-VBRBackupRepository commandlet and which on is actually reflect the option in UI?Cheers,Alexey

HelloI'm looking for some command or script that returns me:VM name -> Tape on which the backup was saved.Similar to the process obtained via the Home >> Backups >> Tape (Properties in a tape job).  

Hello All, Could someone help me with adding servers to agent-based backup jobs via powershell/commandline. In the below command i get error while mentioning Job  and backupobject.Set-VBRComputerBackupJob -Job <VBRComputerBackupJob> [-Name <string>] [-Description <string>] [-BackupObject <Object[]>]. Where RKTest is an existing Job, I’m trying to add objects or servers to the backup job RKTest.  Error:cmdlet Set-VBRComputerBackupJob at command pipeline position 1Supply values for the following parameters:Job: "RKTest"Set-VBRComputerBackupJob : Cannot bind parameter 'Job'. Cannot convert the ""RKTest"" value of type "System.String" to type "Veeam.Backup.PowerShell.Infos.VBRComputerBackupJob".At line:1 char:1+ set-vbrcomputerbackupjob+ ~~~~~~~~~~~~~~~~~~~~~~~~    + CategoryInfo          : InvalidArgument: (:) [Set-VBRComputerBackupJob], ParameterBindingException    + FullyQualifiedErrorId : CannotConvertArgumentNoMessage,Veeam.Backup.PowerShell.Cmdlets.SetVBRCompu

Hello community,the Backup Scanning Tools Web Console got a new buddy:  📃🔎 File Level Restore - Hash Scanner 📃🔎 This Powershell script scans specific subfolders within a Veeam File Level Recovery session and checks if any of the scanned files match a SHA256 value by comparing the values to a list of known hash values. Common locations for temporary Internet files in Windows systems are scanned. The list can be supplemented at any time.The following subdirectories in the Users folder are scannedDownloads AppData\Local\Temp AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data AppData\Local\Google\Chrome\User Data\Default\Cache AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupThe script has been integrated into the Backup Scanning Tools Web Console, but can also be run manually. On top you'll also get this script:vbr-flr-auto-hashscanner.ps1This script automates the execution of the scans Windows VM included in a specific backup job. The number of VMs to be scan

Creating many backup jobs for new environment or new project which has many VMs, it’s boring in addition you may make a mistake because of repeating.To avoid that you can use scripts to create them simultaneously and only change the value for some variables.Below script is for creating VMware VM backup job with almost all required options (VM selection, repo, proxy, retention , GFS, schedule , retries ….etc) moreover the recommended Advanced settings for Dell Data Domain repository.You can also use part of script to edit or modify existing backup jobs simultaneously.{{#Specify the name you want to assign to the backup job$JobName = "backup job name" #Specify the array of VMware VMs you want to add to the job.#If you want to search by part of VM name use *$VMsNames = Find-VBRViEntity -Name "VM1", "VM2", "VM3" #Specify the backup repository where the created backup will be stored. Default: default backup repository#If you want to search by part of repo name use *$BackupRepo = Get-VBRBack

Hello, I attach script to make VBM 365 audit.I hope to have some feedback to know if I forget something, if there are some error or just if you like it ! Sample here :  Thanks

Hi all!I’ve tried to initiate a QuickBackup via VEM API. After starting my Script everything looks good and the response is 202. But when i take look into the VBR Console, there was no QuickBackup started.Did i missed anything in my Script? Does anyone have a idea? #API_QuickBackup_singelVMAdd-Type @"    using System.Net;    using System.Security.Cryptography.X509Certificates;    public class TrustAllCertsPolicy : ICertificatePolicy {        public bool CheckValidationResult(            ServicePoint srvPoint, X509Certificate certificate,            WebRequest request, int certificateProblem) {            return true;        }    }"@[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy$server = "https://ourvemserver:9398/api/"$authPath = 'C:\temp\myadmincred.xml'$Credentials = IMPORT-CLIXML -path $authPath$RESTAPIUser = $Credentials.UserName$RESTAPIPassword = $Credentials.GetNetworkCredential().Password$usrpwd = "$($RESTAPIUser):$($RestAPIPassword)"$encode

is it possible to extract a single file from the most recent backup of a hyperV VM from a commandline utility?   It tried “extract.exe” and it appears to only extract EVERYTHING and actually restores the vhdx file.  Which I would then have to mount the vhdx somehow and extract the file I need. I’d like to run this from cmdline on a daily schedule. Any help greatly appreciated.