YARA and Script Library

Hello community,the Backup Scanning Tools Web Console got a new buddy:  📃🔎 File Level Restore - Hash Scanner 📃🔎 This Powershell script scans specific subfolders within a Veeam File Level Recovery session and checks if any of the scanned files match a SHA256 value by comparing the values to a list of known hash values. Common locations for temporary Internet files in Windows systems are scanned. The list can be supplemented at any time.The following subdirectories in the Users folder are scannedDownloads AppData\Local\Temp AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data AppData\Local\Google\Chrome\User Data\Default\Cache AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupThe script has been integrated into the Backup Scanning Tools Web Console, but can also be run manually. On top you'll also get this script:vbr-flr-auto-hashscanner.ps1This script automates the execution of the scans Windows VM included in a specific backup job. The number of VMs to be scan

Creating many backup jobs for new environment or new project which has many VMs, it’s boring in addition you may make a mistake because of repeating.To avoid that you can use scripts to create them simultaneously and only change the value for some variables.Below script is for creating VMware VM backup job with almost all required options (VM selection, repo, proxy, retention , GFS, schedule , retries ….etc) moreover the recommended Advanced settings for Dell Data Domain repository.You can also use part of script to edit or modify existing backup jobs simultaneously.{{#Specify the name you want to assign to the backup job$JobName = "backup job name" #Specify the array of VMware VMs you want to add to the job.#If you want to search by part of VM name use *$VMsNames = Find-VBRViEntity -Name "VM1", "VM2", "VM3" #Specify the backup repository where the created backup will be stored. Default: default backup repository#If you want to search by part of repo name use *$BackupRepo = Get-VBRBack

Hello, I attach script to make VBM 365 audit.I hope to have some feedback to know if I forget something, if there are some error or just if you like it ! Sample here :  Thanks

Hi all!I’ve tried to initiate a QuickBackup via VEM API. After starting my Script everything looks good and the response is 202. But when i take look into the VBR Console, there was no QuickBackup started.Did i missed anything in my Script? Does anyone have a idea? #API_QuickBackup_singelVMAdd-Type @"    using System.Net;    using System.Security.Cryptography.X509Certificates;    public class TrustAllCertsPolicy : ICertificatePolicy {        public bool CheckValidationResult(            ServicePoint srvPoint, X509Certificate certificate,            WebRequest request, int certificateProblem) {            return true;        }    }"@[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy$server = "https://ourvemserver:9398/api/"$authPath = 'C:\temp\myadmincred.xml'$Credentials = IMPORT-CLIXML -path $authPath$RESTAPIUser = $Credentials.UserName$RESTAPIPassword = $Credentials.GetNetworkCredential().Password$usrpwd = "$($RESTAPIUser):$($RestAPIPassword)"$encode

is it possible to extract a single file from the most recent backup of a hyperV VM from a commandline utility?   It tried “extract.exe” and it appears to only extract EVERYTHING and actually restores the vhdx file.  Which I would then have to mount the vhdx somehow and extract the file I need. I’d like to run this from cmdline on a daily schedule. Any help greatly appreciated.

🌟 Introducing the Backup Scanning Tools Web Console! 🌟You wanted it! - I got it! How to Get Started The Backup Scanning Tools Web Console is also downloaded from the installation script (see original post).Before you start the script, you must open the backup-scanning-tools-webmenu.ps1 script file with a text editor and adjust the following variables:$scanningToolsPath Set this variable to the path where the individual scanning scripts were installed, e.g., "D:\Scripts\vbr\scanningtools".$LogFilePath            Specify the path for the log file (default is "C:\Temp\log.txt").  The script includes optional parameters that you can customize according to your preferences. These parameters are as follows:$Port                      Set the port number for the web server (default is 8080). $RefreshInterval  Define the interval (in seconds) for refreshing the web page (default is 300 seconds)You can also pass the parameters when starting the script. More details in the README document.And Y

As already announced (see here), the first draft of the Backup Scanning Tools Menu has just been made available in my GitHub repository. This script is designed to provide a user-friendly, menu-driven interface for triggering the various backup scan tools that I have provided in the past. It allows the user to choose from a number of options, each corresponding to a specific type of backup scan. The script provides detailed descriptions of each scan operation before prompting the user to enter the required parameters for execution.Besides the actual Scanning Tool Menu script I also created an installer script that "installs" all necessary scan scripts into the selected directory.InstallationFollow these steps:Download the Installer Script Download the backup-scanning-tools-installer.ps1 script to your local machine. Open a PowerShell terminal with administrator privileges Run the Installer script Execute the backup-scanning-tools-installer.ps1 script with the required parameter -Instal

I’m using Veeam Backup for Microsoft Office 365 version 4.0 and want to copy all of the OneDrive data from users into their new accounts $DestinationSubfolder = 'Restored Work'$VeeamBackupJobName = 'BMC_M365_Data'$M365Credentials = Get-Credential$Job = Get-VBOjob -Name $VeeamBackupJobName$Session = Start-VEODRestoreSession -Job $Job -LatestState$UserToRestore = Get-VEODUser -Session $Session -Name 'Joe Bloggs'$UserDocuments = Get-VEODDocument -User $UserToRestoreif($UserDocuments){ $TargetUserName = 'Joe Bloggs 2' Restore-VEODDocument -User $UserToRestore -RestoreChangedItems -RestoreDeletedItems -Credential $M365Credentials -TargetUser $TargetUserName -TargetFolder $DestinationSubfolder}Else{ 'No OneDrive content found.'}Get-VEODRestoreSession | Stop-VEODRestoreSession The commands return this error though:“Restore-VEODDocument : Failed to find Online OneDrive library for: Joe Bloggs 2”I’ve added the second account to the original backup job to ensure Veeam can see it. Any id

This works great for me using forever forward incremental jobs. If you are using synthetic fulls, or reverse you may get unexpected results as your latest job will show as the full size. I took my previous script and modified it so I can look at the previous 2 weeks, and see the size of the backup for each day.  If you change the (-14) you can make this weekly, monthly, daily with ease. # Location of the Veeam backup folder$BackupFolderPath = "f:\Backups"# Start and end dates$EndDate = Get-Date$StartDate = $EndDate.AddDays(-14)# Function to convert bytes to GBfunction ConvertTo-GB { param ( [Parameter(Mandatory=$true)] [int64] $bytes ) return "{0:N2}" -f ($bytes / 1GB) + " GB"}# Go through each day from the start date to the end datefor ($Date = $StartDate; $Date -le $EndDate; $Date = $Date.AddDays(1)) { # Date in the format 'yyyy-MM-dd' $DateString = $Date.ToString('yyyy-MM-dd') # Get all backup files for this date $BackupFiles = Get-ChildItem

For those doing forever forward incremental jobs, this is a handy scrip to see the size of your jobs each day. If you use Synthetic jobs, or reverse incremental you may get unexpected results as your latest file will be the full backup file.  While doing some planning for new storage I wanted to see how big a daily backup of all jobs on a proxy was.Here is a little script I came up with that you can modify the section “Current.Date.AddDays(-1)” to look back further. I may modify the code at a later time to fine tune this.  This worked well to go back a few days, then see the average daily size. Add that to your total full backup size and you can predict out the space needed to meet your retention policies. # Location of the Veeam backup folder$BackupFolderPath = "F:\Backups"# Current date$CurrentDate = Get-Date# Date of the day before$PreviousDay = $CurrentDate.AddDays(-1).ToString('yyyy-MM-dd')# Function to convert bytes to GBfunction ConvertTo-GB { param ( [Parameter(Mandat

I’m trying to delete some user to data to free up licences and it seems to be taking forever to complete. I’m testing with a user who only has a few 100 emails but the command seems to have hung up. Here is the relevant part of the script:$RepositoryName = 'My_M365Repository'$UsersToRemove = @( 'Joe.Bloggs@MyDomain.com')$Repository = Get-VBORepository -Name $RepositoryNameforeach($UserToRemove in $UsersToRemove){ $UserToRemove $UserData = Get-VBOEntityData -Type 'User' -Repository $Repository -Name $UserToRemove if(-not($UserData)) { 'No user data found' } Else { # Use $UserData to see which backup types exist, and then only remove those. if($UserData.IsMailboxBackedUp) { Write-Host 'Removing Mailbox data' Remove-VBOEntityData -Repository $Repository -User $UserData -Mailbox -Confirm:$false } }}Any idea if I’m doing something wrong, or that cmdlet really does just take ages? Thanks.

Hi everyone,I wrote some reports that helps me to manage Veeam backups. I put them online to share it to community. Feel free to use them and personnalize them 👍 BR-MorningReport : shows backup results of the night BR-DurationReport : shows duration and layout of backup jobs 

IntroductionOver the past few months, I have had customers report over-consumption of VUL, when leveraging Veeam NAS backups.Veeam NAS backup is licensed by the amount of protected source data. The protected data amount is rounded down to the nearest 500GB and consumes one VUL per 500GB (see the user guide for details).The important licensing caveat is that if, for instance, a same share is protected by two different backup jobs, even though it is the same source data, its protected amount doubles (in this particular instance).It easy to see how your VUL consumption can very quickly get out of control. The purpose of that short post is to share a very small script that helps identify if a given share has been backed up multiple times.Note: The script only analyzes the defined shares path and cannot detect any “share alias” set on the NAS device. ScriptThe script lists all NAS backup jobs and combs through its protected shares, sort the data and generates an HTML and CSV report. See the

hello, Small trick following a bad handling. The objective is to restore on a Windows file server the ACLs of the files without restoring the files.For this we will start by opening the console restore guest files. Once done, click on any file, then explore to find the path to the FLR mount.To get the list of ACLs you can run a single command. This command will save all subfolders and files as a plain text. The text file (acl.txt) will be saved on your current user folder.icacls c:data /save acl.txt /t /cWhere “C:data” is the FLR path, “T” is added to get all subfolders and files on that drive, and “C” allows to ignore all the access errors.If the number of folders and files are too large, then the command will take a long time to complete its execution. At the end of execution, you will get the list of total files which is processed successfully, and the number of files which don’t get success in processing.If you want to restore the lists, execute the following commandIcacls c: /rest

IntroductionOne of the standout features of Veeam Backup & Replication is SureBackup, which allows for the automated testing and verification of backups. SureBackup creates isolated environments, called Virtual Labs, to ensure the recoverability of your virtual machines. During a SureBackup session, it sometimes would be helpful to connect the virtual machines to the Internet  By default, the VMs within the Virtual Lab run in an isolated environment and do not have access to the Internet. If you want the VMs in the Virtual Lab to access the Internet, select the Allow proxy appliance to act as an Internet proxy for virtual machines in this lab check box. See  Setup Proxy Appliance and Veeam KB1165.With the HTTP proxy settings in place, you can easily download security patches, update antivirus definitions, and install software updates on your Linux VMs. With this you can enhance your software testing and patching processes, streamline deployment workflows, verify compatibility, and

Hi all, Recently I started experimenting with XFS savings calculation. I’ve seen some good work from the community and therefor I want to say, thanks for all people that played with xfs_bmap, filefrag, and especially mweissen13 with some good idea’s on how to find the overlapping intervalsI’m sharing here what I believe is a working implementation:https://github.com/tdewin/ttozz/tree/main/sortedfragmentsSo first of all, I’ve split up the work in 2 parts:Creating frag files: these files are basically filefrag output but reordered on volume level offset. This is required to find the overlapping intervals (shared blocks). Notice that filefrag order the fragments on file level offset. You can cat the files if you are curious. They are basically in YAML format because you should be able to easily parse them with libraries or just pure stream reading line per line. Analyzing the frag files: open the files and read them in ordered fashion. If two files report a similar intervals (starting blo

I have a lot of tapes and multiple libraries. I recently had a few failures, and wanted to check how many times each tape has been loaded and either read or written too to see if there is a trend with the oldest ones.  I created a little script to do this, and figured I’d sort it from the most loads at the top.    It ended up being a coincidence and I have plenty of life left in all my tapes, but always fun to lean a new command # Load Veeam PowerShell SnapIn if not already loadedif ((Get-PSSnapin -Name VeeamPSSnapIn -ErrorAction SilentlyContinue) -eq $null) { Add-PSSnapin VeeamPSSnapIn}# Get all tape media$tapes = Get-VBRTapeMedium# Create an array to hold the results$results = @()foreach ($tape in $tapes) { $tapeInfo = "" | Select-Object 'TapeName', 'LoadCount' $tapeInfo.TapeName = $tape.Name $tapeInfo.LoadCount = $tape.LoadCount $results += $tapeInfo}$results | Sort-Object LoadCount -Descending | Format-Table 

SummaryAnother powerful PowerShell script that leverages Veeam Backup & Replication to simplify the process of restoring virtual machines. With this script, you can perform staged VM restores. The script automates the entire process, from connecting to the Veeam server and listing available restore points to selecting a restore point and initiating the restore process. The script Download hereThe script is highly customizable and utilizes several parameters to tailor the restore process to your specific needs. Let's take a closer look at these parameters:ESXiServer: Specify the name of the target ESXi server where the VM will be restored. This allows you to choose the appropriate destination for the restore operation.VMName: Provide the name of the VM that you want to restore. This ensures that the script locates the correct VM during the restore process.Jobname: Enter the name of the Veeam backup job that contains the VM you wish to restore. This parameter helps the script identif

Anyone created veeam python library through swagger.json and has been successful in creating backup job?

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v12 is now available on VeeamHub! For more details on the script itself, I recommend reading the documentation on VeeamHub.https://github.com/VeeamHub/powershell/tree/master/BR-UpgradeV12 If you’re familiar with my previously written upgrade scripts for v10 and v11, here’s a summary of enhancements in this latest release:Support for both Windows Server 2019 & 2022 Added support for VBR plugins Veeam Backup for AWS Veeam Backup for Microsoft Azure Veeam Backup for GCP Veeam Backup for Nutanix AHV Veeam Backup for Red Hat Virtualization Veeam Plug-in for Kasten K10 Added support for Veeam Explorer for PostgreSQL Added function to test for pending reboots prior to beginning upgrade Added patch install functionality if Updates folder is present in the Veeam ISO Added check for license as it’s required for VBEM upgrade Added ISO validation as the script was written for v12

First time sharing, so feedback is much appreciated. There is a lot improvement possible but this short script did the trick. A while ago we came across an issue after automation made some unforeseen changes to the vm. Therefore I was tasked with the restore of a system file from +1000 vms from a specific date (not the last backup)VBR backup  Agent backups Netapp snapshot onlyThe CSV file exists out the vm name & backupjob name for the VBR & Agent restores. (extracted this from the notes in vcenter where possible)For the netapp restore the vmname was only needed.Here is the script that made my life easier:function Get-TimeStamp { return Get-Date -UFormat "[%Y-%m-%d %T]"}# Starting script# --Write-Host "$(Get-TimeStamp) - Starting script"$vmlist = import-csv C:\scripts\Veeam\restore\vmlist.csv -Delimiter ";"Foreach ($vm in $vmlist) { $backupjob = $vm.backupjob $asset = $vm.vm $backup = Get-VBRBackup -Name $backupjob $restorepoint = Get-VBRRestorePoint -Backup $backup

IntroYou know the stories: Sometimes an incorrect keyboard layout can lead to incorrect entries. Or while coding, , you must make sure that you use the correct special characters such as ' or ", etc.  But let's focus on the main topic - Veeam ONE AlertsVeeam ONE Alert - Suspicious incremental backup sizeYou probably know this Veeam ONE Alert: Veeam ONE Alert - Suspicious incremental backup size. What many may not know is that you can configure Veeam ONE to perform remediation actions when alerts are triggered. These actions can be performed automatically or after manual approval.Veeam ONE offers the following types of remediation for alarms:Predefined actions that are configured for the most commonly used out-of-the-box alarms.  Custom scripts that you can specify in the settings of any alarm. For each severity level, Veeam ONE can run one or more custom scripts.For the Suspicious incremental backup size alert we do have a predefined action available: Predefined RemediationA SureBackup

What? Mount the contents of the latest restore point of a Linux VM to the very same or another VM using the data integration API. Why? Linux admins can just browse the backup contents on the local system and restore the files they need (on the CLI 😉) Advanced & complex restore scenarios Cross-restore to another server (source server and target server can be different) $machine = "esxrhel1"$machine_dns = "esxrhel1.lab.local"$machine_credentials = Get-VBRCredentials -Name "veeam" | ? { $_.Description.Contains("Veeam Linux Account") }$rp = Get-VBRRestorePoint -Name $machine | Sort-Object -Property CreationTime | select -Last 1$publishSession = Publish-VBRBackupContent -RestorePoint $rp -TargetServerName $machine_dns -TargetServerCredentials $machine_credentials -EnableFUSEProtocol -Reason "Test FUSE restore"# Print info on session$publishSession#Unpublish-VBRBackupContent -Session $publishSessionAs a result on the Linux system you’ll get loop mounts like these./dev/loop0 on /tmp/Veea

As the proverb says, "A script a week keeps the doctor away". This week, we'll turn our attention to the Veeam Data Integration API. The idea for the script was to program a kind of SecureRestore for Linux VMs. There are many blog posts about the Data Integration API together with Linux, but nowhere could I find a script that covers the following requirement:Restore a Linux VM with prior AVscan. Abort the process if a virus is found, otherwise do the restoreLet's start…PrerequisitesInstall the latest Win OpenSSH package on the host where the script will be used Win32-OpenSSH Generate a public/private key pair using PuTTYgen A Linux server with ClamAV installed (I used Ubuntu 22.04 LTS) Add the Linux server to Veeam Backup & Replication using the generated key: Add Linux Server A Backup Job protecting the Linux VM as well as a restore point (the script uses the latest for the Restore)How to install ClamAVA quick guide to install ClamAV on the Ubuntu serverUpgrade your package listsu

If you have Veeam on your domain, or Enterprise Manager and want to give a user access for a specific amount of time, you can achieve this with a simple PowerShell command.  Add-ADGroupMember -Identity ‘Group_NAME’ -Members ‘Username’ -MemberTimeToLive (New-TimeSpan -Minutes *****) The issue with this is trying to calculate minutes to days, weeks, months, or having some sort of searchable way to do this task.  Onboarding users with this method was proving difficult so I thought of easier ways to achieve this.  What started off with an overly complex excel spreadsheet to extract minutes from dates and generate a command has now become an PowerShell based GUI.  In the below script. anything with “*****” should be replaced with items from your own AD infrastructure. This allows to search 1 or many users and add them to 1 or many groups. If you select the TTL checkbox, you can select the end date when the users will be removed from the groups. The user and group names can be searched start