YARA and Script Library

🌟 Introducing the Backup Scanning Tools Web Console! 🌟You wanted it! - I got it! How to Get Started The Backup Scanning Tools Web Console is also downloaded from the installation script (see original post).Before you start the script, you must open the backup-scanning-tools-webmenu.ps1 script file with a text editor and adjust the following variables:$scanningToolsPath Set this variable to the path where the individual scanning scripts were installed, e.g., "D:\Scripts\vbr\scanningtools".$LogFilePath            Specify the path for the log file (default is "C:\Temp\log.txt").  The script includes optional parameters that you can customize according to your preferences. These parameters are as follows:$Port                      Set the port number for the web server (default is 8080). $RefreshInterval  Define the interval (in seconds) for refreshing the web page (default is 300 seconds)You can also pass the parameters when starting the script. More details in the README document.And Y

As already announced (see here), the first draft of the Backup Scanning Tools Menu has just been made available in my GitHub repository. This script is designed to provide a user-friendly, menu-driven interface for triggering the various backup scan tools that I have provided in the past. It allows the user to choose from a number of options, each corresponding to a specific type of backup scan. The script provides detailed descriptions of each scan operation before prompting the user to enter the required parameters for execution.Besides the actual Scanning Tool Menu script I also created an installer script that "installs" all necessary scan scripts into the selected directory.InstallationFollow these steps:Download the Installer Script Download the backup-scanning-tools-installer.ps1 script to your local machine. Open a PowerShell terminal with administrator privileges Run the Installer script Execute the backup-scanning-tools-installer.ps1 script with the required parameter -Instal

I’m using Veeam Backup for Microsoft Office 365 version 4.0 and want to copy all of the OneDrive data from users into their new accounts $DestinationSubfolder = 'Restored Work'$VeeamBackupJobName = 'BMC_M365_Data'$M365Credentials = Get-Credential$Job = Get-VBOjob -Name $VeeamBackupJobName$Session = Start-VEODRestoreSession -Job $Job -LatestState$UserToRestore = Get-VEODUser -Session $Session -Name 'Joe Bloggs'$UserDocuments = Get-VEODDocument -User $UserToRestoreif($UserDocuments){ $TargetUserName = 'Joe Bloggs 2' Restore-VEODDocument -User $UserToRestore -RestoreChangedItems -RestoreDeletedItems -Credential $M365Credentials -TargetUser $TargetUserName -TargetFolder $DestinationSubfolder}Else{ 'No OneDrive content found.'}Get-VEODRestoreSession | Stop-VEODRestoreSession The commands return this error though:“Restore-VEODDocument : Failed to find Online OneDrive library for: Joe Bloggs 2”I’ve added the second account to the original backup job to ensure Veeam can see it. Any id

This works great for me using forever forward incremental jobs. If you are using synthetic fulls, or reverse you may get unexpected results as your latest job will show as the full size. I took my previous script and modified it so I can look at the previous 2 weeks, and see the size of the backup for each day.  If you change the (-14) you can make this weekly, monthly, daily with ease. # Location of the Veeam backup folder$BackupFolderPath = "f:\Backups"# Start and end dates$EndDate = Get-Date$StartDate = $EndDate.AddDays(-14)# Function to convert bytes to GBfunction ConvertTo-GB { param ( [Parameter(Mandatory=$true)] [int64] $bytes ) return "{0:N2}" -f ($bytes / 1GB) + " GB"}# Go through each day from the start date to the end datefor ($Date = $StartDate; $Date -le $EndDate; $Date = $Date.AddDays(1)) { # Date in the format 'yyyy-MM-dd' $DateString = $Date.ToString('yyyy-MM-dd') # Get all backup files for this date $BackupFiles = Get-ChildItem

For those doing forever forward incremental jobs, this is a handy scrip to see the size of your jobs each day. If you use Synthetic jobs, or reverse incremental you may get unexpected results as your latest file will be the full backup file.  While doing some planning for new storage I wanted to see how big a daily backup of all jobs on a proxy was.Here is a little script I came up with that you can modify the section “Current.Date.AddDays(-1)” to look back further. I may modify the code at a later time to fine tune this.  This worked well to go back a few days, then see the average daily size. Add that to your total full backup size and you can predict out the space needed to meet your retention policies. # Location of the Veeam backup folder$BackupFolderPath = "F:\Backups"# Current date$CurrentDate = Get-Date# Date of the day before$PreviousDay = $CurrentDate.AddDays(-1).ToString('yyyy-MM-dd')# Function to convert bytes to GBfunction ConvertTo-GB { param ( [Parameter(Mandat

I’m trying to delete some user to data to free up licences and it seems to be taking forever to complete. I’m testing with a user who only has a few 100 emails but the command seems to have hung up. Here is the relevant part of the script:$RepositoryName = 'My_M365Repository'$UsersToRemove = @( 'Joe.Bloggs@MyDomain.com')$Repository = Get-VBORepository -Name $RepositoryNameforeach($UserToRemove in $UsersToRemove){ $UserToRemove $UserData = Get-VBOEntityData -Type 'User' -Repository $Repository -Name $UserToRemove if(-not($UserData)) { 'No user data found' } Else { # Use $UserData to see which backup types exist, and then only remove those. if($UserData.IsMailboxBackedUp) { Write-Host 'Removing Mailbox data' Remove-VBOEntityData -Repository $Repository -User $UserData -Mailbox -Confirm:$false } }}Any idea if I’m doing something wrong, or that cmdlet really does just take ages? Thanks.

Hi everyone,I wrote some reports that helps me to manage Veeam backups. I put them online to share it to community. Feel free to use them and personnalize them 👍 BR-MorningReport : shows backup results of the night BR-DurationReport : shows duration and layout of backup jobs 

IntroductionOver the past few months, I have had customers report over-consumption of VUL, when leveraging Veeam NAS backups.Veeam NAS backup is licensed by the amount of protected source data. The protected data amount is rounded down to the nearest 500GB and consumes one VUL per 500GB (see the user guide for details).The important licensing caveat is that if, for instance, a same share is protected by two different backup jobs, even though it is the same source data, its protected amount doubles (in this particular instance).It easy to see how your VUL consumption can very quickly get out of control. The purpose of that short post is to share a very small script that helps identify if a given share has been backed up multiple times.Note: The script only analyzes the defined shares path and cannot detect any “share alias” set on the NAS device. ScriptThe script lists all NAS backup jobs and combs through its protected shares, sort the data and generates an HTML and CSV report. See the

hello, Small trick following a bad handling. The objective is to restore on a Windows file server the ACLs of the files without restoring the files.For this we will start by opening the console restore guest files. Once done, click on any file, then explore to find the path to the FLR mount.To get the list of ACLs you can run a single command. This command will save all subfolders and files as a plain text. The text file (acl.txt) will be saved on your current user folder.icacls c:data /save acl.txt /t /cWhere “C:data” is the FLR path, “T” is added to get all subfolders and files on that drive, and “C” allows to ignore all the access errors.If the number of folders and files are too large, then the command will take a long time to complete its execution. At the end of execution, you will get the list of total files which is processed successfully, and the number of files which don’t get success in processing.If you want to restore the lists, execute the following commandIcacls c: /rest

IntroductionOne of the standout features of Veeam Backup & Replication is SureBackup, which allows for the automated testing and verification of backups. SureBackup creates isolated environments, called Virtual Labs, to ensure the recoverability of your virtual machines. During a SureBackup session, it sometimes would be helpful to connect the virtual machines to the Internet  By default, the VMs within the Virtual Lab run in an isolated environment and do not have access to the Internet. If you want the VMs in the Virtual Lab to access the Internet, select the Allow proxy appliance to act as an Internet proxy for virtual machines in this lab check box. See  Setup Proxy Appliance and Veeam KB1165.With the HTTP proxy settings in place, you can easily download security patches, update antivirus definitions, and install software updates on your Linux VMs. With this you can enhance your software testing and patching processes, streamline deployment workflows, verify compatibility, and

Hi all, Recently I started experimenting with XFS savings calculation. I’ve seen some good work from the community and therefor I want to say, thanks for all people that played with xfs_bmap, filefrag, and especially mweissen13 with some good idea’s on how to find the overlapping intervalsI’m sharing here what I believe is a working implementation:https://github.com/tdewin/ttozz/tree/main/sortedfragmentsSo first of all, I’ve split up the work in 2 parts:Creating frag files: these files are basically filefrag output but reordered on volume level offset. This is required to find the overlapping intervals (shared blocks). Notice that filefrag order the fragments on file level offset. You can cat the files if you are curious. They are basically in YAML format because you should be able to easily parse them with libraries or just pure stream reading line per line. Analyzing the frag files: open the files and read them in ordered fashion. If two files report a similar intervals (starting blo

I have a lot of tapes and multiple libraries. I recently had a few failures, and wanted to check how many times each tape has been loaded and either read or written too to see if there is a trend with the oldest ones.  I created a little script to do this, and figured I’d sort it from the most loads at the top.    It ended up being a coincidence and I have plenty of life left in all my tapes, but always fun to lean a new command # Load Veeam PowerShell SnapIn if not already loadedif ((Get-PSSnapin -Name VeeamPSSnapIn -ErrorAction SilentlyContinue) -eq $null) { Add-PSSnapin VeeamPSSnapIn}# Get all tape media$tapes = Get-VBRTapeMedium# Create an array to hold the results$results = @()foreach ($tape in $tapes) { $tapeInfo = "" | Select-Object 'TapeName', 'LoadCount' $tapeInfo.TapeName = $tape.Name $tapeInfo.LoadCount = $tape.LoadCount $results += $tapeInfo}$results | Sort-Object LoadCount -Descending | Format-Table 

SummaryAnother powerful PowerShell script that leverages Veeam Backup & Replication to simplify the process of restoring virtual machines. With this script, you can perform staged VM restores. The script automates the entire process, from connecting to the Veeam server and listing available restore points to selecting a restore point and initiating the restore process. The script Download hereThe script is highly customizable and utilizes several parameters to tailor the restore process to your specific needs. Let's take a closer look at these parameters:ESXiServer: Specify the name of the target ESXi server where the VM will be restored. This allows you to choose the appropriate destination for the restore operation.VMName: Provide the name of the VM that you want to restore. This ensures that the script locates the correct VM during the restore process.Jobname: Enter the name of the Veeam backup job that contains the VM you wish to restore. This parameter helps the script identif

Anyone created veeam python library through swagger.json and has been successful in creating backup job?

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v12 is now available on VeeamHub! For more details on the script itself, I recommend reading the documentation on VeeamHub.https://github.com/VeeamHub/powershell/tree/master/BR-UpgradeV12 If you’re familiar with my previously written upgrade scripts for v10 and v11, here’s a summary of enhancements in this latest release:Support for both Windows Server 2019 & 2022 Added support for VBR plugins Veeam Backup for AWS Veeam Backup for Microsoft Azure Veeam Backup for GCP Veeam Backup for Nutanix AHV Veeam Backup for Red Hat Virtualization Veeam Plug-in for Kasten K10 Added support for Veeam Explorer for PostgreSQL Added function to test for pending reboots prior to beginning upgrade Added patch install functionality if Updates folder is present in the Veeam ISO Added check for license as it’s required for VBEM upgrade Added ISO validation as the script was written for v12

First time sharing, so feedback is much appreciated. There is a lot improvement possible but this short script did the trick. A while ago we came across an issue after automation made some unforeseen changes to the vm. Therefore I was tasked with the restore of a system file from +1000 vms from a specific date (not the last backup)VBR backup  Agent backups Netapp snapshot onlyThe CSV file exists out the vm name & backupjob name for the VBR & Agent restores. (extracted this from the notes in vcenter where possible)For the netapp restore the vmname was only needed.Here is the script that made my life easier:function Get-TimeStamp { return Get-Date -UFormat "[%Y-%m-%d %T]"}# Starting script# --Write-Host "$(Get-TimeStamp) - Starting script"$vmlist = import-csv C:\scripts\Veeam\restore\vmlist.csv -Delimiter ";"Foreach ($vm in $vmlist) { $backupjob = $vm.backupjob $asset = $vm.vm $backup = Get-VBRBackup -Name $backupjob $restorepoint = Get-VBRRestorePoint -Backup $backup

IntroYou know the stories: Sometimes an incorrect keyboard layout can lead to incorrect entries. Or while coding, , you must make sure that you use the correct special characters such as ' or ", etc.  But let's focus on the main topic - Veeam ONE AlertsVeeam ONE Alert - Suspicious incremental backup sizeYou probably know this Veeam ONE Alert: Veeam ONE Alert - Suspicious incremental backup size. What many may not know is that you can configure Veeam ONE to perform remediation actions when alerts are triggered. These actions can be performed automatically or after manual approval.Veeam ONE offers the following types of remediation for alarms:Predefined actions that are configured for the most commonly used out-of-the-box alarms.  Custom scripts that you can specify in the settings of any alarm. For each severity level, Veeam ONE can run one or more custom scripts.For the Suspicious incremental backup size alert we do have a predefined action available: Predefined RemediationA SureBackup

What? Mount the contents of the latest restore point of a Linux VM to the very same or another VM using the data integration API. Why? Linux admins can just browse the backup contents on the local system and restore the files they need (on the CLI 😉) Advanced & complex restore scenarios Cross-restore to another server (source server and target server can be different) $machine = "esxrhel1"$machine_dns = "esxrhel1.lab.local"$machine_credentials = Get-VBRCredentials -Name "veeam" | ? { $_.Description.Contains("Veeam Linux Account") }$rp = Get-VBRRestorePoint -Name $machine | Sort-Object -Property CreationTime | select -Last 1$publishSession = Publish-VBRBackupContent -RestorePoint $rp -TargetServerName $machine_dns -TargetServerCredentials $machine_credentials -EnableFUSEProtocol -Reason "Test FUSE restore"# Print info on session$publishSession#Unpublish-VBRBackupContent -Session $publishSessionAs a result on the Linux system you’ll get loop mounts like these./dev/loop0 on /tmp/Veea

As the proverb says, "A script a week keeps the doctor away". This week, we'll turn our attention to the Veeam Data Integration API. The idea for the script was to program a kind of SecureRestore for Linux VMs. There are many blog posts about the Data Integration API together with Linux, but nowhere could I find a script that covers the following requirement:Restore a Linux VM with prior AVscan. Abort the process if a virus is found, otherwise do the restoreLet's start…PrerequisitesInstall the latest Win OpenSSH package on the host where the script will be used Win32-OpenSSH Generate a public/private key pair using PuTTYgen A Linux server with ClamAV installed (I used Ubuntu 22.04 LTS) Add the Linux server to Veeam Backup & Replication using the generated key: Add Linux Server A Backup Job protecting the Linux VM as well as a restore point (the script uses the latest for the Restore)How to install ClamAVA quick guide to install ClamAV on the Ubuntu serverUpgrade your package listsu

If you have Veeam on your domain, or Enterprise Manager and want to give a user access for a specific amount of time, you can achieve this with a simple PowerShell command.  Add-ADGroupMember -Identity ‘Group_NAME’ -Members ‘Username’ -MemberTimeToLive (New-TimeSpan -Minutes *****) The issue with this is trying to calculate minutes to days, weeks, months, or having some sort of searchable way to do this task.  Onboarding users with this method was proving difficult so I thought of easier ways to achieve this.  What started off with an overly complex excel spreadsheet to extract minutes from dates and generate a command has now become an PowerShell based GUI.  In the below script. anything with “*****” should be replaced with items from your own AD infrastructure. This allows to search 1 or many users and add them to 1 or many groups. If you select the TTL checkbox, you can select the end date when the users will be removed from the groups. The user and group names can be searched start

Good Monday everyone! Another week, another script 😉 This time for the Veeam file share backup jobs.IntroAlso last Friday another script was ready for release, but I didn't want to "interrupt" the World Backup Day celebrations with a dull script ;) And my last script also caused quite some buzz in our backup world:vbr-job-scanner-ps1And I promised that more will come...    The scriptIn my GitHub repository you can find a script that checks if a unexpectedly high number of files have been backed up via file share backup compared to the last times. There are two versions of this script:vbr-nasjob-scanner.ps1 - For manual checks vbr-nasjob-scanner-post-script.ps1 - For use in the Backup Job as a post-script Details and instructions on the readme page.Feedback welcome!

Spring is here 💐 and with it comes another script. This time for Veeam Backup & Replication.The script shows different job configuration settings and can be used to quickly identify differences in job settings.The Readme and code lines can be found in GitHub:Bits & BytesMore to come depending on your feedback (I already got one related to NAS backup)

The problemHave you ever needed to know how much data you need to backup incrementally from your VMware environment? Because you need to design a new backup storage? Because you need to know, if your WAN is capable of transferring everything into the cloud or from your branch office? Because you need to know the change rates of your VMs? The solutionNow you can track these data changes with a simple script! Let me introduce you to GetChangedBlocksV2! It is a PowerShell script which uses the VMware PowerCLI to read the changes from your VMware disks each time it is run and saves it as CSV. It keeps track of the changes between each run, between each day and between each week. In order to get good results, you need to run this tool on a regular basis, e.g., with the Task Scheduler.There is even a basic Excel file included to analyze the results for you. But if you have better tools feel free to utilize them. Where to get it?https://github.com/turboPasqual/GetChangedBlocksV2 Other stuffWh

If you do not run VeeamONE, it can be challenging to check if every VM that should be backed up, is really backed up. Therefore I wrote a small PowerShell script. Basically this script looks for each VM if there is a restore point for this VM. If not, it gets listed. Extra feature: Script connects to every vCenter that is registered in B&R server. There is a Blocklist included: when VMs should not be backuped, just place their name in the blocklist and they will not be shown in the list. So you can exclude VMs without editing the script.Notes:CredObject.xml is used for stored, encrypted credentials. Script connects to local B&R server, so it should run there if not changed. # Load Plugin and moduleAdd-PSSnapin VeeamPSSnapinImport-Module VMware.VimAutomation.Core# Configure for multiple vCenter ConnectionsSet-PowerCLIConfiguration -DefaultVIServerMode Multiple -Scope Session -Confirm:$falseSet-PowerCLIConfiguration -InvalidCertificateAction Ignore -Scope Session -Confirm:$false#

IntroIn the past I’ve shared some scripts with the community which were related to security stuff. Among my many ideas (I should put down on paper everything that is buzzing around in my head), someone recently asked in our internal Teams Veeam MVP chat the following question: "Can somebody please integrate VONE's Suspicious Backup file size and job duration alarm into VBR?" Friday MoodI try to keep every Friday afternoon free for some exciting projects. Most of the projects are related to customer or partner requests that can’t be handled directly with Veeam products. So, last Friday's slogan was "It's Friday again.....". (Who knows the song?)My approach was to create two scripts. One for manual execution, the other for integration into existing backup jobs with the possibility to display the result in the backup job statistics. The ResultPlease have a look into Brad's post, who was asking for the possibility to identify this in VBR: Linch TipsRelease v1.1 of the script will include t