Skip to main content
  • EN

YARA and Script Library

Download featured YARA rules, browse code samples or contribute your own scripts

  • 166 Topics
  • 904 Comments
166 Topics
vChris
vChrisNot a newbie anymore
posted in YARA and Script Library
Powershell script - SQL Automated restore with NDF handling

Hello there,I have a customer who wanted to restore some DBs multiple time per month from production to different stages (dev, test ...) and doesn’t want to delegate the rights with EM or to the console to the devs (surprised Pikachu face). Nor spend hours behind their screen to do it themselves. So i created a script that can be scheduled (windows task) or triggered with their own automation tool.As the source databases are split with multiple NDF I had to figure it out. So here it is, it's far from "State of the Art" script but it does the job.(I have a "vaulted" version that can pick credentials from an encrypted file but I'm not that happy with it so here is the script without it. Feel free to improve it.)# Restore a specified SQL database to a specified folder on the same or different server, rename it, add it to an availability group.# Used, for example, to "restage" the prod database to Dev/Qual# Created by Christian Bocquet - https://www.linkedin.com/in/vchris/ on 11.07.2022# V

5441
T
2 years ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Powershell - VBR NAS Scanner

While presenting our powerful file share protection and recovery capabilities, I often show the Instant File Share Recovery feature. One possible purpose for this feature is scanning the share with an AV solution. For this, I created this script to be able to quickly show it to our customers and partners:https://github.com/yetanothermightytool/powershell/blob/master/vbr/vbr-nas-scanner/More to come....stay tuned 

1327
marcofabbri
2 years ago
Bulent.Tolu
Bulent.ToluComes here often
posted in YARA and Script Library
Gathering VBM365 Restore Sessions/Events via Powershell

Hello Everyone, one questions always get asked if it is possible to know “who has touched/restored what and when” to audit for compliance or for any other requirement. For Veeam Backup for Microsoft 365, there is already great information published in the post(s) and blog of Jorge, explaining all in very great detail: https://community.veeam.com/blogs-and-podcasts-57/vb365-restore-audit-the-definitive-guide-2557Possibly, where you need a quick dump of all restore activities (now!), you may also utilize PowerShell interacting with the RESTAPI of VBM365 and list all restore sessions and their events. And the script below is just an “example” to achieve such. You may play with all properties per your needs and create output as you require, even the modified output could even be used to feed into some other applications. (Currently it is only for v6)RestoreSession and RestoreSessionEvent is what we need to use mainly. The script finds the restore sessions, and then iterates through each of

1321
Chris.Childerhose
2 years ago
D
ddomaskComes here often
posted in YARA and Script Library
Tape Library Inventory Report

Hey all,Again, hope it’s not spam, but wanted to share some custom code that came up for the purpose of a case and let the community have it also (since why not?)Issue:You want to have an inventory of Current Tape Locations Library Association Other Tape Elements There isn’t really a “nice” VeeamOne report for this (vOne just reports on Vaulted Tapes), and checking the tape WebUI isn’t always convenient nor is checking the Veeam Tape node.If you find a need for this, check this out:using namespace System.Collections.Genericfunction Get-VBRTapesInLibrary { param( [Veeam.Backup.PowerShell.Infos.VBRTapeLibrary[]]$Library ) $TapesInLibrary = Get-VBRTapeMedium | Where-Object {$_.LibraryID -eq $Library.id} return $TapesInLibrary}function New-TapeLocationPropertiesObject { param( [Veeam.Backup.PowerShell.Infos.VBRTapeMedium[]]$tapemedium ) $TapeBarcode = $tapemedium.Barcode $TapeName = $tapemedium.Name $TapeLocation = $tapemedium.Location.Type if($tapemedium.Location.Type -eq "Drive"){

3662
Chris.Childerhose
2 years ago
D
ddomaskComes here often
posted in YARA and Script Library
Retention Restore Age Report

Hopefully not spam, but occasionally I’ll see questions from Support Cases on “Can we do X with Powershell” and it gets my interest enough that I like to pump out a quick script as proof of concept.As a quick reminder, Veeam Support does not produce custom code on demand, so cases aren’t the right route for getting help with scripts or ideas. Such requests are routed to the forums for assistance.But, I’d feel bad not sharing the results of my curiosity as maybe someone would find it useful. Scenario:We ended up with a case where a client wanted to help gauge where they should keep their retention at based on the average age of restore requests. This is a great and proactive question and I really liked the idea of checking one’s retention policies against real-world use in their environment.VeeamOne has a great report for this already with the Restore Operator Activity, and I recommend you use that if you are licensed for VeeamOne. If not however, this is fairly fast and easy script to

1514
regnor
2 years ago
P
PresleyVNNew Here
asked in YARA and Script Library
SQL Commands Veeam

SQL Commands for Veeam to be able to link a Backup Job that was done before the Veeam B&R Server was migrated to a new server. and Perform a Backup Copy Job.

59111
vNote42
2 years ago
k00laidIT
k00laidITVeeam Vanguard
posted in YARA and Script Library
kb3067-validation.ps1 script

<#.SynopsisTo be used after running the iland-kb3067.ps1 to verify that all data has been evacuated from the source repository. As logging is done by user it can be hard to ensure all data has moved from the Data Management job session logs..NotesVersion: 1.0Author: Jim Jones, @k00laidITModified Date: 5/23/2022.EXAMPLE.\kb3067-validation.ps1#>Import-Module Veeam.Archiver.PowerShell#Organization selection$orgs=Get-vboorganization | Sort-Object Namefor($i=0; $i -lt $orgs.count; $i++){write-host $i. $orgs[$i].name}$organisationNum = Read-Host "Enter organisation number"$vboOrg = $orgs[$organisationNum]$orgjobs = $vboOrg | get-vbojob[System.Collections.ArrayList]$orgrepos = @()foreach ($orgjob in $orgjobs) { $repo = $orgjob.repository $output = [PSCustomObject]@{ repoName = $repo } $orgrepos += $output }#Source Repository selection$sourcerepo = $orgrepos#$sourcerepo=Get-VBORepository | Sort-Object Namefor($i=0; $i -lt $sourcerepo.co

1201
Chris.Childerhose
2 years ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
VB365 Restore Portal Setup Scripts

Here’s a collection of scripts that can be used to automate the setup and configuration of the Veeam Backup for Microsoft 365 Restore Portal. These scripts can be used for VB365 environments protecting a single Microsoft 365 Organization and for those with multiple Microsoft 365 Organizations in a multi-tenant setup (like in a Service Provider scenario).For more detailed information, please follow the VeeamHub link:https://github.com/VeeamHub/powershell/tree/master/VB365-RestorePortalSetup

5683
marcofabbri
2 years ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Powershell - VBO Health Check

Update Jan 13th - Latest version available on https://github.com/yetanothermightytool/powershell/tree/master/vbo/vbo-health-checker***It's always recommended to open a support case as soon you're facing an issue with Veeam Backup for Microsoft Office 365. But as systems engineers, we somehow always want to know what happens under the hood That's why I started writing a VBO Health Check script which quickly gives some useful information about the health of a Veeam Backup for Microsoft 365 setup. The script checks and reports possible issues/misconfigurations:    - Backup Job Status per Job / Number of failed job    - License expiration date    - Check logs if throtthling occured on MS side    - Possible slow backup due to slow backup repository    - Proxy stuff (min. recommended CPU and Memory)    - Check Windows event log for low memory conditions        - Logfile with the findingsLogfile gets stored in “C:\Scripts\Veeam\vbo\vbo_healthcheck_<computername>.log”Note: The script is

150715
SteveHeart
2 years ago
k00laidIT
k00laidITVeeam Vanguard
posted in YARA and Script Library
Get-VeeamDistroSvc.ps1

#Requires -Version 5.1 -PSEdition Desktop<#.SynopsisReports on a given list of AD servers if they have the VeeamDistributionSvc running and it's startType. This is in response to Veeam KB4288, https://www.veeam.com/kb4288.NotesVersion: 1.0Author: Jim Jones, @k00laidITModified Date: 3/13/2022.EXAMPLE.\Get-VeeamDistroSvc.ps1#>$svcName = "VeeamDistributionSvc"$servers = Get-ADComputer -filter * | where {$_.Name -like "*veeam*" -or $_.Name -like "*backup*" -or $_.Name -like "*whatever*"}[System.Collections.ArrayList]$mySvcInfo = @()foreach ($server in $servers) { $svcstatus = get-service -ComputerName $server.name -Name $svcName | select name, status, startType $quickInfo = New-Object psobject -Property @{ server = $server.name service = $svcstatus.Name status = $svcstatus.status startType = $svcstatus.startType } $mySvcInfo += $quickInfo}$mySvcInfo | select server, service, status, startType 

1692
regnor
2 years ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Powershell - Veeam Backup for Microsoft Azure Worker "Tagger"

You want to tag your Veeam Backup for Microsoft Azure Workers? Here's a script that will help you:https://github.com/yetanothermightytool/powershell/tree/master/vbazure/vbazure-workertag

622
JMeixner
2 years ago
E
EdxHComes here often
posted in YARA and Script Library
Veeam Easy Connect - making REST APIs a bit easier

Hi thereI’ve been working on a module to make connecting to Veeam APIs a bit easier when using Python (yes I am a big fan).https://github.com/shapedthought/veeam-easy-connectComments, issues and pull requests welcome.Cheers, Ed

11098
E
2 years ago
falkob
falkobVeeam Vanguard
posted in YARA and Script Library
Automatically create vSphere roles to use with Veeam Backup & Replication

Since I was tired to click roles together in vCenter server, I wrote a simple script on creating a vCenter role for Veeam with PowerCLI.This PowerShell / PowerCLI script lets you create a new vCenter server role with all the cumulative privileges and permissions to use them with Veeam Backup & Replication V10.The privileges used are based on the recommendations out of the Veeam Help Center which you can find here: Cumulative Permission for VMware vSphere – Veeam Help CenterSimply execute the script and follow the steps to fill in the relevant data like your vCenter server name, the username and your password. The script will then ask you to choose a name for your new role and automatically creates it. The script in actionThe script was successfully tested against:VMware vCenter 6.5 VMware vCenter 6.7 VMware vCenter 7.0You can read about this on my blog:https://www.virtualhome.blog/2020/04/22/creating-a-vcenter-role-for-veeam-with-powercli/The script is online at github: https://git

11567
Chris.Childerhose
2 years ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Powershell - VBO Audit Item Configurator

Another week, another script Today I’m sharing a Powershell script to configure the audited items (user) and set the audit notification settings. More details about the enhanced audit item functionality can be found here:https://www.veeam.com/blog/next-gen-office-365-backup-security-auditing-and-reporting.htmlThe read me and the code can be found on github:https://github.com/yetanothermightytool/powershell/tree/master/vbo/vbo-auditcfg 

2484
SteveHeart
2 years ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Powershell - VBO OneDrive for Business File Restore Checker

Another check script for OneDrive for Business data, protected by VBO. The script downloads a specific file and compares the hash value with the value specified by the user. Feedback welcome!Download Linkhttps://github.com/yetanothermightytool/powershell/tree/master/vbo/vbo-odrestore-checker Outlook upcoming scriptsI have a script ready that uploads the detected file hashes/the files to a cloud-based detection and prevention solution and returns the result of the scan. 

1415
I
2 years ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Powershell - VBO Exchange Mailbox Item Restore Content Checker

During my presentations on VBO to customers and partners, people sometimes ask whether the recoverability of data can be checked automatically (Our Veeam Backup & Replication customers love SureBackup). However, this functionality is not available.Since I have now been told this "wish" several times, I thought "New Year, New Luck!"First, I share the Powershell script to check backed up Exchange Online restore data. With this script it is possible to save an email from a mailbox to a local directory and check if a certain pattern can be read.More functions will be added soon. Please give me feedback what can be improved or added.A script for checking OneDrive for Business data will also be available soon. The script can be found here:https://github.com/yetanothermightytool/powershell/tree/master/vbo/vbo-exrestore-checker And don't forget: Always post feature requests in our R&D forum!

2244
regnor
2 years ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Powershell - Exclude Teams object(s) from VBO Backup Job

Last year Veeam Backup for Microsoft Office 365 v5 added purpose-built backup and recovery for Microsoft Teams. Since then many customer and partners asked me "How can we protect all of our teams and exclude specific teams objects based on names automatically?".As there is no filter logic within the UI for the Backup Job object exclusion list, I solved this "problem" using the script down below. First we store the credentials (encrypted) in a txt file:$credential = Get-Credential$credential.Password | ConvertFrom-SecureString | Set-Content <path to secure.txt>And here's the script. Just change the values for the following variables: $organizationname Name of the tenant - Only needed if more than one is configured$backupjob            Name of existing the Backup Job$filter                    Name of the team that needs to be excluded. Regular expressions can be used$userName            Username for retrieving the existing Teams in M365$passwordText       Path to the secure.txt fil

8877
SteveHeart
2 years ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Identifying Cloud Connect Orphaned Backups

Here’s a sample PowerShell script to identify Cloud Connect backups that are no longer tied to an active Backup Job. It also includes functionality to only show restore points older than XX days.Further background info on this script... When a Copy Job (or Backup Job) is deleted that was sending its backups to a (Cloud Connect) Cloud Repository, the backup files are not deleted by default. This behavior is great as it enables a backup administrator to hold on to the backups according to their company's retention policy. Sometimes, though, these backups are forgotten which results in additional storage consumed in the Cloud Repository which translates to higher storage costs. This script provides an automated method of identifying these backups so they aren't forgotten.NOTE: This script is designed to be executed on a Veeam Backup & Replication server that sends backups to a Cloud Repository. It will not work if executed on a Cloud Connect server.For more detailed information, pleas

5203
Chris.Arceneaux
2 years ago
7
7Ryan7New Here
asked in YARA and Script Library
Automatically remove machines from Job

Hey All,I’ve tried to get some automation for the backup of my Citrix base images.  I have a script that adds a machine to the backup job based on the name.  Of course, these machines get created and deleted like flies, and I was wanting to automatically remove them if they’ve been removed from vCenter.  I guess I could use tags, but then I’d have to rely on my Citrix admin to use the tags, and if it’s forgotten then there’s no backup, so I’ve decided a script is the way to go. So adding machines to the jobs works wonderfully, but I can’t seem to nail the way to remove the machines that aren’t in vCenter inventory. I also have the auto delete from backups turned on to prune the base images after x days.   Here’s the snippet of powershell causing issues:#Searches the backup job to find any VM that don't have a size associated with the VM and assigns it to the variable  ie. VM is still in the job but the VM is deleted.$NullVM = Get-VBRJobObject -job $Citrixbackupjob | Where-Object -Prope

3597
D
3 years ago
Markus.K1985
Markus.K1985Comes here often
posted in YARA and Script Library
[PowerShell] Get All Backup Repositories Advanced

[Array]$RepoList = Get-VBRBackupRepository | Where-Object {$_.Type -ne "SanSnapshotOnly"} [Array]$ScaleOuts = Get-VBRBackupRepository -ScaleOutif ($ScaleOuts) { foreach ($ScaleOut in $ScaleOuts) { $Extents = Get-VBRRepositoryExtent -Repository $ScaleOut foreach ($Extent in $Extents) { $RepoList = $RepoList + $Extent.repository } }}$RepoList | Select-Object Name, Path, `@{Name="CachedTotalSpaceGB"; Expression= {[Math]::Round([Decimal]$_.info.CachedTotalSpace/1GB,2)}}, `@{Name="CachedFreeSpaceGB"; Expression= {[Math]::Round([Decimal]$_.info.CachedFreeSpace/1GB,2)}} | Format-Table -AutoSize 

147610
D
3 years ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Veeam Collection for Ansible: v11 support

Support for Veeam Availability Suite v11 (VBR/EM/ONE) is now available in the Veeam Collection for Ansible! Here’s a blog post outlining changes made and improvements: https://www.arsano.ninja/2021/03/03/veeam-ansible-collection-v11/ For those not familiar with this Ansible collection, please see this blog post for an introduction.

6675
Chris.Arceneaux
3 years ago
k00laidIT
k00laidITVeeam Vanguard
posted in YARA and Script Library
Restart-VSS.ps1 Script

One thing I’ve found as a Veeam customer is you often have to restart the VSS services on your SQL and other VSS aware servers. Here’s a script I wrote to do just that.# Name: Restart-VSS.ps1# Description: Restarts list of services in an array on VMs with a given vSphere tag. Helpful for Veeam B&R processing# For more info on Veeam VSS services that may cause failure see https://www.veeam.com/kb2041Import-Module VMware.PowerCLI$vcenter = "vcenter.domain.com"$services = @("SQLWriter","VSS")$tag = "myAwesomeTag"Connect-VIServer $vcenter$vms = Get-VM |where {$_.Tag -ne $tag}ForEach ($vm in $vms){ ForEach ($service in $services){ If (Get-Service -ComputerName $vm -Name $service -ErrorAction SilentlyContinue) { Write-Host $service "on computer" $vm "restarting now." Restart-Service -InputObject $(Get-Service -Computer $vm -Name $service); } }} 

17789
k00laidIT
3 years ago
bp4JC
bp4JCInfluencer
posted in YARA and Script Library
Validator Script

Hi, all I made a simple script that will allow you to run the backup validator and receive a report.  echocd C:\Program Files\Veeam\Backup and Replication\BackupVeeam.Backup.Validator.exe /backup:"BackupName" /report:"C:\VeeamReports"rem May have to specify name(s) of VMs being backed up in jobrem If there are multiple backup jobs, you must create a new line for each job --> Veeam.Backup.Validator.exe /backup:"BackupName" /report:"C:\VeeamReports"

4643
bp4JC
3 years ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Automated Upgrade to Veeam Backup & Replication v11

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v11 is now available on VeeamHub! Here’s a blog post with more detailed information: https://www.arsano.ninja/2021/03/09/veeam-unattended-upgrade-v11/ If you're a VCSP, the script can also be used for Cloud Connect environment upgrades.

9207
marcofabbri
3 years ago
k00laidIT
k00laidITVeeam Vanguard
posted in YARA and Script Library
VSPC API v3 Storage Report

<#.Synopsis Generates report of all repositories known to a given Veeam Service Provider Console Server. Uses the new v3 API so your milage may vary..Notes Version: 1.0 Author: Jim Jones Modified Date: 8/21/2020 If running for the first time a new computer You will need to run to store the credentials $credpath='c:\creds\myadmincred.xml' GET-CREDENTIAL –Credential (Get-Credential) | EXPORT-CLIXML $credpath.EXAMPLE .\VACStorageReport.ps1 -vacServer 'vac.mydomain.com' -authPath 'c:\creds\myadmincred.xml'#>[CmdletBinding()]Param ( [string]$vacserver = "vac.mydomain.com", [string]$authpath = "c:\creds\myadmincred.xml")#Email Variables$date = Get-Date$sgToken = "SendGridToken"$fromAddress = "myvac@mydomain.com"$fromName = "US VAC"$toName = "NetOps"$toAddress = "me@me.com"$emailBody = "See attached VSPC Repository Usage Report for $date"$emailSubject = "VSPC Repository Usage Report for $date"$Credentials = IMPORT-CLIXML -path $a

3164
marcofabbri
3 years ago

Badge winners

Show all badges
Terms & Conditions