Skip to main content
  • EN

YARA and Script Library

Download featured YARA rules, browse code samples or contribute your own scripts

  • 178 Topics
  • 986 Comments
178 Topics
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Powershell - VBO Audit Item Configurator

Another week, another script Today I’m sharing a Powershell script to configure the audited items (user) and set the audit notification settings. More details about the enhanced audit item functionality can be found here:https://www.veeam.com/blog/next-gen-office-365-backup-security-auditing-and-reporting.htmlThe read me and the code can be found on github:https://github.com/yetanothermightytool/powershell/tree/master/vbo/vbo-auditcfg 

2564
SteveHeart
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Powershell - VBO OneDrive for Business File Restore Checker

Another check script for OneDrive for Business data, protected by VBO. The script downloads a specific file and compares the hash value with the value specified by the user. Feedback welcome!Download Linkhttps://github.com/yetanothermightytool/powershell/tree/master/vbo/vbo-odrestore-checker Outlook upcoming scriptsI have a script ready that uploads the detected file hashes/the files to a cloud-based detection and prevention solution and returns the result of the scan. 

1525
I
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Powershell - VBO Exchange Mailbox Item Restore Content Checker

During my presentations on VBO to customers and partners, people sometimes ask whether the recoverability of data can be checked automatically (Our Veeam Backup & Replication customers love SureBackup). However, this functionality is not available.Since I have now been told this "wish" several times, I thought "New Year, New Luck!"First, I share the Powershell script to check backed up Exchange Online restore data. With this script it is possible to save an email from a mailbox to a local directory and check if a certain pattern can be read.More functions will be added soon. Please give me feedback what can be improved or added.A script for checking OneDrive for Business data will also be available soon. The script can be found here:https://github.com/yetanothermightytool/powershell/tree/master/vbo/vbo-exrestore-checker And don't forget: Always post feature requests in our R&D forum!

2664
regnor
SteveHeart
SteveHeartInfluencer
posted in YARA and Script Library
Powershell - Exclude Teams object(s) from VBO Backup Job

Last year Veeam Backup for Microsoft Office 365 v5 added purpose-built backup and recovery for Microsoft Teams. Since then many customer and partners asked me "How can we protect all of our teams and exclude specific teams objects based on names automatically?".As there is no filter logic within the UI for the Backup Job object exclusion list, I solved this "problem" using the script down below. First we store the credentials (encrypted) in a txt file:$credential = Get-Credential$credential.Password | ConvertFrom-SecureString | Set-Content <path to secure.txt>And here's the script. Just change the values for the following variables: $organizationname Name of the tenant - Only needed if more than one is configured$backupjob            Name of existing the Backup Job$filter                    Name of the team that needs to be excluded. Regular expressions can be used$userName            Username for retrieving the existing Teams in M365$passwordText       Path to the secure.txt fil

9417
SteveHeart
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Identifying Cloud Connect Orphaned Backups

Here’s a sample PowerShell script to identify Cloud Connect backups that are no longer tied to an active Backup Job. It also includes functionality to only show restore points older than XX days.Further background info on this script... When a Copy Job (or Backup Job) is deleted that was sending its backups to a (Cloud Connect) Cloud Repository, the backup files are not deleted by default. This behavior is great as it enables a backup administrator to hold on to the backups according to their company's retention policy. Sometimes, though, these backups are forgotten which results in additional storage consumed in the Cloud Repository which translates to higher storage costs. This script provides an automated method of identifying these backups so they aren't forgotten.NOTE: This script is designed to be executed on a Veeam Backup & Replication server that sends backups to a Cloud Repository. It will not work if executed on a Cloud Connect server.For more detailed information, pleas

6103
Chris.Arceneaux
7
7Ryan7Not a newbie anymore
asked in YARA and Script Library
Automatically remove machines from Job

Hey All,I’ve tried to get some automation for the backup of my Citrix base images.  I have a script that adds a machine to the backup job based on the name.  Of course, these machines get created and deleted like flies, and I was wanting to automatically remove them if they’ve been removed from vCenter.  I guess I could use tags, but then I’d have to rely on my Citrix admin to use the tags, and if it’s forgotten then there’s no backup, so I’ve decided a script is the way to go. So adding machines to the jobs works wonderfully, but I can’t seem to nail the way to remove the machines that aren’t in vCenter inventory. I also have the auto delete from backups turned on to prune the base images after x days.   Here’s the snippet of powershell causing issues:#Searches the backup job to find any VM that don't have a size associated with the VM and assigns it to the variable  ie. VM is still in the job but the VM is deleted.$NullVM = Get-VBRJobObject -job $Citrixbackupjob | Where-Object -Prope

3887
D
Markus.K1985
Markus.K1985Comes here often
posted in YARA and Script Library
[PowerShell] Get All Backup Repositories Advanced

[Array]$RepoList = Get-VBRBackupRepository | Where-Object {$_.Type -ne "SanSnapshotOnly"} [Array]$ScaleOuts = Get-VBRBackupRepository -ScaleOutif ($ScaleOuts) { foreach ($ScaleOut in $ScaleOuts) { $Extents = Get-VBRRepositoryExtent -Repository $ScaleOut foreach ($Extent in $Extents) { $RepoList = $RepoList + $Extent.repository } }}$RepoList | Select-Object Name, Path, `@{Name="CachedTotalSpaceGB"; Expression= {[Math]::Round([Decimal]$_.info.CachedTotalSpace/1GB,2)}}, `@{Name="CachedFreeSpaceGB"; Expression= {[Math]::Round([Decimal]$_.info.CachedFreeSpace/1GB,2)}} | Format-Table -AutoSize 

163310
D
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Veeam Collection for Ansible: v11 support

Support for Veeam Availability Suite v11 (VBR/EM/ONE) is now available in the Veeam Collection for Ansible! Here’s a blog post outlining changes made and improvements: https://www.arsano.ninja/2021/03/03/veeam-ansible-collection-v11/ For those not familiar with this Ansible collection, please see this blog post for an introduction.

6755
Chris.Arceneaux
k00laidIT
k00laidITVeeam Vanguard
posted in YARA and Script Library
Restart-VSS.ps1 Script

One thing I’ve found as a Veeam customer is you often have to restart the VSS services on your SQL and other VSS aware servers. Here’s a script I wrote to do just that.# Name: Restart-VSS.ps1# Description: Restarts list of services in an array on VMs with a given vSphere tag. Helpful for Veeam B&R processing# For more info on Veeam VSS services that may cause failure see https://www.veeam.com/kb2041Import-Module VMware.PowerCLI$vcenter = "vcenter.domain.com"$services = @("SQLWriter","VSS")$tag = "myAwesomeTag"Connect-VIServer $vcenter$vms = Get-VM |where {$_.Tag -ne $tag}ForEach ($vm in $vms){ ForEach ($service in $services){ If (Get-Service -ComputerName $vm -Name $service -ErrorAction SilentlyContinue) { Write-Host $service "on computer" $vm "restarting now." Restart-Service -InputObject $(Get-Service -Computer $vm -Name $service); } }} 

19909
k00laidIT
bp4JC
bp4JCInfluencer
posted in YARA and Script Library
Validator Script

Hi, all I made a simple script that will allow you to run the backup validator and receive a report.  echocd C:\Program Files\Veeam\Backup and Replication\BackupVeeam.Backup.Validator.exe /backup:"BackupName" /report:"C:\VeeamReports"rem May have to specify name(s) of VMs being backed up in jobrem If there are multiple backup jobs, you must create a new line for each job --> Veeam.Backup.Validator.exe /backup:"BackupName" /report:"C:\VeeamReports"

4653
bp4JC
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Automated Upgrade to Veeam Backup & Replication v11

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v11 is now available on VeeamHub! Here’s a blog post with more detailed information: https://www.arsano.ninja/2021/03/09/veeam-unattended-upgrade-v11/ If you're a VCSP, the script can also be used for Cloud Connect environment upgrades.

9257
marcofabbri
k00laidIT
k00laidITVeeam Vanguard
posted in YARA and Script Library
VSPC API v3 Storage Report

<#.Synopsis Generates report of all repositories known to a given Veeam Service Provider Console Server. Uses the new v3 API so your milage may vary..Notes Version: 1.0 Author: Jim Jones Modified Date: 8/21/2020 If running for the first time a new computer You will need to run to store the credentials $credpath='c:\creds\myadmincred.xml' GET-CREDENTIAL –Credential (Get-Credential) | EXPORT-CLIXML $credpath.EXAMPLE .\VACStorageReport.ps1 -vacServer 'vac.mydomain.com' -authPath 'c:\creds\myadmincred.xml'#>[CmdletBinding()]Param ( [string]$vacserver = "vac.mydomain.com", [string]$authpath = "c:\creds\myadmincred.xml")#Email Variables$date = Get-Date$sgToken = "SendGridToken"$fromAddress = "myvac@mydomain.com"$fromName = "US VAC"$toName = "NetOps"$toAddress = "me@me.com"$emailBody = "See attached VSPC Repository Usage Report for $date"$emailSubject = "VSPC Repository Usage Report for $date"$Credentials = IMPORT-CLIXML -path $a

3444
marcofabbri
CptAmerica
CptAmericaComes here often
posted in YARA and Script Library
Restore Most Recent SQL Database From Backup Job

Not too long ago I had a customer who only had a Standard license which meant he didn’t have access to SureBackup, but had a need to validate a highly critical SQL database’s backups on a near daily basis. I figured it wouldn’t be too hard to write up a PS script that’d take some basic information about the source job name and database and where it needed to be restored and quickly sort by most recent and selecting it and kicking off the restore. That way he could just fire up the script when necessary. He ended up setting up a scheduled task where each day his DBAs would have the previous day’s backup restored next to the production database and they could do whatever verifications they needed. Easy peasy!Note: Tested and working in v10 & v11 (Should work just fine in v9.x as well, but not tested)<### Un-comment to enable debug output when troubleshooting script ###>#$DebugPreference = "Continue"<### Included for backward compatibility for servers still running pre-v10. #

8818
marcofabbri
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Enforce Backup Job Basic Retention

Here’s a sample PowerShell script to enforce Restore Point configuration for both VMware Backup Jobs & vCloud Backup Jobs. The script retrieves the job’s current retention setting (Restore Points), compares it against the standard defined in a CSV file, and adjusts the configuration where needed. For more detailed information, please follow the VeeamHub link:https://github.com/VeeamHub/powershell/tree/master/BR-EnforceJobRetention

2667
marcofabbri
T
txmlawrenceNew Here
asked in YARA and Script Library
Veeam CLI command to globally enable encrytion

I’ve been searching and trying different commands to set the flag to “enable backup file encryption” within the VBR “Configuration Backup Settings”.While I can see how to create the password with the API with the Add-VRBEncryptionKey shown below, I don’t see a command to set the flag above. Any help would be greatly appreciated...

1283
marcofabbri
A
AnucNot a newbie anymore
asked in YARA and Script Library
How to get a restore job id for the VM using PowerShell command?

 We are not getting restore job Id while running the below PowerShell command in Veeam 11, but for versions below 11, we are getting the restore job id.I checked the Veeam11 commands document but couldn’t find anything helpful regarding VM restore job id.Let us know if there is any particular command to fetch the job id. Running command using Veeam11:$latest_backup_copy = Get-VBRBackup -Name 'backup_job_0'| Get-VBRRestorePoint -Name 'oracle_smallest' | Sort-Object -Property CreationTime -Descending | Select -First 1 ;;  Start-VBRRestoreVM -RestorePoint    $latest_backup_copy -ToOriginalLocation             -StoragePolicyAction Default -PowerUp:$True             -RunAsync Restore Type       VM Name              State      Start Time             End Time               Description------------       -------              -----      ----------             --------               -----------RestoreVm          oracle_smallest      Starting   5/28/2021 12:17:24 PM  1/1/1900 12:00:00 AM  Running

2874
JMeixner
jorge.delacruz
jorge.delacruzCommunity Manager
posted in YARA and Script Library
[Bash Shell Script] How to Secure your Veeam Backup for AWS v2 instance with a Let’s Encrypt SSL certificate

Hello everyone, today I bring you one more step on how to correctly secure our instance of Veeam Backup for AWS v2.To do this we will rely on Let’s Encrypt, the famous open-source project that allows us to generate free SSL certificates.NOTE: This process is not officially supported by Veeam, and any consequence of following the steps incorrectly, or any incidence derived from these steps will leave us without support. We will have to deploy the appliance again, keep that in mind!Where shall I run this Script?My recommendation will be to run it from a Linux VM, Container, or similar that you have already on your on-prem, or in the Cloud. As a last alternative, not supported of course, is to follow these steps inside the Veeam Backup for AWS appliance itself.Installation of system requirementsTo make it all work we’re going to need a couple of packages to do all this automatically:jq The necessary Let’s Encrypt packagesTo install jq, we will launch the following command:sudo apt-get ins

4051
Shaokat
CptAmerica
CptAmericaComes here often
posted in YARA and Script Library
Restore Same Folder/Files From Multiple Backups

First time sharing, so feedback is much appreciated, but please excuse my code if it’s not up to par with those who have a lot more experience with Powershell than I. I recently had a client who -- for legal purposes -- needed to restore the same folder from two month’s worth of backups. Running 61 File Level Restores in the GUI seemed like a nightmare, so he opened a case asking if there was an easier way. Unfortunately, through the GUI there’s really not an easier way, but this sounded like a perfect scenario for leveraging some Veeam PowerShell cmdlets. I soon discovered that the FLR cmdlets don’t have functionality that supports a ‘Copy To’ feature like you’d get in the GUI, so I had to leverage what Veeam cmdlets we do have and then add in some good old basic PowerShell commands to then pull the data from the mount point (C:\VeeamFLR\ by default) and move it to the target, then loop through n-number of times based on the user input.Here’s what I came up with. I’m still working on

2492
CptAmerica
Chris.Childerhose
Chris.ChilderhoseVeeam Legend, Veeam Vanguard
posted in YARA and Script Library
Veeam Service Providers - Check Ransomguard

This is a simple oneliner for the MSPs out there if you are needing to check if Ransomguard is enabled for your VCC tenants this will output it on the screen for you from Powershell - Get-VBRCloudTenant  | sort-object | FT Name, BackupProtectionEnabled, BackupProtectionPeriod You can also output this to a file that could be emailed as well.

2334
Chris.Childerhose
jdw
jdwComes here often
posted in YARA and Script Library
Enable Snapshot-Only Jobs for Secondary Storage Array for Pure Storage FlashArray with This Post-Job Script

VBR integration for storage systems supports several useful features that optimize backup performance. Unfortunately for those systems built on the Universal Storage API (USAPI) some of those features are not yet available. One specific feature that is missing is the ability to orchestrate array-based snapshots on a secondary storage array.I’ve written a PowerShell script to be used as a post-job VBR script along with snapshot-only jobs for Pure Storage FlashArray which will replicate Veeam created array snapshots to a secondary FlashArray. It will also ensure that those snapshots are visible in the VBR console and available for recovery tasks including Instant VM recovery, Guest Files recovery, and Application Item Recovery. Download Invoke-PfaSendSnapAfterVBRJob.ps1 from GitHub. Detailed setup instructions. This script has been designed to work both with VBR v10 VeeamPSSnapIn as well as the brand new VBR v11 PowerShell Toolkit.  

1841
JMeixner
StefanZi
StefanZiComes here often
posted in YARA and Script Library
Create least privilege VBO Azure AD applications without using VBO

Here’s a script I wrote to create Azure AD applications for VBO usage aside from creating the app from within VBO itself.I experienced that this is not always easy to do (Global Admin using VBO to create an app, or having the Global Admin read the documentation and create the application with the right permissions, etc… on his own), so I hope my script can help here. Check out my blog article on it at VBO365: Create Azure AD applications automatically with least priviliges – Z8NAnd the script itself is available on Github: veeam/vbo-create-azure-ad-app.ps1 at master · StefanZi/veeam (github.com)

1564
gulzarshaikhveeam
P
ProfessorMsibiNew Here
posted in YARA and Script Library
What am I missing here? I'm getting this error

Backup job: mwc-appsvr-midtier_2020-11-17T095355 (Full) Error 1 of 1 VMs processed 17 November 2020 09:53:55 AM Success 0 Start time 09:53:55 AM Total size 0 B Backup size 0 B Processing mwc-appsvr-midtier Error: Access is denied. Could not perform threshold check for backup location "\\10.0.0.12\Backup\VirtualMachines\Autobackups" due to space info retrievement fail! Warning 0 End time 09:54:35 AM Data read 0 B Dedupe 1.0x Error 1 Duration 0:00:39 Transferred 0 B Compression 1.0x Details Name

3072
vNote42
k00laidIT
k00laidITVeeam Vanguard
posted in YARA and Script Library
VeeamHub?

Not to be a negative nelly, but don’t we already have github.com/veeamhub as a repository that is purpose built for this type of content, managed by people who know code? Can we not push community script additions there rather than turning them into effectively forum posts?

5444
ratkinsonuk
MicoolPaul
MicoolPaul
asked in YARA and Script Library
Improvement Idea: SureBackup & Pre/Post Repositories

Hey, Don’t know about you guys but I feel Veeam are missing what could be a very successful trick here with their SureBackup and Pre/Post Processing script functionalities. I know we have VeeamHub for some PowerShell scripts but I think to really push the value of Veeam integrating into our customers’ enterprise application stacks it would be great to have a more direct interface of getting scripts into Veeam. I’ve seen plenty of systems integrating “stores” or other web fronts to enable simple access. It’d be great to see ways of integrating with systems that have been seen as “traditionally” unfriendly to snapshoting and also to validate more complex workloads.I’m sure there are plenty of great scripts out there that just aren’t being shared due to lack of visibility of the existing platforms but driving it into the client would really improve feature take up. That’s my opinion anyway, how do you all feel about this? Wouldn’t you like vendors to be able to offer a one click “it just

4206
BertrandFR
Markus.K1985
Markus.K1985Comes here often
posted in YARA and Script Library
[PowerShell] vSphere Tag and vSphere SPBM Examples with Veeam Backup & Replication

#region: Add Veeam PSSnapin and ConnectAdd-PSSnapin VeeamPSSnapin$VeeamCred = Get-Credential -Message "Veeam Credential"Connect-VBRServer -Server "192.168.3.100" -Credential $VeeamCredFind-VBRViEntity#endregion#region: VMware Module and vCenter ConnectionGet-Module -ListAvailable -Name VMware* | Import-ModuleSet-PowerCLIConfiguration -DefaultVIServerMode Single -InvalidCertificateAction Ignore -Scope Session -Confirm:$false$vCenterCred = Get-Credential -Message "vCenter Credential"Connect-VIServer -Server "192.168.3.101" -Credential $vCenterCred#endregion#region: List Objects in Backup Jobs$VBRJobs = (Get-VBRJob).where({$_.JobType -eq "Backup" -and $_.Name -like "*Location*"})## List Backup Jobs that match the filter$VBRJobs | Select Name, JobType, SourceType | ft$VBRJobToLocationA = Get-VBRJob -Name "Backup to LocationA"## list Objects in Job$VBRJobToLocationA.GetObjectsInJob().GetObject() | Select ViType, Name, ObjectId | ft#endregion#region: Get Veeam Tag Details## Veeam Inventory(F

7580
Markus.K1985

Badge winners

Show all badges
Terms & Conditions