Veeam server hardened with Advisor and local hyperV

[jfrobs]

Hello,

I'm having a small problem with Veeam 12.1 hardening with the veeam advisor. Everything is green, great for security.

My Veeam server is a physical server that manages my backups to various repositories.

On this same Hyper-V server, a Veam365 VM is running, saving my M365 tenant in its jet DB.

I'd like to be able to back up this VM to have an immutable backup, so send it to one of my backup repositories with VBR.

Problem: I can't add the local hyperV, which seems to want to connect to the server/admin$ ip.

I think it's probably due to the server hardening done with the Veeam advisor and its good configuration practices.

Do you have any ideas or tips?

I know that the ideal would be not to bother and make S3 storage immutable from Veeam365. But S3 onprem solutions (scality or object first) cost a lot for a small tenant.

Do you have any ideas or tips/advice?

thanks

[Mildur]

Hi jfrobs

Can you please confirm what Veeam advisor is? Our Security & Compliance Analyzer?
https://helpcenter.veeam.com/docs/backu ... ml?ver=120

Have you installed Veeam Backup & Replication directly on the HyperV host? We don't support installing Veeam Backup & Replication directly on the HyperV host.
If so, the problem can most likely be solved by removing VBR from HyperV host and use a dedicated physical machine (or VM) for the backup server. Then reset your hardening on the HyperV host back to the default settings.

https://helpcenter.veeam.com/docs/backu ... ml?ver=120

You must not install Veeam Backup & Replication directly on a Hyper-V host. Such installation may lead to unpredictable system behavior. Instead, install Veeam Backup & Replication and its components on dedicated machines. Backup infrastructure component roles can be co-installed.

As a workaround till you can migrate the backup server to a dedicated machine, consider to reset the changes you made.
It's also possible that you have to disable remote UAC if you use another account than HOST\administrator:

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
DWORD: LocalAccountTokenFilterPolicy
Value: 1

Best,
Fabian

[jfrobs]

Hello, yes its Compliance Analyzer.

VBR is directly on the dedicated physical machine.

you cannot install veam365 on the same physical server as VBR. That's why I installed hyperv on this physical server to run only Veeam365.

but I can't add the hyper-v server, which runs on the same physical server.

Is used an other account, not HOST\administrator

maybe its this....

[jfrobs]

Thanks a lot Fabien.

The registred key work !

All is ok now

[Mildur]

Hi jfrobs

You‘re welcome.
I‘m glad it works now.

Best,
Fabian