Veem B&R in a resource domain

[hbilke]

Ave collegae,

during an online session a setup within a "resource domain" was mentioned. I'd plan a setup with Exchange and VEEAM in such a construction.
Anything to be especially aware of?

I'd even think of a VM for administration that is shut down when not needed / used.

Salvete
Harry

[Mildur]

Hi Harry

I assume you are talking about veeam in a resource forest? How big is your environment you want to backup? How many administrators will need to have access to the veeam server? If there are only a few veeam administrators, I don‘t see any advantage to have a resource forest to deploy veeam. Do you want to deploy the Veeam Enterprise Manager for Exchange Item Level restores?
I would‘t shutdown the veeam vm. There could background tasks which needs to be running. Are you putting this vm on your main hypervisor? Then it can be taken over. There is always a way. Resetting local administrator password and you have access to the entire backup server. Better would be to have a dedicated hardware for the backup system.


For a veeam resource forest:
- You must make sure, that all necessary ports can be reached from the veeam forest to your productive forest, if you put a firewall between the two forests.

- If you use an ad trust between the veeam forest and the production forest, configure it only as a one-way trust, to keep veeam more secure.

Veeam in a resource forest behaves not differently as non ad joined or domain joined in the productive environment.

[hbilke]

Hi Mildur,

it will be in a certain "weird" environment I can't describe in more detail. As far as I know "Exchange Single Item Restore" should be possible. Therefore putting Veeam and Exchange into the res-dom.
There will be a separate hypervisor and storage.
I didn't think of shutting down the veeam manager but utilizing sort of a jump host that won't be running all the time.

GreetNx
Harry

[Mildur]

I would install the vbr server on a non joined machine.
Restoring exchange items from the vbr server can be done without having the vbr Server in the domain.

Only the enterprise manager must be in the domain for restoring exchange items, if you choose to have one for the restores.

Why not using the hypervisor directly as an veeam backup server with locally attached disks? There is no need to have a hypervisor installed for the veeam installation.
For the second backup copy, use a sobr with immutable object storage or airgapped backup storage like tape or usb disks.