Can't disable Encrypt of Configuration Backup

[Maurice]

Hi all,

i got a small Problem with a Customers B&R Configuration.
They tested a Encryption on a Test Backup and now decided they dont want to use it.
Now i got a Problem disabling Configuration Backup Encryption.
When i disable the encryption it says "Configuration backup encryption must be enabled because product configuration contains encryption keys.".
The problem is: The key which is inside the Password Manager is the key that the Configuration Backup itself uses.
So i can't disable the Configuration Backup because of that error message and i can't delete the key because it is used by a Job (the Configuration Backup).

How can i disable the encryption of the Configuration backup now?

Thanks for any solutions.

[veremin]

I'm wondering whether the backup console still contains encrypted backups or jobs using encryption. Thanks.

[Maurice]

There are no other Jobs using encryption.
When i try to delete the Password in the Password Manager it shows me the dependent jobs and the only one showing is the configuration backup.
I deleted also the corresponding backups (restore points).

[foggy]

Maurice, just talked to QA, they are aware of this issue, so it should be addressed further down the road. Thanks.

[Maurice]

Thank you for the info. I hope it will soon be fixed. Till then the customer will create an easy Password for the Config-Backup.

[BarryPhillips]

Has there been any update to this issue ? I find myself in the same scenario, We have one password associated to the Configuration Backup job only (we were testing), but now I cannot remove it or turn off encryption on the configuration backup job

[foggy]

Hi Barry, this hasn't been addressed so far.

[sfbi]

Hello,
I've added one "Ecryption Password" and then configured for "Configuration Backup".
Now I need to delete this password and disable "Encryption configuration backup".
When I try to "Remove" the Encryption Password Veeam reply: "Unable to delete selected password ..in use.."
When I try to remove the flag "Encryption configuration backup" into "Configuration Backup Settings" Veeam reply: "Configuration backup encryption must be enabled becouse product configuration contains encryption keys".

It's a loop!

Support reply me:

This behavior is by design. Veeam requires that you encrypt the configuration backup if you have created at least one password in the Password Manager on the backup server (https://helpcenter.veeam.com/docs/backu ... tml?ver=95).

Code: Select all

Veeam Backup & Replication requires that you encrypt the configuration backup if you have created at least one password in the Password Manager on the backup server"

It's right, but it is not specified that I can not delete and disable this feature...

I still do not understand why I can't:
- disable "Configuration Backup"
- delete "Ecryption Password" (It is no longer used anywhere!)
- enable "Configuration Backup"
Done.

Any idea?

Regards
Sim

[foggy]

Hi Sim, this should be fixed in v10.

[lightsout]

All,

It seems playing about has got me into trouble. I enabled encrypted backups which forced me to create an encrypted backup password. The issue is I can't turn it off!

If I try to turn off encrypted backups, it says I have an encryption key so I can't. If I try to remove the encryption key, it says I can't as it is use by the configuration backup job.

How can I escape this trap!

Thanks!

[sasilik]

Why not fix it in some 9.5 updates? I also fell in this trap and can't get rid of encryption password and encryption of configuration backup job. Kind of frustrating.

[foggy]

Markko, this is still planned to be fixed in one of the next updates. Thanks.

[alphabet5]

Is there a timeline for this issue being fixed? Is there a workaround in the meantime?

[foggy]

Hi John, this is addressed in the upcoming U4. Thanks!

[mallikarjunac]

Hi All,
Any updates on this issue. I too facing same issue in Veeam 11.
Is there a way to disable Encryption in Configuration Backup or remove Configuration Backup settings by powershell cmd-lets.?

[Mildur]

Hi Mallikarjuna

Do you use encryption in any backup job or backup repo? Or have encrypted backups registered in the console?

I can disable the encryption of the configuration backup, when the encryption key is only used for the configuration backup, but not a server where encryption keys are used for actual jobs or repositories.

Thanks
Fabian

[mallikarjunac]

Hi Fabien,

We use two encryption keys, one for BackupJobs and another one for Configuration Backup. Can you please provide us the cmd-lets to disable encryption of the configuration backup.

Thanks,
Mallikarjuna

[Egor Yakovlev]

Check out Set-VBRConfigurationBackupJob cmdlet.

Please note that having encryption enabled on Configuration Backup is a recommended best practice.

/Thanks!

[mallikarjunac]

Hi Egor,

I tried "Set-VBRConfigurationBackupJob -EnableEncryption:$false", but no luck. it thrown below error.

"Set-VBRConfigurationBackupJob : Configuration backup encryption must be enabled because product configuration contains encryption keys."

Do we need to pass any other additional arguments?

Thanks,
Mallikarjuna

[Egor Yakovlev]

That error is expected when your configuration database contains security data that otherwise cannot be restored(without being included in the encrypted configuration backup). Such security data can be encryption keys, thumbprints, password hashes just to name a few.

When you enable configuration backup without encryption we can ignore some security principals, like added credentials, and just skip passwords from processing. There is a warning for you, and when you are restoring from such configuration backup you will have to re-type passwords for all used credentials as they are not backed up without encryption. However, some things like a password hash cannot be re-entered as easy, thus leading us to enforce encryption when database already contains such data. We cannot allow non-encrypted configuration backup, because it is like storing your passwords on desktop in Passwords.txt format.

/Hope that helps!