Query which backup job is encrypted or not ?

[albertwt]

Hi Folks,

After enabling some backup tasks successfully using: https://helpcenter.veeam.com/docs/backu ... ml?ver=110

I wonder if it is possible or not with Veeam PowerShell to get which backup job is encrypted and which one is not?

Thank you.

[Mildur]

Hi Albert

If you want to know, which jobs have encryption enabled, you can use the following command:

$jobs = Get-VBRJob | select name -ExpandProperty BackupStorageOptions
$jobs | ft name,StorageEncryptionEnabled

Thanks
Fabian

[albertwt]

Hi Team,

I wonder if there is any PowerShell command to show which backup job is encrypted and which one is not?

Either using each of these commands

Code: Select all

Get-VBREncryptionKey 

https://helpcenter.veeam.com/docs/backu ... ml?ver=110

or using the below script to check if the value is $null then there is no backup encryption ?

Code: Select all

$Result = $null
$AllBackupJobs = Get-VBRJob | Where-Object { $_.TypeToString -eq 'VMware Backup' }

ForEach ($BackupJob in $AllBackupJobs)
{
	$Result = [PSCustomObject]@{
		Name			 = $BackupJob.GetJobDisplayName()
		Description	     = $BackupJob.Description
		TargetRepositoryName = ($BackupJob.GetBackupTargetRepository()).Name
        TargetRepositoryPath = ($BackupJob.GetBackupTargetRepository()).Path
		EncryptionStatus = If (($BackupJob.UserCryptoKey -eq $null) -or ($BackupJob.UserCryptoKey.Id -eq $null))
							{
								'Unencrypted'
							}
							Else
							{
								$BackupJob.UserCryptoKey
								$BackupJob.UserCryptoKey.Id
							}
	}
}

$Result

Any help would be greatly appreciated.

Thanks.

[Mildur]

Hi Albert

You asked the same (or similar question) two days ago.
Please see my answer I provided you back then.
I merged both topics together. I see no reason why a new topic for the same question is required.

Thanks
Fabian

[david.domask]

Just want to note @albertwt, your code is a bit...interesting.

Why do you return $Result outside of your Foreach loop?

I think you instead want a function like

Code: Select all

function Get-VBRJobStats {
     param(
          [Veeam.Backup.Core.CBackup]$Backup
     )
     $Result = [PSCustomObject]@{
          Name = $Backup.GetJobDisplayName()        
          Description = $Backup.Description
          TargetRepositoryName = ($Backup.GetBackupTargetRepository()).Name
          TargetRepositoryPath = ($Backup.GetBackupTargetRepository()).Path
          JobSetForEncryption = (Test-Path $Backup.UserCryptoKey)
     }
return $Result
}

You would then run the function over all backups in some array and add the results to some array you can print to a report.

I don't think there's sense in adding text for a job without encryption, you can just use Test-Path to confirm it.

However, I must note a few things:

1. Your script relies heavily on unsupported .NET methods, so every update has a chance to break your script. The .NET methods are not guaranteed and you probably should not rely on them
2. Keep in mind that paths are relative with Scale-Out Backup Repositories (SOBR); I've not tested this particular .NET method but I don't assume you're going to get a proper path from this method for SOBRs
3. Initialize the array or list before the loop, don't just set the variable $Result to $Null

[albertwt]

Hi David,

Thank you for the update.

I wonder how to use your created function as I cannot execute it like below ?

Code: Select all

Get-VBRJob | Get-VBRJobStats
WARNING: This cmdlet is no longer supported for computer backup jobs. Use "Get-VBRComputerBackupJob" instead.
You cannot call a method on a null-valued expression.
At line:6 char:2
+     $Result = [PSCustomObject]@{
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull

and this new cmdlet failed as well:

Code: Select all

Get-VBRComputerBackupJob | Get-VBRJobStats -Backup $_
You cannot call a method on a null-valued expression.
At line:6 char:2
+     $Result = [PSCustomObject]@{
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : InvokeMethodOnNull

[albertwt]

@David,

Thank you for the suggestion, I have now updated the script to get it to work like in the below format:

Code: Select all

Get-VBRJob |
	Where-Object { $_.TypeToString -eq 'VMware Backup' } |
	ForEach-Object {
		[PSCustomObject]@{
			Name					   = $_.GetJobDisplayName()
			Description			       = $_.Description
			TargetRepository		   = ($_.GetBackupTargetRepository()).Name
			TargetRepositorypath	   = ($_.GetBackupTargetRepository()).Path
			EncryptionStatus		   = If ((-not $_.UserCryptoKey) -or (-not $_.UserCryptoKey.Id))
											{
												'Unencrypted'
											} Else {
												$_.UserCryptoKey
												$_.UserCryptoKey.Id
											}
		}
	}

May I know which part of the .NET method is unsupported on the above script so I can learn to adapt accordingly?

[albertwt]

David,
Even after updating the function, it still failed to execute.

[david.domask]

Hi @albertwt,

Well, it was just an example ))

But give me a bit and I will write something that does closer to what you're wanting. Checking your previous code now, in fact a lot of those methods do not exist on backup objects (another reason not to use the .NET Methods They change!)

But your errors are because you're not passing an individual backup object to the function, you're passing an array of backups.

But, please wait, I will compose a short example for you.,

[albertwt]

Sure, thank you @David
I appreciate your help in this matter.

[david.domask]

So here's an example you can use for testing with Virtual Machine Jobs. I strongly recommend you try your hand at a custom one for Get-VBRComputerBackupJob as using Get-VBRJob to return Computer Backup jobs is deprecated and may go away, so you'll need some custom handling, might as well write it now

The function you can use to test it is like:

Code: Select all

	function Get-VBRVMJobInfo {
		 param(
			  [Object]$Job
		 )
		 
		 $Repository = Get-VBRBackupRepository | Where-Object {$_.Id -eq $job.Info.TargetRepositoryId}
		 if(-not $Repository){
			$Repository = Get-VBRBackupRepository -Scaleout | Where-Object {$_.Id -eq $job.Info.TargetRepositoryId}
			$RepoDirectoryPath = "Scale-out Backup Repository"
		 } Else {
			 $RepoDirectoryPath = $Repository.Path.ToString()
		 }
		 $Encrypted = $Job.UserCryptoKey
		 If(-not $Encrypted){
			$Encrypted = $false
		 } Else {$Encrypted = $True}
		 $Result = [PSCustomObject]@{
			  Name = $Job.Name      
			  Description = $Job.Description
			  TargetRepositoryName = $Repository.Name
			  TargetRepositoryPath = $RepoDirectoryPath
			  JobSetForEncryption = $Encrypted
		 }
	return $Result
	}

Note a few things:

1. You need to consider when checking the repository if it is a Scale-out Backup Repository or not. This matters because Get-VBRBackupRepository requires the -Scaleout flag to return those, and they have different properties than a normal backup repository (e.g., there won't be a TargetDir/Path value since Scale-out Repositories are a logical collection of many repositories) For this example, I just set a condition to check if it's on a scaleout repository and you can then write logic to delve deeper into the potential paths.

2. I reworked the check for if Encryption is set as Test-Path didn't work like I expected even when setting its ErrorAction to SilentlyContinue

I think you can use this as a basis for your starting and add/remove properties as you see fit, and from there, work on additional items. You might want to collect all jobs at once into an array to avoid having to call Get-VBRJob a lot (expensive call), and add the Job.Id to the function to allow you to quickly report on jobs you run this on which are of interest for you (e.g., if you want to do further processing on jobs targeting a Scale-out Repository, you can just return all jobs with that value from above and then do further processing)

As for Unsupported .NET methods, anything that you see on the Powershell objects that is listed as a Method when you do $job | gm is not supported. These methods are internal only and they change fairly frequently from update to update, and different job types may not have the same methods, so it's not good to rely on them as you'll be constantly having to fix your script.

Give that a whirl and see how it goes for your VM jobs, and try to make something similar for your ComputerBackupJobs

[david.domask]

Btw @albertwt, I can't help but notice seems you're embarking on a pretty big Powershell project to do what Veeam One already does for you

https://helpcenter.veeam.com/docs/one/r ... on&ver=110

As I get it, you can pick and choose which Properties to include in these reports; maybe this suits you better than trying to write a tool from scratch?

[albertwt]

Hi @david.domask,

As my current company licensing I manage does not have VeeamONE, hence I was not aware that VeeamONE can do that for me , I will give it a try.

Thank you for the suggestion.

[david.domask]

Sure, happy to give the hint. We will help of course with Powershell, it's just I see that it looks like you've been given a pretty massive Powershell project, and it might be a better investment of time/$$$ to just get Veeam One for your company.

[albertwt]

Hi @david.domask.

I've finally made some updates on the script like the one below, would you be able to verify if the result is correct?

Code: Select all

Get-VBRJob |
    Where-Object { $_.TypeToString -eq 'VMware Backup' } |
    ForEach-Object {
        [PSCustomObject]@{
            Name                 = $_.GetJobDisplayName()
            Description          = $_.Description
            TargetRepository     = ($_.GetBackupTargetRepository()).Name
            TargetRepositorypath = ($_.GetBackupTargetRepository()).Path
            EncryptionStatus     = If ((-not $_.UserCryptoKey) -or (-not $_.UserCryptoKey.Id)) {
                                        'Unencrypted'
                                    }
                                    Else {
                                        $_.UserCryptoKey
                                        $_.UserCryptoKey.Id
                                    }
        }
    }

I hope this can be a helpful resource for anyone seeking backup encryption status.

[david.domask]

Hi!

Well, if it works for you it works for you

But again, I want to stress that the unsupported .net methods (GetBackupTargetRepository()) may not be wise to build around.

[albertwt]

@david.domask,
Sure, thank you for the suggestion

Because When I try to execute and use your Function, it does not work, like in the below screenshot:

[albertwt]

Code: Select all

Get-VBRJob | Where-Object { $_.TypeToString -eq 'VMware Backup' } | Get-VBRVMJobInfo

WARNING: This cmdlet is no longer supported for computer backup jobs. Use "Get-VBRComputerBackupJob" instead.

Name                 : 
Description          : 
TargetRepositoryName : 
TargetRepositoryPath : Scale-out Backup Repository
JobSetForEncryption  : False

and the same result with the suggested PowerShell cmdlet: Get-VBRComputerBackupJob

Code: Select all

Get-VBRComputerBackupJob | Where-Object { $_.TypeToString -eq 'VMware Backup' } | Get-VBRVMJobInfo

Name                 : 
Description          : 
TargetRepositoryName : 
TargetRepositoryPath : Scale-out Backup Repository
JobSetForEncryption  : False

[david.domask]

@albertwt, can I ask, why are you using _TypeToString?

Also, please remember I mentioned that one is for VM jobs It was just an example for you, and I suggested try writing your own for Agent jobs

[albertwt]

@david.domask,

When I use the { $_.Type -eq 'VMware Backup' } clause to filter, it does not return anything.

Code: Select all

PS C:\WINDOWS\system32> Get-VBRJob | Where-Object { $_.Type -eq 'VMware Backup' } 
WARNING: This cmdlet is no longer supported for computer backup jobs. Use "Get-VBRComputerBackupJob" instead.

however, when I am using the { $_.TypeToString -eq 'VMware Backup' }, the code works and returns the VMware backup job.

Code: Select all

Get-VBRJob | Where-Object { $_.TypeToString -eq 'VMware Backup' } 

Is there anything that I need to know or this attribute will be deprecated soon?

[david.domask]

Got it, I've not used the TypeToString property before as it looks like it's just a human-readable conversion of the JobType property. Type failed with VMWare Backup because JobType doesn't have VMware Backup, it's just Backup.

I don't think it will be deprecated, but I'm not sure how active that is...but mostly I think it should be working