Move Veeam Backup for Microsoft 365 to another OS/VM (fresh install, same remote db)?

[t7MevELx0]

Hi,

What’s the recommended process for reinstalling Veeam Backup for Microsoft 365 on a new OS or VM? We’re considering this as a troubleshooting step to rule out any underlying OS issues, assuming it’s safe to do so.

Here’s what I’m thinking:

Build a new VM using the same hostname and IP address

Install Veeam Backup for Microsoft 365 and point it to the existing PostgreSQL database and NATS server (both hosted on a separate Ubuntu 24.04 LTS VM)

Delete the NATS streams folder before starting the services

I know Veeam support often suggests uninstalling and reinstalling the software since there’s no repair option. I wanted to check if you’ve had success moving the installation to a fresh Windows environment like this.

Thanks!

[t7MevELx0]

Is Veeam Backup for Microsoft 365 tied to a local certificate for decrypting stored secrets?

I installed VB365 on a new Windows Server 2022 VM and pointed it to the existing PostgreSQL database. The service will not start, and Veeam.Archiver.Service.log shows:

Code: Select all

Database initialization was started
Warning: Failed to decrypt data
Warning: The system cannot find the path specified
Error: LogFailedServiceInitialize
Error: Failed to decrypt data
Type: System.Exception

Veeam Support previously told me this move-and-reconnect process would work without extra steps, but the error suggests the new server cannot decrypt something in the database.

We are an MSP and cannot re-enter every client credential. How can I bring the service up on the new host with all secrets intact?

Thanks!

[Mildur]

Hello t7MevELx0

The migration workflow you are trying is not supported. By this time, workflow documented in our KB2649 must be followed:
https://www.veeam.com/kb2649

We are aware that configuration backup and restore is a highly requested feature, and its on our roadmap. But no ETA we can provide today.

All of our products encrypt credential/encryption keys in the database with a private key specific to the source backup server (encrypted using the Microsoft Data Protection API mechanism). As a result, no other machine can decrypt the data simply by connecting to the existing database.

Veeam Support previously told me this move-and-reconnect process would work without extra steps, but the error suggests the new server cannot decrypt something in the database.

May I ask for the case number?

Best,
Fabian

[t7MevELx0]

Hi @Mildur ,

Case #07683140

This problem has become a standing P1. One of our VBO servers keeps hanging (actually two, but our most critical one uses API's for self-registration): we must delete the NATS streams directory and restart every proxy and service to restore operations. On top of that, the /Explore API for Exchange restores is failing.

If we cannot repair or move the application to a fresh OS, the software cannot be considered enterprise grade. It safeguards hundreds of paying organizations, yet it cannot backup its own configuration. Veeam writes backup software; the platform must be able to protect itself. This is critical, and I hope the team treats it with the urgency it deserves.

We therefore need a clear, supported procedure to backup the configuration and migrate the deployment to new hardware or a fresh OS, that doesn't require customer interaction.

Thanks

[t7MevELx0]

@Mildur
I opened another ticket (Case #07685363) because the support engineer says a swing migration should work. They are currently helping me troubleshoot the failure. Are you certain the support team understands the product’s limitations?

[Mildur]

Hi t7MevELx0

Thank you for the new case number.
I have reached out to support management to clarify the answer you got in the support case.

Best,
Fabian

[t7MevELx0]

Hi @Mildur ,

I’m considering an in-place upgrade from Windows Server 2019 to 2022 using the “Keep personal files only” option. This should give me a clean OS while preserving the DPAPI machine keys. After the upgrade, I plan to reinstall .NET, PowerShell, and Veeam Backup for Microsoft 365, then point the installation to the existing PostgreSQL database. I’ll schedule a maintenance window and take snapshots before I start.

Have you used this approach?

Thanks!

[t7MevELx0]

Well, I gave it a shot and the in-place upgrade does work, but it didn't resolve anything. I think the in-place upgrade carried over the issue.

Without a configuration backup it seems the options are limited. I'm still waiting for RnD to get back to all of my support cases.

So my remaining options are; uninstall VBO and reinstall to see if this does anything, wait for RnD (could be months), or setup a brand new environment and call hundreds of clients and tell them we need to reconfigure them on a new server....

[Mildur]

Hi t7MevELx0,

I received feedback from support management regarding the statement about exporting/importing the certificates. The statement in Case 07685363 should have been updated by the case engineer.

We have never tested in-place upgrades, but from my experience, they work "most of the time." However, I would still recommend deploying a new machine instead of performing in-place upgrades on Windows machines.

Nevertheless, I understand the challenges faced with Veeam Backup for Microsoft 365 and new machines. I already have forwarded your case to our core PM team for Veeam Backup for Microsoft 365 as another vote for configuration backup/restore, but we won't have such a feature available in a reasonable timeframe to resolve your issues.
Therefore, I want to review and potentially escalate the case you mentioned to QA.

I'm still waiting for RnD to get back to all of my support cases.

Could you please share the case number which was the reason for the new deployment approach?
If you can provide it, I can review it and ask our RnD teams to take a closer look.

Best,
Fabian

[karsten123]

thats so embarrassing. please get your stuff right. asap!

[t7MevELx0]

@Mildur

Yes, I will share my case numbers here.

Case #07674412 - All jobs are hanging / freezing, requiring us to delete the NATS streaming dir and restart all services
Case #07681900 - API/Rest failures; the API for restores isn't working

These cases are open for the one environment, and are our most critical issues as this environment has self-registration that is powered by the API.

I have another environment that hasn't had working copy jobs since January (Case #07583409).


Thanks

@karsten123 Yes, I agree, and extremely stressful. I've been resuscitating services for 3+ weeks now. We can't be the only ones with these issues.

[karsten123]

@Veeam. can we please have a official c-level comment on this. thanks!

[Mildur]

Hi t7MevELx0,

Case #07674412 - All jobs are hanging / freezing, requiring us to delete the NATS streaming dir and restart all services

An RnD escalation was opened last week. I'll keep an eye on the internal RnD case.

Case #07681900 - API/Rest failures; the API for restores isn't working

This case was escalated to RnD last Wednesday, and our QA team is actively working on it.

Case #07583409 - Environment that hasn't had working copy job

I checked our RnD system, and it appears there was a private fix for your case.
However, it seems to have addressed a different issue rather than the copy jobs issue, correct?
Nonetheless, I have requested an update from our support team.

Best,
Fabian

[t7MevELx0]

Hi @Mildur ,

Yes, that private fix was related to immutable repositories being marked as invalid.

I've uploaded a fresh log bundle to case #07674412. I still have to delete the NATS streaming directory and restart services every night on nearly all 365 environments.

If I don't get some kind of resolution from RnD soon, I'll need to deploy Ansible and create a resurrection workflow. This software is requiring a lot of hand-holding right now.

Thanks

[Mildur]

Hi t7MevELx0

I checked the latest status of each case.

07674412 - Latest Logs from last week are with QA right now.

07681900 - QA is currently waiting for log files forwarded from the support case. I will start an escalation with support management to keep me updated and to raise awareness of the case.

07583409 -A follow-up case was created. You were provided with a hotfix and additional configuration for the proxy.xml file. I’ve asked support management to provide you with the PowerShell command (Set-VBOConfigurationParameter) so you can quickly update the proxy.xml file on multiple proxy servers. If our cmdlet works for your scenario, it should allow you to reconfigure all your proxies efficiently.

Best,
Fabian