Move Veeam Backup for Microsoft 365 to another OS/VM (fresh install, same remote db)?

[t7MevELx0]

Hi,

What’s the recommended process for reinstalling Veeam Backup for Microsoft 365 on a new OS or VM? We’re considering this as a troubleshooting step to rule out any underlying OS issues, assuming it’s safe to do so.

Here’s what I’m thinking:

Build a new VM using the same hostname and IP address

Install Veeam Backup for Microsoft 365 and point it to the existing PostgreSQL database and NATS server (both hosted on a separate Ubuntu 24.04 LTS VM)

Delete the NATS streams folder before starting the services

I know Veeam support often suggests uninstalling and reinstalling the software since there’s no repair option. I wanted to check if you’ve had success moving the installation to a fresh Windows environment like this.

Thanks!

[t7MevELx0]

Is Veeam Backup for Microsoft 365 tied to a local certificate for decrypting stored secrets?

I installed VB365 on a new Windows Server 2022 VM and pointed it to the existing PostgreSQL database. The service will not start, and Veeam.Archiver.Service.log shows:

Code: Select all

Database initialization was started
Warning: Failed to decrypt data
Warning: The system cannot find the path specified
Error: LogFailedServiceInitialize
Error: Failed to decrypt data
Type: System.Exception

Veeam Support previously told me this move-and-reconnect process would work without extra steps, but the error suggests the new server cannot decrypt something in the database.

We are an MSP and cannot re-enter every client credential. How can I bring the service up on the new host with all secrets intact?

Thanks!

[Mildur]

Hello t7MevELx0

The migration workflow you are trying is not supported. By this time, workflow documented in our KB2649 must be followed:
https://www.veeam.com/kb2649

We are aware that configuration backup and restore is a highly requested feature, and its on our roadmap. But no ETA we can provide today.

All of our products encrypt credential/encryption keys in the database with a private key specific to the source backup server (encrypted using the Microsoft Data Protection API mechanism). As a result, no other machine can decrypt the data simply by connecting to the existing database.

Veeam Support previously told me this move-and-reconnect process would work without extra steps, but the error suggests the new server cannot decrypt something in the database.

May I ask for the case number?

Best,
Fabian

[t7MevELx0]

Hi @Mildur ,

Case #07683140

This problem has become a standing P1. One of our VBO servers keeps hanging (actually two, but our most critical one uses API's for self-registration): we must delete the NATS streams directory and restart every proxy and service to restore operations. On top of that, the /Explore API for Exchange restores is failing.

If we cannot repair or move the application to a fresh OS, the software cannot be considered enterprise grade. It safeguards hundreds of paying organizations, yet it cannot backup its own configuration. Veeam writes backup software; the platform must be able to protect itself. This is critical, and I hope the team treats it with the urgency it deserves.

We therefore need a clear, supported procedure to backup the configuration and migrate the deployment to new hardware or a fresh OS, that doesn't require customer interaction.

Thanks

[t7MevELx0]

@Mildur
I opened another ticket (Case #07685363) because the support engineer says a swing migration should work. They are currently helping me troubleshoot the failure. Are you certain the support team understands the product’s limitations?

[Mildur]

Hi t7MevELx0

Thank you for the new case number.
I have reached out to support management to clarify the answer you got in the support case.

Best,
Fabian

[t7MevELx0]

Hi @Mildur ,

I’m considering an in-place upgrade from Windows Server 2019 to 2022 using the “Keep personal files only” option. This should give me a clean OS while preserving the DPAPI machine keys. After the upgrade, I plan to reinstall .NET, PowerShell, and Veeam Backup for Microsoft 365, then point the installation to the existing PostgreSQL database. I’ll schedule a maintenance window and take snapshots before I start.

Have you used this approach?

Thanks!

[t7MevELx0]

Well, I gave it a shot and the in-place upgrade does work, but it didn't resolve anything. I think the in-place upgrade carried over the issue.

Without a configuration backup it seems the options are limited. I'm still waiting for RnD to get back to all of my support cases.

So my remaining options are; uninstall VBO and reinstall to see if this does anything, wait for RnD (could be months), or setup a brand new environment and call hundreds of clients and tell them we need to reconfigure them on a new server....

[Mildur]

Hi t7MevELx0,

I received feedback from support management regarding the statement about exporting/importing the certificates. The statement in Case 07685363 should have been updated by the case engineer.

We have never tested in-place upgrades, but from my experience, they work "most of the time." However, I would still recommend deploying a new machine instead of performing in-place upgrades on Windows machines.

Nevertheless, I understand the challenges faced with Veeam Backup for Microsoft 365 and new machines. I already have forwarded your case to our core PM team for Veeam Backup for Microsoft 365 as another vote for configuration backup/restore, but we won't have such a feature available in a reasonable timeframe to resolve your issues.
Therefore, I want to review and potentially escalate the case you mentioned to QA.

I'm still waiting for RnD to get back to all of my support cases.

Could you please share the case number which was the reason for the new deployment approach?
If you can provide it, I can review it and ask our RnD teams to take a closer look.

Best,
Fabian

[karsten123]

thats so embarrassing. please get your stuff right. asap!

[t7MevELx0]

@Mildur

Yes, I will share my case numbers here.

Case #07674412 - All jobs are hanging / freezing, requiring us to delete the NATS streaming dir and restart all services
Case #07681900 - API/Rest failures; the API for restores isn't working

These cases are open for the one environment, and are our most critical issues as this environment has self-registration that is powered by the API.

I have another environment that hasn't had working copy jobs since January (Case #07583409).


Thanks

@karsten123 Yes, I agree, and extremely stressful. I've been resuscitating services for 3+ weeks now. We can't be the only ones with these issues.

[karsten123]

@Veeam. can we please have a official c-level comment on this. thanks!