[V13] Veeam Server Appliance host admin lockout, MFA reset, password reset

[squebel]

Hello,

How would one go about resetting the built-in "veeamadmin" MFA should the original info for it get lost? Let's assume there is not another user that is able to get onto the machine.

[Gostev]

Hello, same as with any other OS: you'd have to boot the server from a live ISO, mount the file system to it and edit the OS configuration files manually. So not a quick fix and best avoided by making sure there are at least two admin accounts!

[squebel]

Gostev, is this a process that Veeam Support will be documenting and providing via support cases if needed? I opened case 07824123 to inquire about an official process and so far only a rebuild has been suggested as an option.

[Gostev]

@Dima P. do we have any documentation for Live ISO yes and if not, when does the Technical Writing team plan to release it?

[Dima P.]

Sure, here you go guys > How to use Veeam Live OS ISO.

[Gostev]

@Dima P. what about the instructions of resetting host admin account access in case the password and/or MFA are lost.

[Dima P.]

Asked team to update the KB with step by step instructions. Please stay tuned.

[Dima P.]

The KB has been updated with information on unlocking users and resetting user passwords.

We are currently working with the Technical Writing team to prepare step-by-step MFA reset instructions for Host Admin and Security Officer accounts, which will be published in the Help Center soon — stay tuned!

For MFA resets via LiveOS mage, we strongly recommend opening a support case first to avoid possible misconfigurations.

[Gostev]

I really like the on-going updates to the Common Tasks section thanks Dima!

[pirx]

After a new install and some configuration I managed to lock veeamadmin user by entering wrong password inVM console.

https://helpcenter.veeam.com/docs/vbr/e ... king-users

But how can I do this if there is no other user with host admin permissions than veeamadmin? Logged in as veeamso user I don't see any option to reset other users passwords or unlock accounts. Is there a timeout after a lock is released like in most Linux?

There is a KB for hardened repository pw reset, but it does not work for v13 appliance.

https://www.veeam.com/kb4663

[Mildur]

Hi Pirx,

You can use the Veeam Live OS ISO to unlock accounts in the Veeam Software Appliance if no other Admin account is available.
Please follow the steps outlined in KB4761.

Best regards,
Fabian

[pirx]

Thx, I did search forum but did not find this thread. Maybe it would make sense to add the unlock feature to veeamso account

[Gostev]

Not your fault, we routinely merge topics discussing different variations of the same issue (in this case, host admin lockout when no other host admin present) and in the process we expand the original topic name with all key words to improve search hits.

You are right, simple unlock should be a safe operation in terms of Zero Trust.