12.3.2.4165 Patch and Agent 6.3.2.1302

[jcofin13]

It is my understanding that the 12.3.2.4165 patch doesnt affect those vbr servers that are not domain joined.

Should it be patched anyway if the vbr servers are not domain joined or can it be skipped?

Also for the Windows Agent CVE listed, (https://www.veeam.com/kb4778) do you need to be running vbr 4156 to run the new agent version ( 6.3.2.1302)

It mentioned "preinstalled protection groups". I am not sure what preinstalled means. Does that mean if you use protection groups then you need to apply the patch from C:\Program Files\Veeam\Veeam Distribution Service\Fixes\vaw\kb.1076569?

I do have some protection groups for exchange vms and some other stand along physical machines.

IF you dont upgrade VBR to 4165, do you still need to do the agent upgrade?

Finally, If you have stand alone agents (6.3.2.1205) installed and try to install/upgrade 6.3.2.1302 it says the product is already installed. It suggest you must uninstall it first then install the new version? Wont that wipe out all your backup settings for those stand alone agents who dont rely on a VBR server? In this example, agents are installed on laptops and backups are taken locally of items using the agent on those machines outside of vbr.

https://www.veeam.com/kb4778 seems to suggest you need to remove the agent and install the new one but the release notes just say to upgrade the current one:
https://helpcenter.veeam.com/rn/veeam_a ... notes.html


You can also perform the upgrade manually, for example before the new version is published to auto-update servers. To perform the upgrade manually:

Download the latest version of Veeam Agent for Microsoft Windows from https://www.veeam.com/downloads.html to the computer where you want to perform an update.
Double-click the downloaded file, then double-click the setup file contained in the archive.
Click Accept and Update to accept the license agreements and upgrade Veeam Agent for Microsoft Windows.
Once update is completed, you will be offered to launch the Recovery Media creation wizard upon exiting the update wizard. If you decide to do this later, you will be able to start the wizard from the Windows Start menu.
Click Finish to close the setup.
To access Veeam Agent for Microsoft Windows control panel, click the corresponding icon in the notification area of the system tray.

IF i download the agent from veeam and try to install it it says its already installed and doesnt upgrade 1205 to 1302. The Check now button says im up to date. I assume despite it being a stand alone agent it must check aganst the vbr server to see what version is on offer and if we didnt upgrade to 4165 since we are not affected (not domain joined) then it wouldnt find any new agent and continue to report 1205 as current. Or.....its just not seeing the new 1302 update from veeam yet. Either way...if i manually download it from veeam.com and try to upgrade it, it says its already installed. "Another vesion of this product is already installed. Installation of this version cannot continue"

[Gostev]

1/ No, you don't have to patch VBR that are not a part of domain.
2/ Yes, you need to patch VBR if it does agent-based backups of Windows machines so that your managed agents get updated to a non-vulnerable version.
3/ No, it won't wipe all your backup settings. The update notification in the agent specifically addresses this, take a closer look. It also explains that you must uninstall the existing agent manually first.

[jcofin13]

Thanks..so you have to upgrade if you have managed agents despite it not being in a windows domain.....and stand alone agents must be uninstalled first, then the new agent reinstalled. Ill get the patch scheduled so we can upgrade our agents. Thanks!