V12 new features

[matteu]

Hello,

I'm improving my V11 veeam audit script for the V12 but I don't find any documentation about the new powershell commandlet on V12 to know what are new between v11 and v12.

I would like to know how to :

1) Get the best practice analyzer result for all test

2) Get the MFA status for all user

3) Get the Timeout value before console close automatically

Thanks for your help

[david.domask]

Heya @matteu, Will give it a shot on all these but a lot don't have official cmdlets yet it looks like, so we need to go into unsupported territory.

1. BestPractices Analyzer Outputs: This one is a bit tricky; I see where it is help in the code, but I'm not sure how to get it to print the output. I think it's best to wait for official cmdlets on this one, as looks like there is a lot that is not publicly exposed and we'd have to dig a ton.

2. MFA Status: Use the following classes to pull this info:

$AccountRoles = [Veeam.Backup.Core.CAccountRoles]::GetAll()
[Veeam.Backup.Core.CUserMFAProfile]::FindByUserId('UserID from $AccountRoles')

You will want to parse on the Types, as looks like CAccountRoles returns a lot of default accounts also; you will likely want User and EPAgent account types. Pass their ID from the Account Property to the second command, and it will return the MFA information you're seeking.

3. Timeout settings for Console: Check two options under SBackupOptions.

If first is $false, then it means the option is not set.

[Veeam.Backup.Core.SBackupOptions]::AutomaticallyTerminateSession
False
[Veeam.Backup.Core.SBackupOptions]::AutomaticallyTerminateSessionTimeoutMinutes
10

Flipping the first to $True with powershell _looks_ to be okay but I would still categorize this for manual adjustment via the UI until an official cmdlet appears and just use these for reporting on if it's set or not.

Again, want to stress that the methods listed here are not supported, and may (and likely will) change with future updates/releases.

[matteu]

Thank you for your answer

Where can I find changelog for V12 powershell commandlet ? I don't find it

For now, I only have to change 2 option from my previous script :
-Database section because registry key are not the same on V11 and V12
-Indexing enable or not into a job because now it's not a method but a property of windows or linux guest index.

I hope official commandlet will come on the next patch because it's pretty convenient to just document veeam installation with powershell automatically

[david.domask]

Always Welcome, good luck on scripting.

As for changes, I'm not sure if there's a changelog posted anywhere. I know there are some "internal but public" resources for the changes to User Guide documents, but I think it's not quite what you're looking for.

For your two cited changes, I get these are examples but it's usually not been the best way of checking this. Can you elaborate what your script needs with regards to the Configuration Database? The indexing change is an appropriate one in my opinion as we shouldn't rely on the .NET Methods whenever possible as they frequently change. It's better that data from the Properties be used as it's more stable and likely not to change.

You can always check the Release Notes, as I think they usually give mention of cmdlet changes to some degree. I know the RestAPIs have changelogs,and for sure they are the focus of a lot of love in upcoming versions so you might consider tapping those as resources and making your requests there also.

[matteu]

What you mean is I should use more RestAPI than "native" powershell command ?

I need to learn more how to use REST Api, I'm not familiar with it.

For my need, on V11 this is what I did :

Code: Select all

function Get-veeamSQLInventory
{
    Write-Host "$(Get-Date -Format HH:mm:ss) - VeeamSQLInventory"

    $SQLSettings        = (Get-ItemProperty "HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication")
    $instance           = (get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server').InstalledInstances
    $RegistryKey        = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL').$instance
    $Edition            = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$RegistryKey\Setup").Edition.Split(" ")[0]
    $SQLServer          = $SQLSettings.SqlServerName
    $SQLInstance        = $SQLSettings.SqlInstanceName
    $Version            = (Invoke-SqlCmd -Query "select @@version" -ServerInstance "$SQLServer\$SQLInstance").column1.Split(")")[0].Replace("(","")
    $SQLServiceAccount  = (Get-WmiObject win32_service -ComputerName $SQLSettings.SqlServerName -Filter {name like "%mssql%"}).Startname
    $SQLDatabaseName    = $SQLSettings.SqlDatabaseName
    [INT]$MDFSize       = ((Invoke-SqlCmd -Query "exec sp_databases" -ServerInstance "$SQLServer\$SQLInstance") | Where-Object {$_.DATABASE_NAME -eq $SQLDatabaseName}).DATABASE_SIZE /1000
    $queryLDF           = "USE $SQLDatabaseName;SELECT (total_log_size_in_bytes - used_log_space_in_bytes)*1.0/1024/1024 AS [logSpace] FROM sys.dm_db_log_space_usage;"
    [INT]$LDFSize       = (Invoke-SqlCmd -Query $queryLDF -ServerInstance "$SQLServer\$SQLInstance").Logspace

    [PScustomObject]@{
        Name            = $SQLServer
        Edition         = $Edition
        Version         = $Version
        Instance        = $SQLInstance
        Database        = $SQLDatabaseName
        'MDFSize(MB)'   = $MDFSize
        'LDFSize(MB)'   = $LDFSize
        ServiceAccount  = $SQLServiceAccount
    }
    Write-Host "$(Get-Date -Format HH:mm:ss) --------------------"
}

On V12 this is the replacement :

Code: Select all

function Get-veeamSQLInventory
{
    Write-Host "$(Get-Date -Format HH:mm:ss) - VeeamSQLInventory"

    $SQLApp = (get-ItemProperty 'HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication\DatabaseConfigurations').SqlActiveConfiguration

    if ($SQLApp -eq "Mssql")
    {
        $SQLProperties      = get-ItemProperty 'HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication\DatabaseConfigurations\MsSql'
        $SQLinstance         = $SQLProperties.SqlInstanceName
        $InstancePath       = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL').$SQLinstance
        $Edition            = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\$InstancePath\Setup").Edition.Split(" ")[0]
        $SQLServer          = $SQLProperties.SqlServerName
        $Version            = (Invoke-SqlCmd -Query "select @@version" -ServerInstance "$SQLServer\$SQLInstance").column1.Split(")")[0].Replace("(","")
        $SQLServiceAccount  = (Get-WmiObject win32_service -ComputerName $SQLProperties.SqlServerName -Filter {name like "%mssql%"}).Startname
        $SQLDatabaseName    = $SQLProperties.SqlDatabaseName
        [INT]$MDFSize       = ((Invoke-SqlCmd -Query "exec sp_databases" -ServerInstance "$SQLServer\$SQLInstance") | Where-Object {$_.DATABASE_NAME -eq $SQLDatabaseName}).DATABASE_SIZE /1000
        $queryLDF           = "USE $SQLDatabaseName;SELECT (total_log_size_in_bytes - used_log_space_in_bytes)*1.0/1024/1024 AS [logSpace] FROM sys.dm_db_log_space_usage;"
        [INT]$LDFSize       = (Invoke-SqlCmd -Query $queryLDF -ServerInstance "$SQLServer\$SQLInstance").Logspace
    }
    else
    {
        $PostGreProperties  = get-ItemProperty 'HKLM:\SOFTWARE\Veeam\Veeam Backup and Replication\DatabaseConfigurations\PostgreSql'
        $SQLServer          = $PostGreProperties.SqlHostName
        $Edition            = "<N/A>"
        $SQLInstance        = "<N/A>"
        $Version            = "<N/A>"
        $SQLServiceAccount  = "<N/A>"
        $SQLDatabaseName    = $PostGreProperties.SqlDatabaseName
        $MDFSize            = "<N/A>"
        $LDFSize            = "<N/A>"
    }

    [PScustomObject]@{
        Name            = $SQLServer
        Edition         = $Edition
        Version         = $Version
        Instance        = $SQLInstance
        Database        = $SQLDatabaseName
        'MDFSize(MB)'   = $MDFSize
        'LDFSize(MB)'   = $LDFSize
        ServiceAccount  = $SQLServiceAccount
    }
    Write-Host "$(Get-Date -Format HH:mm:ss) --------------------"
}

Indexing V11

Code: Select all

$VmwareBkpJobs = Get-VBRJob | Where-Object {$_.TypeToString -eq "VMware Backup"}
 foreach ($element in $VmwareBkpJobs)
{
$element.VssOptions.IsIndexingRequired()
}

And for indexing V12 :

Code: Select all

$VmwareBkpJobs = Get-VBRJob | Where-Object {$_.TypeToString -eq "VMware Backup"}
 foreach ($element in $VmwareBkpJobs)
{
$element.VssOptions.WinGuestFSIndexingOptions.IsIndexingRequired 
}

If you know easier way to have the same information, feel free to help me on it

[oleg.feoktistov]

Hi @matteu,

Changelog for powershell is currently in progress. I'll let you know once it's published.

Best regards,
Oleg

[matteu]

Thanks for your answer.

PS : How do you know to mention people ?

[oleg.feoktistov]

Mentions are only available to the members of Veeam Software group. Thanks!

[matteu]

@david.domask

I execute this code for my needs :

2)

Code: Select all

#MFA status
$AccountRoles = [Veeam.Backup.Core.CAccountRoles]::GetAll() | where {$_.roles}
foreach ($Account in $AccountRoles)
{
    $Query = [Veeam.Backup.Core.CUserMFAProfile]::FindByUserId($Account.account.id)
    [pscustomobject]@{
        Account      = $Account.Account.Name
        MFAEnabled   = $Query.IsMFAEnabled
        MFAActivated = $Query.IsMFAActivated
    }
}

Unfortunately, it's not working correctly.
I have actually 4 account with MFA disabled and the result of the command is not 4 account with disabled MFA.

Account MFAEnabled MFAActivated
------- ---------- ------------
administrateur False False
testveeam True True
veeamone True False
Administrateur True False

3) It's working perfectly

Code: Select all

[pscustomobject]@{
    Autoclose = [Veeam.Backup.Core.SBackupOptions]::AutomaticallyTerminateSession
    MinutesTimeOut   = [Veeam.Backup.Core.SBackupOptions]::AutomaticallyTerminateSessionTimeoutMinutes
}

[matteu]

Maybe I need to provide more details.

If MFA is enable, all value are correct. MFAEnabled is True if it's "standard" account and false if it's "service account"
MFA activated is true when user did the activation and false if he doesn't.

=> This is working fine.

However, if I uncheck MFA, values stays the same. How can I know if MFA is enable or not on the Veeam Server ?

[david.domask]

Hi @matteu,

So just to get it right, the values show as correct, but your expectation is that if global MFA is disabled then the accounts should reflect as such?

If so this is not quite correct.

The account values are not tied to the global value; which is stored separately in the Options table in the database. What you're seeing is the "last set value" of the user accounts, which is not tied to whether Global MFA is enabled or not.

Global MFA option is observable with the following:

[Veeam.Backup.Core.SBackupOptions]::GlobalMFA

So first your script should check if this is True or False, and if it's False, don't parse the user accounts warn on that. If it's true, then proceed to check the user accounts.

[david.domask]

To answer your other questions @matteu, I don't see anything wrong with the scripts, looks like they should run fine without penalties.

To answer this: "What you mean is I should use more RestAPI than "native" powershell command ?"

It was more an observation This isn't to say anything about the future of Veeam and Powershell (It is a daily tool for so many), just I think a lot of the stuff is better handled through the RestAPI eventually. Powershell has too many quirks for my taste, and I know there is a heavy focus on the APIs. So you might consider that as a source for your scripts also (Powershell can use Invoke-RestMethod to call RestAPIs, so you can mix and match). So more just positioning that you have another options

[matteu]

Thanks for your answer

What I would like to have is exactly : [Veeam.Backup.Core.SBackupOptions]::GlobalMFA
With all command now I can know if MFA is enable "globaly" and if it is the configuration for each acount. If it isn't, I don't care about configuration of each account

Thanks for your help

For the second part of your answer, do I have the same capabilities with "powershell" and RestAPI ? or RestAPI can give informations on MFA on a "supported way" ?

[matteu]

Probably not the best way to query it because of "global" on each object but it's working fine :

Code: Select all

$GlobalMFA =[Veeam.Backup.Core.SBackupOptions]::GlobalMFA
#MFA account status
$AccountRoles = [Veeam.Backup.Core.CAccountRoles]::GetAll() | where {$_.roles}
foreach ($Account in $AccountRoles)
{
    $Query = [Veeam.Backup.Core.CUserMFAProfile]::FindByUserId($Account.account.id)
    [pscustomobject]@{
        GlobalMFA    = $GlobalMFA
        Account      = $Account.Account.Name
        MFAEnabled   = if ($GlobalMFA) {$Query.IsMFAEnabled} else {"<N/A>"}
        MFAActivated = if ($GlobalMFA) {$Query.IsMFAActivated} else {"<N/A>"}
    }
}

[albertwt]

Hi @matteu,

Changelog for powershell is currently in progress. I'll let you know once it's published.

Best regards,
Oleg

Yes, @oleg.feoktistov,

I'm also curious and interested as well for the Changelog when available.

[RubinCompServ]

I, too, would like to see the Changelog and/or updated PS reference docs.

[oleg.feoktistov]

I'm glad to announce that Powershell Changelog v12 is now live.

[matteu]

Thanks a lot

[matteu]

Is there a powershell commandlet to get the best practice result now ?
Or maybe an "unsupported" way to get them with powershell ?

[david.domask]

@matteu,

I can pull the raw data with a few commands, but it's not really parsable in an easy way unless I just can't find an alternative method. Let's consider it a feature request, as it would require a bit of work/code to make the data I can pull usable.

[matteu]

Thanks for your answer.
I create a topic

[OliverW]

Hello,

I wanted to ask if it is possible to query via PowerShell, if MFA for specific users or the GUI timeout is enabled? We want to activate a bit of monitoring for these settings, if somebody changes these settings we want to be aware of it.

Thanks!

[david.domask]

Hi @OliverW, I've moved your post to an existing topic on the same subject. The same workarounds must be used at this time, but it is a known request to return this information natively. For now please use the workarounds found in this thread.

Thanks!

[OliverW]

Hi David,

thanks, didn't found this topic, but will try the suggestions.