Problem with disabling 'backup file encryption'

[Noix]

Hello,

I'm using Veeam Agent for Windows in Free Mode, Version 3.0.2.1170, on Windows 10 Build 2004.
Retention is 25 days, active full every Thursday, Schedule is Daily at 10:00, target is a local storage (2nd build in HD).

A few days ago I decided to check out the 'Enable backup encryption' option.
So I hit the checkbox and provided a password. veeam gave a hint, that the next backup will be an active full. Ok.
Next day it performed an active full.

Then I tried to access this backup image but was not prompted for a password. I waited a week until the next scheduled active full but still when I tryed to access this second backup image under encryption, it did not prompt for a password. Strange.
Due to this intransparence I decided to disable backup file encryption again. veeam gave again a hint, that the next backup will be an active full. Ok.

This is two weeks ago. So there have been two scheduled active full backups meanwhile without backup file encryption active. On the system generating the backups I'm still not prompted for a password for recovery.

Now I wanted to access these files on a different system. I copied the whole folder including all .vib, .vbk and the .vbm files to an external disk and plugged it to another system. Guess what, now veeam prompts for the password, no matter which archive I try (encrypted or unencrypted).

So my question is, how can I reset this password to 'nothing' and how-to completely disable backup file encryption?
(Path: Edit Backup Job > Local Storage > Advanced > Storage > Section Encryption, Checkbox unchecked, Password Input Box still shows [To change the safed password, click here])

Help is very much appreciated,
Noix

[Egor Yakovlev]

Hi Noix.

- First of all, let me note, that official support for Windows 10 build 2004 for Veeam agent came at version 4.0.1. It would be a good idea to update the agent.
- If backup file was created with encryption enabled, there is no way to make it non-encrypted. You can enter password and read data from it, but you cannot "remove the lock" retroactively - it is possible to alter future backups encryption mode.
- For ease of use, Veeam Agent stores encryption key locally - that is, if you are opening "your own" encrypted backup, we will never ask for password! Simple as that, Veeam will ask for encryption password when backup is opened on any "foreign" machine.
- Reason why Veeam asks for passwords even on non-encrypted chains, is because backupdata metadata(holding information about all restore points in the chain, including encrypted and non encrypted ones) is encrypted too!

Hope that clears out the case!

[Noix]

Hello Egor,

thank you very much for your reply. I appreciate your quick response.
4.0.1 is already downloaded for installation soon ,-)

> .. there is no way to make it non-encrypted.
I read that before in the online help. Clear so far and logical.

> For ease of use, Veeam Agent stores encryption key locally ..
> .. is because backupdata metadata .. is encrypted too!
> .. will ask for encryption password when backup is opened on any "foreign" machine.
Ah. Ok. Understood.

> .. it is possible to alter future backups encryption mode.
At which point after unchecking the box '[ ] enable file backup subscription' will the metadata '.vbm' be decrypted again? And when will it disremember the former active password? Will it disremember at that point when all former restore points are released? How can I proove that a current .vbm/.vbk without encryption enabeled will be readable without beeing prompted for a password later (I store these files by month on external storage).

Best Regards,
Noix

[Egor Yakovlev]

Metadata will be un-encrypted when last encrypted restore point it describes will be gone by retention.
/Cheers!