Restore from backup copy job

[redhorse]

Hello,

I backup my physical Veeam Server with VEB into a Veeam repository which is physically located on the Veeam Server (local hdd). I have a Backup Copy-Job which copies my VEB-Backup to a secondary location (NAS) and everything is working great.

Now, I want to test the restore of my Veeam Server and I booted the Server with the rescue media. Because in case of disaster I am unable to access the local Veeam-Repository and the local hdd to access the primary Veeam Backup directly, I tried to restore from the backup copy on the NAS with accessing it via UNC path. Unfortunately I got the message that it is not possible to restore from Backup & Replication backups. Is that behaviour expected? If so, I have to choose a location outside of the Veeam Server for the primary backup.

[Dima P.]

Hi redhorse,

There is a limitation in the existing backup copy jobs with VEB backups – it can be restored only by VBR’s restore operator or admin account. It was done to limit the possible security violations - otherwise users could restore anything from backup file made by backup copy job. If the backup made by copy job is ‘detached’ from the VBR you can’t use it for restore since it can’t check your permissions anymore.

That being said, I recommend excluding the VBR backup from backup copy job or, maybe, point this VEB to the CIFS location instead.

[redhorse]

Hi Dima,

the restore works when I point the VEB recovery to the primary repository via UNC-Path (although the backup uses the option to backup to B&R-Repository). So the limitation exists only for backup copys? My plan is to add a repository outside of the physical Veeam Server (NAS-Share) as the primary backup destination of the VEB Job and leave the backup copy job as it is. In case of disaster recovery I can point VEB directly to this NAS-Share.

[Dima P.]

So the limitation exists only for backup copys?

Yes. You plan will work if you use a regular CIFS destination and stay away from backup copy.

[redhorse]

Thanks!

[ChuckS42]

Ok, just hit this. Quite frustrating. I am using a Backup Copy job to give a VAW backup a meaningful name, and I need the copy to be restorable (of course, otherwise what's the point?). Feh.

[ChuckS42]

Yes. You plan will work if you use a regular CIFS destination and stay away from backup copy.

Is this something that will be fixed in the future? Maybe with VBR v10?

[Technogod]

You mentioned VEB and then VAW. Are you using VAW? If so, you can boot from recovery media and restore backup copy job from SMB share.

[Dima P.]

I am using a Backup Copy job to give a VAW backup a meaningful name, and I need the copy to be restorable (of course, otherwise what's the point?). Feh.

The backup copy backup file is restorable, but you have to authenticate with Veeam B&R admin account during recovery from Veeam B&R repository.

Is this something that will be fixed in the future? Maybe with VBR v10?

Yes. We plan to provide the granular access for backup copy backup file (let regular users see only their portion of backup files). Once it’s done – admin account is no longer a mandatory.

[c.schulzejn]

We just hit this too.

Our installations are quite small but still use VBR. The only offsite backup are files from a backup copy job. In case of desaster (location fully lost) we only have the backup copy files, neither a VBR nor a VBR repo.

Is it possible to import the files from the offsite backup copy job into another VBR instance and transform them into a state, which can be used to recover via recovery media and provide the backup file via local storage or CIFS?

[Dima P.]

Hello Christoph,

Unfortunately no, Veeam repository is required to sort the permissions within the backup copy backup. That could be a brand new Veeam B&R installation with old backup copy backup being imported. Since there is no extra requirements on the setup, you can spin up a new Veeam B&R instance and start Bare Metal Recovery pretty quick.

[c.schulzejn]

Hi Dima P.,

thx for the answer.

Does Veeam have any plans to change that behavior?

We have many small customers with just one Hyper-V host or even w/o a Hyper-V host. The latter only use a single Windows Server Essentials. VBR is used to backup the physical server and VMs (if any) and the clients. In case of a desaster i.e. the server machine is lost, we only rely on the backup copy job files in the cloud or offsite (RDX, LTO). Currently my solution would be a spare machine, which gets spun up for the restore. That thing increases one time and running costs. :\

[c.schulzejn]

@Dima P. if the Backup Copy goes to a VCC, would BMR be possible then?

[Dima P.]

Hello Christoph,

Bare Metal Recovery is supported from cloud connect repository for sure. You need to use tenant account to access cloud repository repository and list all the backup files.

[sp-it]

Hi Dima P.,

The backup copy backup file is restorable, but you have to authenticate with Veeam B&R admin account during recovery from Veeam B&R repository.

Yes. We plan to provide the granular access for backup copy backup file (let regular users see only their portion of backup files). Once it’s done – admin account is no longer a mandatory.

Is this feature in VBR v11? It would be nice to restore without Veeam B&R in case of a disaster. To prevent unauthorized access to backup copy files the backup file encryption could be activated.

[Dima P.]

Hello sp-it,

No, admin access to the repository is still required. Cheers!

[wires]

I'm running into this issue as well, but am a bit confused of the logic "why".

My setup is Agent -> Veeam B&R to NAS -> Backup Copy to HDD

If I open the recovery console for a BMR, I can:
1) Recover directly from the NAS
2) Recover from the backup server
3) Recover from backups copied from the NAS to a HDD (direct copy, not a backup copy)
But cannot recover from the backup copy.

My confusion comes around the "permissions comment". I can grab a junk PC, install Veeam B&R with a random user/password/PC name (not remotely the same as the original server making the backup copy). I can then import the backup copy into this server, and then recover off of the backup copy.

How is this any more "Secure". Anyone in possession of my backup copy just needs to download the free Veeam version off of the website, and VOILA they can access all the data. I'm a bit confused....

I ended up copying the Veeam ISO + drivers + recovery ISO to a folder on the backup copy HDD just to deal with a DR situation. I'm struggling to understand why the extra complexity is required?

[Mildur]

How is this any more "Secure". Anyone in possession of my backup copy just needs to download the free Veeam version off of the website, and VOILA they can access all the data. I'm a bit confused....

Use Encryption in the backup copy Job and that will never be an issue.

[Dima P.]

Backup copy can contain multiple agent backups, to avoid issues when one user get instant access to another users data it needs to be controlled by backup admin. As Fabian mentioned if you are worried about any backup file being imported to another Veeam B&R you should encrypt your backups.

[wires]

I'm not worried about security and if I was, I'd encrypt them. My confusion is why can't we just use the recovery console and recover directly from a backup copy? The comment above was it is "more secure" since it requires admin permissions to restore, but that isn't the case since anyone can spin up a Veeam B&R instance to do the import.

This just seems to be an extra (and unjustified) step.

[Dima P.]

Lyle,

I'll count your post as a feature request. Thanks for the feedback!

[wires]

Thanks. Luckily (knock on wood) I've never had to go through a DR scenario other than bench testing backups. I cannot image the level of stress if it happened for real, so minimizing that would be great.

Hopefully, the backup copy is just a "waste of my time" -- IE we never get to a DR!

[Ben.online]

I'm still not sure about the procedure to recover from VBR with a copy job.

My setup is Agent -> Veeam B&R to NAS -> Backup Copy to NAS on DR site.

When i try to open the backup on the DR for BMR it will not list any restore options because it is not an agent backup, what kinda makes sense.
But when setting up a VBR on the DR site and importing the backup the issue is unchanged.
Backup copy shows up under imported jobs but will not be listed when doing a BMR and connecting to the VBR on the DR site (all other agent backups are listed as restore options).
Even when exporting the backup from the imported copy job (contains 2 physical servers) to a singel full backup will show its an physical server backup (the icon) but lists as a backup so not usable with the agent recovery media in BMR situation.

As a quick fix i just copied the original agent backup from production NAS to the NAS on the DR and then there is no issue with BMR.

But how to use the copy job on the DR site when the production is gone is unclear to me!?

[Dima P.]

Hello Ben.online,

Backup copy shows up under imported jobs but will not be listed when doing a BMR and connecting to the VBR on the DR site (all other agent backups are listed as restore options).

Can you clarify what credentials you've used when connecting to a Veeam B&R at the DR site? To see all the backup files you must use account associated with Veeam B&R admin role (so that should be DR's Veeam B&R administrator account). Thanks!

[Ben.online]

Hello Dima,

I'm using the administrator account. I can see all agent backups from multiple repository's but the copy job or the export of that job are shown as regular backups in the imported interface.
And i think there for not listed when using the agent BMR recovery media.

[Dima P.]

Ben,

Any chance you have other backups (registered under any other primary or secondary job) for the same machine in your DR Veeam B&R? Thanks!

[Ben.online]

Hi Dima,

No that is not the case only the one imported file

[Dima P.]

Ben,

Can you please raise a ticket for the affected VBR and share the case ID with me. I'll RnD folks to review the log details once uploaded. Thank you in advance!

[Vertigo]

Apologies for the thread resurrection but I've just come across this and want to get it straight in my head.

I use VBR in a home scenario. I have a daily backup of client machines to my local VBR server. There is then a weekly backup copy job which copies to a remote repository which is on a dedicated drive in a machined located at my place of work, connected via a VPN. The backup copy is encrypted. This all works fine.

The offsite backup copy is obviously intended for disaster recovery but, from what I'm reading here, it sounds like I still need the VBR server to access it?
So what happens if I completely lose my local server? I'm then screwed? Doesn't this totally defeat the purpose?

Thanks.

[Technogod]

Make sure you have a backup of your server and the server configuration is stored on a different repository.