Security issues with Veeam.Agent.Configurator.exe

[Martinest]

Hi!

I have set up test environment to get to know with Veeam Agent for Windows.

Wanted to test configuration export and import. Free edition doesn't support it so I'm trying out 30 days trial.
Have installed and configured 2.0.0700 - Workstation Edition. Backups are running nicely.

Wanted to export the configuration file:

"C:\Program Files\Veeam\Endpoint Backup\Veeam.Agent.Configurator.exe" -export /f:C:\Veeam\configuration.xml

Getting configuration.xml with "Access denied" message:

<ExecutionResult Version="" ExitCode="20"><Errors><Exception Type="Veeam.EndPoint.Configurator.ExecutionError" Message="Failed to perform the operation." /><Exception Type="System.Security.SecurityException" Message="Access denied. Backup settings are managed by your backup administrator" /></Errors></ExecutionResult>

I have full admin rights. Do i need to install something else to manage the Veeam administrators list or what I'm doing wrong?

Regards
Martin

[Dima P.]

Hi Martin,

Any chance you were testing Veeam Availability Console with Veeam Agent for Windows? What is set to be the backup job destination? Thanks.

[Martinest]

Hi!

Thank you for a quick reply.
No, just standalone agent. We have some physical machines making backups to network share and i wanted to find better ways to install other workstations with smaller effort.
Didn't work for me, downloaded the 30 day license and tried again with no success. Installed clean VM and made backup to secondary VHD but still same error message.

Regards
Martin

[Dima P.]

Martin,

Sorry for keeping silence - your last rely somehow slipped away. Can you confirm that before running import you actually installed the license file? Whiteout the license being installed import/export operation simply fails.

[Martinest]

Thank you for your reply. It started to work on the third workstation and haven't got that message again (license were installed successfully).

I might fall off topic with next question but I followed Clint Wyckoff post on GitHub for deploying VAW remotely (https://github.com/VeeamHub/powershell/ ... oy-VAW.ps1)

Running that PowerShell script gave me some errors. Had to modify some rows to get it working:

Write-Host -ForegroundColor Green "Step #2: Applying your License File to the Protected Host"
Set-Location $VeeamAgentInstallDirectory
Start-Process Veeam.Agent.Configurator.exe -ArgumentList "-license /f:'$LicenseFile'"

Changed to:

Write-Host -ForegroundColor Green "Step #2: Applying your License File to the Protected Host"
Set-Location $VeeamAgentInstallDirectory
.\Veeam.Agent.Configurator.exe -license /f:"$LicenseFile"

And same for config file import.Used bat to call the script so it doesn't have to be run in administrator rights and to bypass execution policy:

Powershell.exe -Command "& {Start-Process Powershell.exe -ArgumentList '-ExecutionPolicy Bypass -File "path"' -Verb RunAs}"

Now everything working regarding install, licensing and configuration.

The only problem left now for silent remote install is the new UAC popup window appears asking permission to run Windows PowerShell. Is there a possibility to add some rows to the script to bypass this too. Don't want to change UAC settings in every PC.

Regards
Martin

[Dima P.]

Martin,

Asked the author about this issue. Stay tuned.

[Martinest]

Ping

[vClintWyckoff]

Martin-
Sorry for the delayed response on this thread. The version I had in the Github repository was for an earlier beta version (2.0.0.677) - I've updated the Github script to work with the GA VAW (2.0.0.700).

As for the UAC - I was using the script as part of an SCCM application deployment, so UAC was not an issue in this scenario.

[Martinest]

Martin-
Sorry for the delayed response on this thread. The version I had in the Github repository was for an earlier beta version (2.0.0.677) - I've updated the Github script to work with the GA VAW (2.0.0.700).

As for the UAC - I was using the script as part of an SCCM application deployment, so UAC was not an issue in this scenario.

Thank you for your answer.
Is there a way to bypass UAC with the script?

Regards
Martin

[vClintWyckoff]

Hey Martin-
So there's a few ways out there you can bypass UAC based on just some quick searching around the web. UAC is there for protection so manually bypassing would be a security risk in my mind. Probably the best bet in this scenario would be either wait for Veeam Backup & Replication Update 3 where we'll provide the ways to automatically and silently deploy the VAW / VAL software or use a software deployment tool like SCCM or even something as simple as GPO deployment.

[Martinest]

Thank you for your time!

Regards
Martin