Security issues with Veeam.Agent.Configurator.exe

Backup agent for Microsoft Windows servers and workstations (formerly Veeam Endpoint Backup FREE)

Security issues with Veeam.Agent.Configurator.exe

Veeam Logoby Martinest » Thu Jul 20, 2017 1:27 pm

Hi!

I have set up test environment to get to know with Veeam Agent for Windows.

Wanted to test configuration export and import. Free edition doesn't support it so I'm trying out 30 days trial.
Have installed and configured 2.0.0700 - Workstation Edition. Backups are running nicely.

Wanted to export the configuration file:
"C:\Program Files\Veeam\Endpoint Backup\Veeam.Agent.Configurator.exe" -export /f:C:\Veeam\configuration.xml


Getting configuration.xml with "Access denied" message:

<ExecutionResult Version="" ExitCode="20"><Errors><Exception Type="Veeam.EndPoint.Configurator.ExecutionError" Message="Failed to perform the operation." /><Exception Type="System.Security.SecurityException" Message="Access denied. Backup settings are managed by your backup administrator" /></Errors></ExecutionResult>


I have full admin rights. Do i need to install something else to manage the Veeam administrators list or what I'm doing wrong?

Regards
Martin
Martinest
Novice
 
Posts: 5
Liked: never
Joined: Tue Jul 18, 2017 9:14 am

Re: Security issues with Veeam.Agent.Configurator.exe

Veeam Logoby Dima P. » Thu Jul 20, 2017 5:32 pm

Hi Martin,

Any chance you were testing Veeam Availability Console with Veeam Agent for Windows? What is set to be the backup job destination? Thanks.
Dima P.
Veeam Software
 
Posts: 6523
Liked: 454 times
Joined: Mon Feb 04, 2013 2:07 pm
Location: SPb
Full Name: Dmitry Popov

Re: Security issues with Veeam.Agent.Configurator.exe

Veeam Logoby Martinest » Thu Jul 20, 2017 7:15 pm

Hi!

Thank you for a quick reply.
No, just standalone agent. We have some physical machines making backups to network share and i wanted to find better ways to install other workstations with smaller effort.
Didn't work for me, downloaded the 30 day license and tried again with no success. Installed clean VM and made backup to secondary VHD but still same error message.

Regards
Martin
Martinest
Novice
 
Posts: 5
Liked: never
Joined: Tue Jul 18, 2017 9:14 am

Re: Security issues with Veeam.Agent.Configurator.exe

Veeam Logoby Dima P. » Fri Jul 28, 2017 3:06 pm

Martin,

Sorry for keeping silence - your last rely somehow slipped away. Can you confirm that before running import you actually installed the license file? Whiteout the license being installed import/export operation simply fails.
Dima P.
Veeam Software
 
Posts: 6523
Liked: 454 times
Joined: Mon Feb 04, 2013 2:07 pm
Location: SPb
Full Name: Dmitry Popov

Re: Security issues with Veeam.Agent.Configurator.exe

Veeam Logoby Martinest » Thu Aug 10, 2017 12:51 pm

Thank you for your reply. It started to work on the third workstation and haven't got that message again (license were installed successfully).

I might fall off topic with next question but I followed Clint Wyckoff post on GitHub for deploying VAW remotely (https://github.com/VeeamHub/powershell/ ... oy-VAW.ps1)

Running that PowerShell script gave me some errors. Had to modify some rows to get it working:
Write-Host -ForegroundColor Green "Step #2: Applying your License File to the Protected Host"
Set-Location $VeeamAgentInstallDirectory
Start-Process Veeam.Agent.Configurator.exe -ArgumentList "-license /f:'$LicenseFile'"

Changed to:
Write-Host -ForegroundColor Green "Step #2: Applying your License File to the Protected Host"
Set-Location $VeeamAgentInstallDirectory
.\Veeam.Agent.Configurator.exe -license /f:"$LicenseFile"

And same for config file import.Used bat to call the script so it doesn't have to be run in administrator rights and to bypass execution policy:
Powershell.exe -Command "& {Start-Process Powershell.exe -ArgumentList '-ExecutionPolicy Bypass -File "path"' -Verb RunAs}"

Now everything working regarding install, licensing and configuration.

The only problem left now for silent remote install is the new UAC popup window appears asking permission to run Windows PowerShell. Is there a possibility to add some rows to the script to bypass this too. Don't want to change UAC settings in every PC.

Regards
Martin
Martinest
Novice
 
Posts: 5
Liked: never
Joined: Tue Jul 18, 2017 9:14 am

Re: Security issues with Veeam.Agent.Configurator.exe

Veeam Logoby Dima P. » Fri Aug 11, 2017 6:22 pm

Martin,

Asked the author about this issue. Stay tuned.
Dima P.
Veeam Software
 
Posts: 6523
Liked: 454 times
Joined: Mon Feb 04, 2013 2:07 pm
Location: SPb
Full Name: Dmitry Popov

Re: Security issues with Veeam.Agent.Configurator.exe

Veeam Logoby Martinest » Wed Oct 11, 2017 2:07 pm

Ping
Martinest
Novice
 
Posts: 5
Liked: never
Joined: Tue Jul 18, 2017 9:14 am

Re: Security issues with Veeam.Agent.Configurator.exe

Veeam Logoby vClintWyckoff » Fri Oct 13, 2017 3:40 pm

Martin-
Sorry for the delayed response on this thread. The version I had in the Github repository was for an earlier beta version (2.0.0.677) - I've updated the Github script to work with the GA VAW (2.0.0.700).

As for the UAC - I was using the script as part of an SCCM application deployment, so UAC was not an issue in this scenario.
vClintWyckoff
Veeam Software
 
Posts: 443
Liked: 98 times
Joined: Sat Oct 27, 2012 1:22 am
Location: Technical Evangelist
Full Name: Clint Wyckoff

Re: Security issues with Veeam.Agent.Configurator.exe

Veeam Logoby Martinest » Mon Oct 16, 2017 1:05 pm

vClintWyckoff wrote:Martin-
Sorry for the delayed response on this thread. The version I had in the Github repository was for an earlier beta version (2.0.0.677) - I've updated the Github script to work with the GA VAW (2.0.0.700).

As for the UAC - I was using the script as part of an SCCM application deployment, so UAC was not an issue in this scenario.



Thank you for your answer.
Is there a way to bypass UAC with the script?

Regards
Martin
Martinest
Novice
 
Posts: 5
Liked: never
Joined: Tue Jul 18, 2017 9:14 am

Re: Security issues with Veeam.Agent.Configurator.exe

Veeam Logoby vClintWyckoff » Tue Oct 17, 2017 5:18 am

Hey Martin-
So there's a few ways out there you can bypass UAC based on just some quick searching around the web. UAC is there for protection so manually bypassing would be a security risk in my mind. Probably the best bet in this scenario would be either wait for Veeam Backup & Replication Update 3 where we'll provide the ways to automatically and silently deploy the VAW / VAL software or use a software deployment tool like SCCM or even something as simple as GPO deployment.
vClintWyckoff
Veeam Software
 
Posts: 443
Liked: 98 times
Joined: Sat Oct 27, 2012 1:22 am
Location: Technical Evangelist
Full Name: Clint Wyckoff


Return to Veeam Agent for Windows



Who is online

Users browsing this forum: No registered users and 10 guests