Identify who initiated VeeamZip backup

[DeadEyedJacks]

We need to establish who ran a VeeamZip backup of a VM.
How do we find this information within vSphere or Veeam Backup logs.
(VMware tasks and events just shows Veeam service account creating snapshot.)


Secondly, can we disable, remove or restrict use of this option, which is being widely misunderstood and is potentially disaterous as it defaults to targeting the system drive of the Veeam Backup server...


Case# 02267830

[Dima P.]

Hello DeadEyedJacks,

Not sure (never tested myself) but try to check windows event log for event 110:

110 Backup job started <Job type> job "<Job name>" has been started. Info Backup

In the event details look for the User field and associated windows account.

it defaults to targeting the system drive of the Veeam Backup server...

If possible, remove the default C:\Backup repository. Once done this location should not appear under repository thus users won’t be able to choose it.