Notification when encryption password changes

[MattCutt]

Hi there

My concern is someone getting on the backup server and changing the encryption password. We have done everything we can to harden the backup server, use immutable backups and also cc, but if mr bad guy gets on the server and changes the encryption password, we will be in trouble.
Is there anyway Veeam can write to the event log when a password is changed? That way we can monitor the event logs and be notified of this event occurring.
I know Veeam One can monitor this, but our customers dont use this.

Cheers!

[jorgedlcruz]

Hello,
Pretty interesting case. Please allow me some time on the lab to see what is the current level of monitoring for this action.

Thank you

[soncscy]

I posted this awhile back and I think it still works:

post374312.html#p374312

See if it helps!

[Egor Yakovlev]

Windows Event Log also has it under Applications > Veeam Backup.

If someone changes password used in the job:

Code: Select all

Event ID 23050 source VeeamMP
Backup {JobName} has been modified.
<property name="Storage > Storage encryption password" internal="BackupStorageOptionsStorageEncryptionPasswordHint" type="String">
	<old>my old password</old>
	<new>bad guy password</new>
</property>

If someone changes used password in credentials manager:

Code: Select all

Event ID 31700 source VeeamMP
Encryption password {pass.name} has been modified.

/Cheers!