Comprehensive data protection for all workloads
Post Reply
MattCutt
Novice
Posts: 8
Liked: 1 time
Joined: Feb 02, 2015 6:06 am
Contact:

Notification when encryption password changes

Post by MattCutt »

Hi there

My concern is someone getting on the backup server and changing the encryption password. We have done everything we can to harden the backup server, use immutable backups and also cc, but if mr bad guy gets on the server and changes the encryption password, we will be in trouble.
Is there anyway Veeam can write to the event log when a password is changed? That way we can monitor the event logs and be notified of this event occurring.
I know Veeam One can monitor this, but our customers dont use this.

Cheers!

jorgedlcruz
Veeam Software
Posts: 710
Liked: 372 times
Joined: Jul 17, 2015 6:54 pm
Full Name: Jorge de la Cruz
Contact:

Re: Notification when encryption password changes

Post by jorgedlcruz »

Hello,
Pretty interesting case. Please allow me some time on the lab to see what is the current level of monitoring for this action.

Thank you
Jorge de la Cruz
Senior Analyst, Product Management | Veeam ONE @ Veeam Software

@jorgedlcruz
https://www.jorgedelacruz.es / https://jorgedelacruz.uk
vExpert 2014-2021 / Nutanix Technology Champion 2018-2019 / InfluxAce

soncscy
Veeam Legend
Posts: 627
Liked: 300 times
Joined: Aug 04, 2019 2:57 pm
Full Name: Harvey Carel
Contact:

Re: Notification when encryption password changes

Post by soncscy »

I posted this awhile back and I think it still works:

post374312.html#p374312

See if it helps!

Egor Yakovlev
Veeam Software
Posts: 2364
Liked: 583 times
Joined: Jun 14, 2013 9:30 am
Full Name: Egor Yakovlev
Location: Prague, Czech Republic
Contact:

Re: Notification when encryption password changes

Post by Egor Yakovlev » 1 person likes this post

Windows Event Log also has it under Applications > Veeam Backup.

If someone changes password used in the job:

Code: Select all

Event ID 23050 source VeeamMP
Backup {JobName} has been modified.
<property name="Storage > Storage encryption password" internal="BackupStorageOptionsStorageEncryptionPasswordHint" type="String">
	<old>my old password</old>
	<new>bad guy password</new>
</property>
If someone changes used password in credentials manager:

Code: Select all

Event ID 31700 source VeeamMP
Encryption password {pass.name} has been modified.
/Cheers!

Post Reply

Who is online

Users browsing this forum: helly.wu and 13 guests