Comprehensive data protection for all workloads
Post Reply
Posts: 8
Liked: 1 time
Joined: Feb 02, 2015 6:06 am

Notification when encryption password changes

Post by MattCutt »

Hi there

My concern is someone getting on the backup server and changing the encryption password. We have done everything we can to harden the backup server, use immutable backups and also cc, but if mr bad guy gets on the server and changes the encryption password, we will be in trouble.
Is there anyway Veeam can write to the event log when a password is changed? That way we can monitor the event logs and be notified of this event occurring.
I know Veeam One can monitor this, but our customers dont use this.


Veeam Software
Posts: 829
Liked: 427 times
Joined: Jul 17, 2015 6:54 pm
Full Name: Jorge de la Cruz

Re: Notification when encryption password changes

Post by jorgedlcruz »

Pretty interesting case. Please allow me some time on the lab to see what is the current level of monitoring for this action.

Thank you
Jorge de la Cruz
Senior Analyst, Product Management | Veeam ONE @ Veeam Software

@jorgedlcruz /
vExpert 2014-2022 / InfluxAce

Posts: 636
Liked: 305 times
Joined: Aug 04, 2019 2:57 pm
Full Name: Harvey Carel

Re: Notification when encryption password changes

Post by soncscy »

I posted this awhile back and I think it still works:


See if it helps!

Egor Yakovlev
Veeam Software
Posts: 2401
Liked: 592 times
Joined: Jun 14, 2013 9:30 am
Full Name: Egor Yakovlev
Location: Prague, Czech Republic

Re: Notification when encryption password changes

Post by Egor Yakovlev » 1 person likes this post

Windows Event Log also has it under Applications > Veeam Backup.

If someone changes password used in the job:

Code: Select all

Event ID 23050 source VeeamMP
Backup {JobName} has been modified.
<property name="Storage > Storage encryption password" internal="BackupStorageOptionsStorageEncryptionPasswordHint" type="String">
	<old>my old password</old>
	<new>bad guy password</new>
If someone changes used password in credentials manager:

Code: Select all

Event ID 31700 source VeeamMP
Encryption password {} has been modified.

Post Reply

Who is online

Users browsing this forum: Bing [Bot], Egor Yakovlev, Google [Bot], Kazuha, RValensise and 71 guests