false alarms on v13.

[ashleyw]

hi,

Just looking at some of the alarms being reported in Veeam ONE when checking a V13 Backup and Replication appliance.
I think there are some

1. "Backup services should be running under the LocalSystem account"
suggestion: Best practice "Backup services should be running under the LocalSystem account" has Not implemented status.
*The V13 appliance isn't windows based, so I think this message should not be triggered when reporting on a V13 appliance.

2. MFA for the backup console should be enabled
suggestion: Best practice "MFA for the backup console should be enabled" has Not implemented status
*the V13 Appliance doesn't allow access without MFA so think this shouldn't be triggered when monitoring a V13 appliance. In our case we have V13 B&R dialed in SAML and corporate policy dictates o365 MFA anyway.

3. Password loss protection should be enabled
suggestion: Best practice "Password loss protection should be enabled" has Not implemented status
* We aren't using B&R Enterprise manager as we have only a single instance of B&R at this stage. There is a support note I think; https://www.veeam.com/kb4342 but it appears the only solution is to deploy Enterprise Manager - is this really the case? Reason why is we have saved the encryption key within our own password vault.

thanks
Ashley

[jorgedlcruz]

Hello Ashley,
Thanks for the detailed post. Do you have all these alarms triggered on a VSA? Let me review if this is a bug as I thought we had logic for platform.

Regarding MFA, you can today have accounts on VSA with MFA disabled so I would double check this as well, will report back.

Thank you

[jorgedlcruz]

Hello,
We have just confirmed that the Best practice "Backup services should be running under the LocalSystem account" has Not implemented status. it is a bug and it will be fixed in v13.0.1

For the rest of the alarms, it is recommended to have them implemented. For example the MFA one, that appears because you have users inside Veeam Backup & Replication Console, not Host Management, that have MFA disabled.

For Password loss protection, totally recommended, but in any case any of these alarms can be suppressed on the Veeam Backup & Replication Console to avoid Veeam ONE Alarms, and to improve Veeam ONE Threat Center score, etc.

Thank you!

[ashleyw]

Awesome. Thanks for the confirmation.
We have now deployed Veeam v13 enterprise manager and dialled it into SAML, so we'll be able to remediate some of those lwarnings next week.
Thanks again.