Feature Request: Script Execution through VMware VIX in VRO

[magcware]

Request

Case #08206873
We would like to request an enhancement to Veeam Recovery Orchestrator (VRO) to allow scripts to be executed directly inside the Guest OS of VMware virtual machines through **VMware Guest Operations / VIX.

Currently, VRO script execution relies on network-based mechanisms, including the use of the Windows administrative share:

\\<VM_IP>\ADMIN$

From a security and network segmentation perspective, we do not consider relying on `ADMIN$` to be the best option, as it requires SMB connectivity and access to administrative resources within the Guest OS.

Use Case: Data Labs

This limitation is particularly relevant in Data Lab environments.

During a recovery test, recovered virtual machines may initially start in an isolated network. In this scenario, VRO may not have direct network connectivity to the Guest OS.

As a result, the current script injection and execution mechanism using `ADMIN$` cannot be used because it requires SMB connectivity between VRO and the virtual machine.

For example, after a VM is recovered, we may need to execute a script to start services, perform additional configuration, or complete post-recovery actions. However, if the VM is running in an isolated network, VRO cannot access:

\\<VM_IP>\ADMIN$

This limits our ability to fully automate the recovery workflow in Data Labs.

Requested Functionality

We request that VRO provide **VMware Guest Operations / VIX as an alternative script execution method**, using VMware Tools to:

1. Transfer the script to the Guest OS.
2. Execute the script directly inside the virtual machine.
3. Retrieve the script exit code.
4. Report the execution result within the VRO workflow.

The VIX-based execution should use the communication path:

**VRO → vCenter/ESXi → VMware Tools → Guest OS**

This would eliminate the requirement for direct SMB connectivity between VRO and the virtual machine.

As a result, scripts could be executed even when the VM is temporarily running in an **isolated network** during a Data Lab recovery test.

Business and Security Justification

This enhancement would allow us to:

• Reduce dependency on SMB and `ADMIN$`.

• Avoid requiring additional firewall rules for SMB connectivity.

• Reduce exposure of administrative resources within the Guest OS.

• Execute scripts on VMs running in isolated networks.

• Fully automate recovery workflows in Data Lab environments.

• Leverage the existing **VMware Guest Operations / VIX

• capabilities provided by VMware Tools.

Ideally, VRO should allow the administrator to select the desired execution method:

• SMB / Network

• VMware Guest Operations / VIX

We believe this functionality would significantly improve the security, flexibility, and automation capabilities of Veeam Recovery Orchestrator, particularly for Disaster Recovery and Data Lab scenarios** where recovered VMs may initially be placed in isolated networks.