[Feature Request] make configuration restore work in V13

[rainer-k]

Dear Veeam developers,

currently I have a problem with configuration restore as part of disaster recovery,
should our Veeam B&R server be lost. I have to test and document this as part of
the compliance regulations in my company. The scenario here is that only tapes
with our data and the configuration backups are left in a fireproof safe.

What I did was setting up a new VM (Veeam B&R runs on a VM) and install Veeam from
the product ISO. After that, I got the configuration backup and the corresponding password
and tried to restore this. With V12, that worked fine. In V13, however, I get an error that the
users on the newly set up VM don't have access to the Veeam console. This is because they have
different internal IDs since it's a new Windows installation.

Veeam support (case 08177884) told me a solution where I run PowerShell under the ID "Local System"
and use the Veeam PowerShell module to re-enable the current user for access to the Veeam console.
However, this process is a little bit tricky to perform, I'd like to have this functionality
integrated into the configuration restore wizard, i.e. add the current user as legitimate
Veeam user. This should not be a security concern when I both have the configuration backup
file and the corresponding password.

Thanks a lot,
Rainer

[david.domask]

Hi Rainer,

Thank you for sharing the case number and sorry to hear about the challenge.

Will start with the good news: already have plans to adjust the configuration restore behavior in a future release to avoid needing to do the manual role assignment like you did in the case.

The issue is related to the issue documented in KB4898; while the KB is specific about MFA and Domain joined machines, the essence of the issues in the KB and your issue is a change of the SID between the two servers, as currently the configuration restore does not accommodate for this but v13 is checking such items during authentication now.

So the solution from the KB should work, alternatively, the workaround provided by Veeam Support is also valid, though requires the use of a 3rd party tool. Workaround documented here for those who choose it:

1. Download PsExec by Sysinternals from Microsoft to the new backup server
2. On new backup server, open an administrative powershell session and run PsExec.exe -i -s pwsh.exe
3. A new powershell window will appear; in the new window, verify you are running as SYSTEM: [System.Security.Principal.WindowsIdentity]::GetCurrent().Name (Must show as NT AUTHORITY\SYSTEM or your regional variant of SYSTEM account (e.g., NT-Autorität\System))
4. Import the Veeam PowerShell module: Import-Module Veeam.Backup.PowerShell
5. Add Backup Admin role to Administrator account or another local account you plan to use: Add-VBRUserRoleAssignment -Name "\Administrator" -Role "BackupAdmin

At this point you should be able to log in with the account you set in step 5; once logged in, you will want to edit the Users & Roles to remove references to the old local accounts and add new local accounts.

If you are unable to get success with either the KB steps or the workaround above, reach out to Veeam Support for assistance.