VB&R VMWare Script not working

[andyboy16]

I have a VMware job that backs up a VM, and under storage > advance settings > scripts tab I have a PowerShell script set to run after job completes. After the backup job is completed the status states that the script was executed successfully but in reality it does not run.
When I enabled the same script under application awareness "Post-thaw script", the script runs fine after the job completes.

The script is located on the Veeam B&R server C:\temp\Scripts\script.ps1
And the script that is running is below. It performs a delete action on a folder remotely to a VM that is being backed up:
Invoke-Command -ComputerName servername -ScriptBlock {
Get-ChildItem -Path F:\Folder\ -Recurse -Force | Where-Object {!$_.PSIsContainer} | Remove-Item
}

It works via Post-thaw script but does not work under regular backup job. Thoughts?

[PetrM]

Hi Albert,

I have 2 thoughts:
1. Pre-freeze/post-thaw scripts are executed directly on the guest and post-job scripts are started on the backup server. For example, does the script work if you run it manually on the backup server?
2. It might be related to the account being used for running post-job scripts, Veeam uses the Service Account under which the Veeam Backup Service is running and pre-freeze/post-thaw scripts are executed under the account specified in the Guest Processing step.

Anyway, the described behavior does not look normal, please open a support case and share ID over here for our reference.

Thanks!

[andyboy16]

yep, I can run the script directly from the backup server using the same service account running the backup. Also, the script location (for both post-thaw and backup job script) are stored on the c:\temp folder on the backup server.

[Andreas Neufert]

Does the script itself get executed?

Remove the code and add something local.
dir c:\ > c:\temp\1.log

will it get executed?

[andyboy16]

looks like the script ran locally...it created the 1.log file

[andyboy16]

Does the script itself get executed?

Remove the code and add something local.
dir c:\ > c:\temp\1.log

will it get executed?

looks like the script ran locally...it created the 1.log file

[Andreas Neufert]

Then let´s try something like this to execute the same on the remote server
Invoke-Command -ComputerName servername -ScriptBlock { dir c:\ > c:\temp\1.log}

[andyboy16]

that did not work either

[andyboy16]

Then let´s try something like this to execute the same on the remote server
Invoke-Command -ComputerName servername -ScriptBlock { dir c:\ > c:\temp\1.log}

created a new ps script and added this to the job. script ran after the post-post job but did not create the file on the remote system.

[Andreas Neufert]

Can you issue the command from a non administrative powershell prompt of this specific user the Veeam Backup Service runs on?

[albertwt]

Hi Albert,

What about executing the script under the Run as Administrator?

Was there any error message shown on the console perhaps?

[albertwt]

created a new ps script and added this to the job. script ran after the post-post job but did not create the file on the remote system.

Hi @andyboy16,

Check the credentials of the Service account you are using, it may not have the required privileges.

To run PowerShell on a remote box the credential used must be a local administrator if connecting via the default session configuration. This can be seen by running Get-PSSessionConfiguration (along with Remote Management Users). If you wish to allow non-administrators to use a remote machine you can create an alternate session configuration and allow different groups of users.

https://4sysops.com/archives/powershell ... or-rights/

Hope this helps,

[andyboy16]

Hi Albert,

What about executing the script under the Run as Administrator?

Was there any error message shown on the console perhaps?

I can run the command manually without using Run as Administrator in powershell.

[andyboy16]

Hi Albert,

What about executing the script under the Run as Administrator?

Was there any error message shown on the console perhaps?

I can run the command manually just fine without any issues without Run as Admin in powershell.

[andyboy16]

Hi @andyboy16,

Check the credentials of the Service account you are using, it may not have the required privileges.



https://4sysops.com/archives/powershell ... or-rights/

Hope this helps,

I service account is a local admin already from both source and target. And I can run the script manually just fine using the same service account as the backup job.

[Andreas Neufert]

Maybe try this and see what the output is in a logfile of your choice. It should give you some insights.
Invoke-Command -ComputerName servername -ScriptBlock {
Get-ChildItem -Path F:\Folder\ -Recurse -Force | Where-Object {!$_.PSIsContainer} | Remove-Item
} | out-file "c:\test.log"

[Andreas Neufert]

Local Admin to local Admin without domain trust of the same user might be possible from an interactive session but form a service started session might be blocked.
Maybe try to add the authentication to the invoke-command https://stackoverflow.com/questions/180 ... credential

[Andreas Neufert]

Check the target system Event Log (Security section maybe) to check if you see any errors or authentication issues.

[andyboy16]

Maybe try this and see what the output is in a logfile of your choice. It should give you some insights.
Invoke-Command -ComputerName servername -ScriptBlock {
Get-ChildItem -Path F:\Folder\ -Recurse -Force | Where-Object {!$_.PSIsContainer} | Remove-Item
} | out-file "c:\test.log"

Did that, output file was blank

[Andreas Neufert]

Can you please check my other tips and try those?

[andyboy16]

Yep, I added the invoke-command as well. Still no go. Looked a security logs and don't see any indication of any deny

Start-Sleep -Seconds 15 | Out-File C:\temp\Output.txt -Append
Invoke-Command -ComputerName nameofserver -ScriptBlock {
Get-ChildItem -Path f:\test\ -Recurse -Force | Where-Object {!$_.PSIsContainer} | Remove-Item
} | Out-File C:\temp\Output.txt -Append

Output.txt is blank

[Andreas Neufert]

I do not know now what to do here as no access to your system. Maybe Firewall is enabled?
Please reach out to our support to let them check logs or maybe one of our Field SEs can help.