Veeam Backup Enterprise

Manager

Version 11
User Guide
October, 2021
© 2021 Veeam Software.

All rights reserved. All trademarks are the property of their respective owners.

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or
translated into any language in any form by any means, without written permission from Veeam Software
(Veeam). The information contained in this document represents the current view of Veeam on the issue
discussed as of the date of publication and is subject to change without notice. Veeam shall not be liable for
technical or editorial errors or omissions contained herein. Veeam makes no warranties, express or implied, in
this document. Veeam may have patents, patent applications, trademark, copyright, or other intellectual
property rights covering the subject matter of this document. All other trademarks mentioned herein are the
property of their respective owners. Except as expressly provided in any written license agreement from Veeam,
the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other
intellectual property.

NOTE
Read the End User Software License Agreement before using the accompanying software programs. Using
any part of the software indicates that you accept the terms of the End User Software License Agreement.

2 | V eeam Backup Enterprise Manager | User Guide

Contents
CONTACTING VEEAM SOF TWARE ................................ ................................ ........................... 8
ABOUT THIS DOCUMENT ................................ ................................ ................................ ..... 9
ABOUT VEEAM BACKUP ENTERPRISE MANAGER ................................ ................................ ........ 10
What's New in Version 11 ...................................................................................................................... 11
What's New in Version 11a .......................................................................................................... 13
How Veeam Backup Enterprise Manager W orks .....................................................................................14
Enterprise Manager Components .......................................................................................................... 15
Veeam Backup Catalog......................................................................................................................... 17
Veeam Backup Search Capabilities ..............................................................................................18
File-Level Restore Capabilities ................................................................................................... 20
How Indexing W orks .................................................................................................................. 21
Indexing Data ........................................................................................................................... 22
Indexing Data Retention............................................................................................................ 27
SAML Authentication Support ............................................................................................................. 29
PLANNING AND P REPARATION ................................ ................................ ............................. 31
System Requirements ......................................................................................................................... 32
Required Permissions .......................................................................................................................... 35
Used Ports ......................................................................................................................................... 37
LICENSING ................................ ................................ ................................ ..................... 43
Installing License ................................................................................................................................ 44
Viewing License Details ....................................................................................................................... 45
Updating License ................................................................................................................................ 47
Revoking License ................................................................................................................................ 49
Managing Monthly Usage Rep orts ....................................................................................................... 50
Reviewing Monthly Usage Rep ort ............................................................................................... 51
Adjusting Monthly Usage Report ............................................................................................... 52
Downloading Monthly Usage Report .......................................................................................... 53
Submitting Monthly Usage Report ............................................................................................. 54
DEPLOY MENT ................................ ................................ ................................ ................. 56
Installing Veeam Back up Enterprise Manager ....................................................................................... 57
Before Y ou Begin ...................................................................................................................... 58
Step 1. Start Setup Wizard ......................................................................................................... 59
Step 2. Read and Accept License Agreement ..............................................................................60
Step 3. Provide License File ........................................................................................................61
Step 4. Review Components and Select Installation Folder.......................................................... 62
Step 5. Install Missing Software ................................................................................................. 63

3 | V eeam Backup Enterprise Manager | User Guide

 Step 6. Specify Installation Settings ........................................................................................... 64
Step 7. Specify Service Account Settings .................................................................................... 66
Step 8. Select Microsoft SQL Server ........................................................................................... 67
Step 9. Specify Service Ports ..................................................................................................... 68
Step 10. Specify File Locations ................................................................................................... 69
Step 11. Begin Installation ......................................................................................................... 70
Maintaining Veeam Backup Enterprise Manager .................................................................................... 71
Upgrading Veeam Backup E nterprise Ma nager ..................................................................................... 72
Uninstalling Veeam Backup Enterprise Manager ................................................................................... 74
Migrating Veeam Backup Enterprise Ma nager....................................................................................... 75
GETTING TO KNOW VEEAM BACKUP E NTERPRISE MANAGER................................ .......................... 76
Accessing Enterprise Manager Website ................................................................................................ 77
Veeam Backup Enterprise Ma nager UI .................................................................................................. 79
Viewing Operation Statistics ...................................................................................................... 82
CONFIGURING VEE AM BACKUP ENTERPRISE MANAGER................................ ................................ 85
Initial Config uration ............................................................................................................................ 86
Managing Backup Servers.................................................................................................................... 87
Collecting Data from Back up Servers ......................................................................................... 89
Reports on Backup Servers .........................................................................................................91
Audit Reports ........................................................................................................................... 93
Viewing vCenter Servers ..................................................................................................................... 95
Configuring Retention Settings for Index and History ........................................................................... 96
Configuring Security Settings .............................................................................................................. 99
Configuring Accounts a nd Roles ............................................................................................... 100
Configuring Backup Server Roles ............................................................................................. 108
Configuring SAML Authentication Settings ............................................................................... 109
Updating Security Certificate .....................................................................................................113
Configuring Notification Settings ........................................................................................................ 114
Email Server Settings ................................................................................................................115
Notifications on Job Results ..................................................................................................... 116
Notifications on Lab Requests ................................................................................................... 118
Notifications on Restore Operations .......................................................................................... 119
Notifications on Licensing ........................................................................................................120
Notifications on Key Management ............................................................................................ 122
Viewing Information Ab out Enterprise Manager .................................................................................. 123
Managing Languages ......................................................................................................................... 124
Language Files Overview .......................................................................................................... 125
Adding Languages ................................................................................................................... 126
MANAGING JOBS ................................ ................................ ................................ ........... 130

4 | V eeam Backup Enterprise Manager | User Guide

 Viewing Jobs ......................................................................................................................................131
Starting, Stopping and Retrying Jobs .................................................................................................. 132
Enabling and Disabling Jobs ............................................................................................................... 133
Editing Jobs ...................................................................................................................................... 134
Step 1. La unch W izard .............................................................................................................. 135
Step 2. Edit Job Name and Retention Settings ........................................................................... 136
Step 3. Edit List of VMs ............................................................................................................ 137
Step 4. Cha nge VM Processing Order ........................................................................................ 139
Step 5. Configure Guest Processing Settings............................................................................. 140
Step 6. Edit Job Schedule .........................................................................................................150
Creating Active Full Backups .............................................................................................................. 153
Cloning Jobs...................................................................................................................................... 154
Deleting Jobs .................................................................................................................................... 155
MANAGING CDP POLICIES ................................ ................................ ................................ . 156
Viewing Policies ................................................................................................................................. 157
Enabling and Disabling Policies .......................................................................................................... 158
Editing Policies .................................................................................................................................. 159
Step 1. La unch Edit Policy Wizard ............................................................................................. 160
Step 2. Edit P olicy Name a nd Description .................................................................................. 161
Step 3. Edit List of VMs ............................................................................................................ 162
Step 4. Edit P olicy Schedule ..................................................................................................... 165
Step 5. Configure Guest Processing Settings.............................................................................. 167
Deleting P olicies ................................................................................................................................ 174
SUPP ORT FOR VEEAM AGENTS ................................ ................................ ............................ 175
Guest File Browsing and 1-Click Restore .............................................................................................. 176
Preparing for File Browsing and Restore .................................................................................... 177
Browsing and Restore Procedures ............................................................................................. 179
Application Item Restore ................................................................................................................... 180
WORKING WITH FILE SHARES................................ ................................ .............................. 181
Viewing File Share Backups ................................................................................................................ 182
Browsing File Share Backups ..............................................................................................................184
Performing File Restore .....................................................................................................................186
Restoring Files to Original Location........................................................................................... 187
Downloading Files ...................................................................................................................189
Restoring Multiple Files ........................................................................................................... 192
Deleting File Share Back ups ...............................................................................................................194
WORKING WITH MACHINES ................................ ................................ ............................... 195
Viewing, Searching, Deleting Machines ...............................................................................................196
Performing Quick Back up ...................................................................................................................198

5 | V eeam Backup Enterprise Manager | User Guide

 Performing 1-Click Restore .................................................................................................................199
Performing Failover ...........................................................................................................................201
Performing Virtual Disk Restore ......................................................................................................... 205
Running Failover Plans ...................................................................................................................... 209
RESTORING GUEST OS FILES ................................ ................................ ............................... 211
Preparing for File Browsing and Searching .......................................................................................... 212
Performing Catalog Replication and Indexing ............................................................................ 213
Preparing for File Search and Restore ( non-Windows machines) ................................................. 214
Browsing Machine Backups for Guest OS Files ..................................................................................... 216
Searching Guest OS Files in Machine Backups ...................................................................................... 218
Performing 1-Click File Restore .......................................................................................................... 220
Restoring Files to Original Location........................................................................................... 221
Downloading Files to Local Machine .........................................................................................223
Restoring Multiple Files ...........................................................................................................225
Using Self-Service File Restore Portal to Restore Machine Guest Files ..................................................227
BACKUP AND RESTORE OF APPLICATION ITEMS ................................ ................................ ....... 230
Backup and Restore of Microsoft Exchange Items ................................................................................ 231
Preparing Application-Consistent Backup ..................................................................................232
Providing Access Rights ........................................................................................................... 234
Restore Procedure .................................................................................................................. 236
Backup and Restore of Microsoft SQL Server Databases ...................................................................... 238
Preparing Application-Consistent Backup ................................................................................. 239
Providing Access Rights ........................................................................................................... 242
Restore Procedure .................................................................................................................. 243
Backup and Restore of Oracle Databases............................................................................................ 249
Preparing Application-Consistent Backup ................................................................................. 250
Providing Access Rights ............................................................................................................253
Restore Procedure .................................................................................................................. 254
MANAGING E NCRYPTION KEYS ................................ ................................ ........................... 260
Generating E nterprise Ma nager Keyset ............................................................................................... 261
Activating Enterprise Manager Keyset ................................................................................................ 262
Specifying Retention Settings for E nterprise Ma nager Keyset ............................................................. 263
Exporting and Importing Enterprise Manager Keyset .......................................................................... 264
Deleting E nterprise Ma nager Keyset .................................................................................................. 266
Handling Password Recovery Requests .............................................................................................. 267
WORKING WITH VIRTUAL LAB REQUESTS................................ ................................ ............... 269
Creating Virtual Lab Requests............................................................................................................ 270
Approving Virtual Lab Requests ..........................................................................................................273
WORKING WITH VMWARE VCLOUD DIRECTOR ................................ ................................ ......... 274

6 | V eeam Backup Enterprise Manager | User Guide

 Managing Configurations for vCD Organizations ................................................................................. 276
Before Y ou Begin .....................................................................................................................277
Viewing Organization Configurations ....................................................................................... 279
Adding Organization Configuration .......................................................................................... 280
Editing Organization Configuration .......................................................................................... 283
Removing Organization Configuration ...................................................................................... 284
Exporting Configuration Report ............................................................................................... 285
Veeam Self -Service Backup P ortal ..................................................................................................... 286
Required Permissions .............................................................................................................. 287
Accessing Veeam Self-Service Backup Portal ............................................................................ 288
Working with Veeam Self-Service Backup Portal ........................................................................ 291
CONTROLLING BACKUP INFRASTRUCTURE WITH VSPHERE WEB CLIENT PLUG-IN ............................... 302
Getting Started................................................................................................................................. 303
Configuring Plug-in Settings ............................................................................................................. 306
Examining Backup Infrastructure ....................................................................................................... 308
Creating Restore Points with VeeamZIP and Quick Backup ...................................................................310
VSPHERE SELF-SERVICE BACKUP PORTAL ................................ ................................ .............. 314
Configuring Delegation Mode ............................................................................................................. 316
Managing Tenant Accounts ................................................................................................................ 318
Adding Tenant Account ............................................................................................................ 319
Editing Tenant Account ............................................................................................................323
Exporting List of Tenant Accounts ........................................................................................... 326
Removing Tenant Account........................................................................................................327
Using vSphere Self -Service Backup Portal .......................................................................................... 328
Viewing Self -Service Backup P ortal Statistics ........................................................................... 330
Managing Backup Jobs .............................................................................................................332
Managing VMs ........................................................................................................................ 334
Restoring Guest OS Files ..........................................................................................................337
Restoring Application Items ..................................................................................................... 338
APPENDIX A. LICENSE UPDATE SESSION DATA ................................ ................................ ........ 339
APPENDIX B. CONFIGURING AD FS FOR SAML AUTHE NTICATION ................................ ................... 340

7 | V eeam Backup Enterprise Manager | User Guide

Contacting Veeam Software
At Veeam Software we value feedback from our customers. It is important not only to help you quickly with your
technical issues, but it is our mission to listen to your input and build products that incorporate your
suggestions.

Customer Support
Should you have a technical concern, suggestion or question, visit the Veeam Customer Support Portal to open a
case, search our knowledge base, reference documentation, manage your license or obtain the latest product
release.

Company Contacts
For the most up-to-date information about company contacts and office locations, visit the Veeam Contacts
Webpage.

Online Support
If you have any questions about Veeam products, you can use the following resources:

• Full documentation set: veeam.com/documentation-guides-datasheets.html

• Veeam R&D Forums: forums.veeam.com

8 | V eeam Backup Enterprise Manager | User Guide

About This Document
This guide is intended for IT managers, virtual infrastructure administrators, and other personnel responsible for
the product deployment and operation.

This document describes the features included in the Veeam Backup Enterprise Manager. It also provides usage
examples and gives step-by-step instructions that will help you better understand how to install the Veeam
Backup Enterprise Manager and monitor your Veeam Backup infrastructure, services and jobs.

Intended Audience
The document is intended for backup administrators and other IT professionals who plan to deploy and use
Veeam Backup Enterprise Manager. This guide assumes that you have a good understanding of Veeam Backup &
Replication and VMware vSphere.

9 | V eeam Backup Enterprise Manager | User Guide

About Veeam Backup Enterprise
Manager
Veeam Backup Enterprise Manager (Enterprise Manager) is a management and reporting component that allows
you to manage multiple Veeam Backup & Replication installations from a single web console. Veeam Backup
Enterprise Manager helps you optimize performance in remote office/branch office (ROBO) and large-scale
deployments and maintain a view of your entire virtual environment.

The distributed architecture of Veeam Backup & Replication allows you to create a custom backup infrastructure
that meets your company needs. Veeam Backup Enterprise Manager manages backup and replication according
to your administrative, business and security requirements and restrictions. With a number of
Veeam Backup & Replication instances installed on different servers, Veeam Back up Enterprise Manager acts as
a single management point. It allows you to control license distribution, manage backup jobs across the backup
infrastructure, analyze operation statistics of Veeam backup servers, perform restore operations, and so on.

In particular, with Veeam Backup Enterprise Manager you can:

• Manage jobs across multiple Veeam backup servers.

• View on-going reporting data for all jobs running on these servers, set up email notifications to get
information on the status of all jobs.

• Search for machines, file shares, and guest files in backups and replicas.

• Perform recovery operations for VMs and physical machines, including 1-Click restore, 1-click guest OS file
restore and application items restore (for Microsoft Exchange mailboxes , Microsoft SQL Server databases
and Oracle databases); perform 1-Click restore for file share backups.

• Centrally manage and update licenses to ensure compliance.

• Delegate permissions for restore operations to personnel in charge.

• Manage VMware vCloud Director organizations and support their administrators with the Veeam Self -
Service Backup Portal.

• Manage vSphere user accounts and support them with the vSphere Self-Service Backup Portal.

• Install vSphere Web Client plug-in on vCenter servers.

• Implement data encryption and decryption processes for the Veeam solutions.

• Provide operation automation with Veeam Backup Enterprise Manager REST API.

10 | V eeam Backup Enterprise Manager | User Guide

What's New in Version 11
Veeam Backup Enterprise Manager 11 introduces the following new features and enhancements.

Continuous Data Protection (CDP)

Now Veeam Backup Enterprise Manager lets you manage CDP policies that have been created on backup servers
added to the Enterprise Manager infrastructure. Depending on the account role, you can view, edit, enab le and
disable CDP policies. For replicated VMs, you can start failover. For more information, see Managing CDP
Policies and Performing Failover.

VMware vCloud Director Replication

In Veeam Backup Enterprise Manager, you can manage vCD replication jobs as well as start failover for
replicated vApps. For more information, see Managing Jobs and Performing Failover.

Multiple Repositories for vCD Organizations

Now you can add multiple repositories for each vCD organization. It allows tenants to select which backup
repository to use for their backup jobs. For more information, see Managing Configurations for vCD
Organizations.

Veeam Plug-in for VMware vCloud Director

Veeam Plug-in for VMware vCloud Director allows members of vCD organizations to manage their vCD jobs and
restore VMs, files and application items in the native vCD interface. Users get access to the por tal features by
logging in to the vCloud Director Service Provider Tenant Portal under their vCD credentials.

Localization
Veeam Backup Enterprise Manager 11 is available in the following languages:

• Chinese (Simplified, PRC)

• English

• French

• German

• Italian

• Japanese

• Spanish

You can select a preferred language on the login page. If the language you need is not available, you can add it.
Localization is based on the GNU gettext tools, and English strings are used as message IDs. For more
information, see Managing Languages.

11 | V eeam Backup Enterprise Manager | User Guide

SAML Authentication for vSphere Self-Service Backup Portal
In version 11, you can configure SAML authentication for vSphere Self-Service Backup Portal. Both the External
User and External Group are supported. In case of SAML authentication, you can configure the delegation mode
based on vSphere tags only. For more information, see SAML Authentication Support.

12 | V eeam Backup Enterprise Manager | User Guide

What's New in Version 11a
Veeam Backup Enterprise Manager 11a (build 11.0.1.1261) introduces the following new features and
enhancements.

Licensing
Now Veeam Backup Enterprise Manager can apply its license to backup servers that have
Veeam Backup & Replication version 10 or later installed.

Veeam Self-Service Backup Portal

• Starting from Veeam Backup Enterprise Manager 11a, you can add vCD organization configurations for
multiple vCD servers. All vCD servers must be added to the backup infrastructure of the same b ackup
server. For more information, see Adding Organization Configuration.

• In version 11, you can select a display language for Veeam Self-Service Backup Portal when you access the
portal by its URL. In version 11a, the portal is available in the selected language when you open it from the
vCD environment as well. For more information, see Accessing Veeam Self-Service Backup Portal.

13 | V eeam Backup Enterprise Manager | User Guide

How Veeam Backup Enterprise Manager
Works
Veeam Backup Enterprise Manager aggregates data from multiple Veeam backup servers, as well as from the
underlying VMware vCenter servers.

1. Veeam Backup Enterprise Manager retrieves data from the managed Veeam backup servers using a data
collection job. This job gets information about the backup and replication jobs, processed machines, and
other data from the configuration databases used by Veeam backup servers.

2. Collected data is stored to the Veeam Backup Enterprise Manager database (hosted on SQL Server) and
can be accessed by multiple users from the web interface. This web interface also allows for modifying job
settings, license management, installing Veeam plug-in on vCenter server, and other tasks.

3. When a user modifies a backup job using Veeam Backup Enterprise Manager, these changes are
communicated to the backup server that manages the job and stored in its configuration database.

If you have a Veeam Agent integrated with Veeam Backup & Replication, you can use Veeam Backup Enterprise
Manager to browse and restore guest OS files and application items from a backup stored in a Veeam backup
repository. These processes involve appropriate backup job setup, as well as mount and data transfer
operations. For more information, see Support for Veeam Agents.

14 | V eeam Backup Enterprise Manager | User Guide

Enterprise Manager Components
Veeam Backup Enterprise Manager incorporates the following services and components:

• Veeam Backup Enterprise Manager Service coordinates all operations performed by Veeam Backup
Enterprise Manager such as backup, replication, recovery verification and restore tasks. The Veeam Backup
Enterprise Manager Service runs under the Local System account or an account that has the Local
Administrator permissions on the backup server. This service is installed and started automatically on the
local Windows server.

• VeeamBackup and VeeamBackup site (IIS extension) application pools are created and displayed in IIS
Manager. These web applications are deployed on the local IIS web server.

• Web interfaces used to access Veeam Backup Enterprise Manager from different infrastructures:

o Ma in web interface is used to browse and perform operations with jobs, backups and machines, to
configure Enterprise Manager functionality and control infrastructure. For more information, see
Getting to Know Veeam Backup Enterprise Manager.

o Veeam Self-Service File Restore Portal that allows administrators to restore files or folders from the
guest OS of a virtual or physical machine. For more information, see Using Self-Service Portal to
Restore Machine Guest Files.

o Veeam Self-Service Backup Portal and Veeam Plug-in for VMware vCloud Director that provide
members of vCloud Director organizations with a UI for self-service operations on machine protection.
For more information, see Veeam Self-Service Backup Portal.

o VMwa re vSphere Self-Service Backup Portal that provides Service Providers with a UI for managing
access permissions and vSphere quotas for their customers. For more information, see vSphere Self-
Service Backup Portal.

NOTE

Veeam Self-Service File Restore Portal, Veeam Self-Service Backup Portal, Veeam Plug-in for VMware
vCloud Director and VMware vSphere Self-Service Backup Portal features are available in the Enterprise
Plus edition of Veeam Backup & Replication.

• SQL Server database is used to store configuration and performance data. For more information, see
Deployment.

• Veeam Backup Catalog is used for guest OS file indexing, index data retention and its synchronization with
the information on a Veeam backup server. It comprises a Windows service named Veeam Guest Catalog
also installed on the Veeam Backup Enterprise Manager server. For more information, see Veeam Backup
Catalog.

• Veeam Backup Search is an optional component used for guest OS file indexing of protected machines.
This component is included in the installation package to provide backward compatibility with older
existing deployments. For a new deployment, there is no need to install Veea m Backup Search, since all
operations related to guest OS file indexing and search will be performed by Veeam's proprietary built -in
indexing engine. For more information, see Veeam Backup Search Capabilities.

• Veeam Cloud Connect P ortal is an optional component that comprises the Veeam Cloud Connect Portal
website (IIS extension) and UI. It is intended for the tenants of Service Providers. For more information,
see the Veeam Cloud Connect Guide.

15 | V eeam Backup Enterprise Manager | User Guide

 • Veeam Backup Enterprise Manager REST API lets developers communicate with Veeam Backup Enterprise
Manager to query information about Veeam Backup Enterprise Manager objects and perform basic
operations with them using HTTP and HTTPS protocols and the principles of REST. For more information,
see the Veeam Backup Enterprise Manager REST API Reference.

• Veeam VMware vSphere Web Client plug-in allows vSphere administrators to manage backup
infrastructure of the virtual environment. For more information, see the Controlling Backup Infrastructure
with vSphere Web Client Plug-in.

16 | V eeam Backup Enterprise Manager | User Guide

Veeam Backup Catalog
Veeam Backup Catalog is a feature that stands for VM guest OS file indexing. Veeam Backup Catalog comprises
Veeam Guest Catalog services that run on the following servers in the backup infrastructure: Veeam backup
server and Veeam Backup Enterprise Manager server.

• Veeam Guest Catalog service on the Veeam backup server works as a local catalog service. It collects index
data for backup jobs on this specific Veeam backup server and stores this data locally in the Veeam Backup
Catalog folder.

• Veeam Guest Catalog service on Veeam Backup Enterprise Manager works as a federal catalog service. It
communicates with Veeam Guest Catalog services on Veeam backup servers connected to Veeam Backup
Enterprise Manager and performs the following tasks:

o Replicates index data from Veeam backup servers to create a federal catalog

o Maintains index data retention

o Lets you search for machine guest OS files in backup files

17 | V eeam Backup Enterprise Manager | User Guide

Veeam Backup Search Capabilities
Veeam Backup Enterprise Manager allows you to browse the guest OS file system in a machine backup, search
for guest OS files and restore necessary files. These operations are also supported for the backups of physical
machines created by Veeam Agents (Server edition is needed). For more information on Veeam Ag ents, see
Support for Veeam Agents.

NOTE

While browsing and search possibilities are available to all Veeam Backup Enterprise Manager users, file
restore operations can be performed by authorized users only.

Guest OS Files Indexing

By default, Veeam uses its proprietary file indexing mechanism to index machine guest OS files and facilitate
search for files in backups with Veeam Backup Enterprise Manager. For more information on how to enable
guest OS file system indexing in the backup job settings, see the Application-Aware Processing section of the
Veeam Backup & Replication User Guide.

1. When a backup job with guest OS files indexing enabled is run, Veeam Backup & Replication creates a
catalog (or index) of the machine guest OS files and stores index files on the Veeam backup server.

2. After that, the Veeam Guest Catalog Service performs index replication — it aggregates index data for all
machine image backups from managed backup servers. This consolidated index is stored on the Veeam
Backup Enterprise Manager server in the C:\VBRCatalog\Index\ folder and is used for search queries.

3. Then you can browse or search through machine guest OS files using the search criteria you need. Once
you find a necessary file, you can use the File-Level Restore feature to recover the file from the machine
backup. For more information, see How Indexing Works.

Importing Indexed Guest OS Files

When you move machine backups to an external storage device or tape, indexing data for such machines
remains in the catalog. It means that these machines still appear in search results. You can use the Imp ort
feature to import the backup to the Veeam Backup & Replication backup server, and then recover the file.

However, consider that by default, backup repository is the primary destination for the search. This means, in
particular, that if a backup (with indexed guest) is stored in both locations — repository and tape — then
Enterprise Manager search results will only include files from the backup stored on the repository. Files from
tape-archived backup will appear in search results only if not found on the repository . For more information, see
Configuring Retention Settings.

NOTE

This capability is supported in the Enterprise and Enterprise Plus editions of Veeam Backup & Replication.

Searching for Physical Server Guest OS Files

If your Veeam Backup & Replication server is integrated with Veeam Agent, you can set up the integrated Veeam
Agent to create an index (catalog) of files and folders on the physical machine OS. This allows you to search for
backed-up files and perform 1-Click restore of server files in Veeam Backup Enterprise Manager; all operations
are similar to those performed for virtual machine backup.

For more information, see the following sections:

• Guest File Browsing and 1-Click Restore section of this guide

18 | V eeam Backup Enterprise Manager | User Guide

 • Guest Processing section of the Veeam Agent for Windows User Guide

• File System Indexing section of the Veeam Agent for Linux User Guide

• File System Indexing section of the Veeam Agent for Oracle Solaris User Guide

• File System Indexing section of the Veeam Agent for IBM AIX User Guide

19 | V eeam Backup Enterprise Manager | User Guide

File-Level Restore Capabilities
When you restore files from the restore point created for a virtual or physical machine with guest OS file
indexing enabled , Veeam uses the following workflow:

1. To provide for browsing and search, Veeam uses index data to represent the file system of the guest OS.

2. If you then select to download the necessary files, Veeam Backup & Replication will mount virtual or
physical machine disks (from the restore point in repository) on the Veeam backup server and then copy
these files from the backup server to the target location.

3. If you select to restore files to the original location, an additional mount point will be created on the
mount server associated with the backup repository storing the backup file. During restore, machine data
will flow from repository to target, keeping the machine traffic in one site and reducing load on the
network.

4. After you download or restore the necessary files, and finish the restore session, the machine (or server)
disks will be unmounted.

When you restore files from the restore point that was created without guest OS file indexing , Veeam Backup &
Replication uses the following workflow:

1. To provide for browsing, disks of the virtual machine or physical server from the ba ckup file are mounted
to Veeam backup server.

2. If you then select to download the necessary files, Veeam will copy these files from the backup server to
the destination location, using this mount point.

3. If you select to restore files from the backup to the original location on the production machine, an
additional mount point will be created on the mount server associated with the backup repository storing
the backup file.

4. If you restore machine files from a VM replica, a single mount point for all these operations (browsing,
download, restore to original location) will be created on the Veeam backup server.

5. After you download or restore the necessary files, and finish the restore session, the machine (or server)
disks will be unmounted.

20 | V eeam Backup Enterprise Manager | User Guide

How Indexing Works
When you run a backup job with the file indexing option enabled, Veeam Backup & Replication indexes the
machine file system, collects indexing data and writes it to the GuestIndexData.zip file. The GuestIndexData.zip
file is first stored in a temporary folder on the Veeam backup server.

As soon as the backup job completes, Veeam Backup & Replication notifies the local Veeam Backup Catalog
service. The service saves indexing data in the Veeam Backup Catalog folder on the Veeam backup server.
During the next catalog replication session started on Veeam Backup Enterprise Manager, indexing data from
the Veeam backup server is replicated to the Veeam Backup Catalog on Veeam Backup Enterprise Manager
server. By federating indexing data from all connected Veeam backup servers, the Veeam Backup Catalog
service on Veeam Backup Enterprise Manager creates a global catalog for the whole backup infrastructure.

Veeam Backup & Replication supports file-level restore not only for machines included in guest catalog but also
for the machines that are not indexed. Indexing may be disabled at the time of restore point creation, or
indexing operation may fail. In this case, the restore point of a Windows machine is mounted to the backup
server that manages the job, and the restore point of a non-Windows machine is mounted to the helper
appliance.

Then a user will be able to locate the necessary files and folders and perform restore operation. To learn more
about mount operation, refer to the Veeam Backup & Replication User Guide and to the Search and Restore of
Machine Guest Files section of this guide.

21 | V eeam Backup Enterprise Manager | User Guide

Indexing Data
Veeam Backup & Replication stores indexing data in the Veeam Backup Catalog folder. By default, the Veeam
Backup Catalog is located in the C:\VBRCatalog folder on the Veeam backup server and on Veeam Backup
Enterprise Manager.

Veeam Backup Catalog comprises the following data:

• Machine index

• Session index

Machine Index
Machine index reproduces the structure of files and folders on the machine guest OS.
Veeam Backup & Replication uses the file index to search for guest OS files within machine backups.

For every machine whose file system has been indexed, there is a dedicated folder that contains indexing data
for all restore points available for the machine.

Session Index
Veeam Backup Catalog keeps information for every backup job session. Session indexing data describes which
machine restore points correspond with a specific backup job session and what sets of files are required to
restore a machine to a specific point in time.

22 | V eeam Backup Enterprise Manager | User Guide

Session indexing files vary for incremental and reverse incremental backup chains:

• For incremental backup chains, a session indexing file contains information about only one restore point —
the restore point that is created with this backup job session. Additionally, it contains information about a
set of files that is required to restore a machine to this point in time. For example, if a backup chain
contains 5 restore points, the 5th session indexing file will contain information about the 5th restore point
and a group of 5 files that are required to restore the machine to this point in time.

BackupServer=BACKUP01
JobName=srv04
SessionDateUtc=05/13/2014 08:05:57.081
####################################################
# OIBS
oib0.VmName=srv04
oib0.BackupTimeUtc=05/13/2014 08:02:04.988
oib0.OibUID=f81f790c-103e-4351-81a4-e4ec8a8c290c
oib0.Platform=EVmware
oib0.Group=grp0
####################################################
# BACKUP FILE GROUPS
grp0.file0.Server=BACKUP01
grp0.file0.Path=c:\backup\srv04\srv042014-05-13T010101.vib
grp0.file0.ModifyDateUtc=05/13/2014 08:04:10.293
grp0.file1.Server=BACKUP01
grp0.file1.Path=c:\backup\srv04\srv042014-05-13T004536.vib
grp0.file1.ModifyDateUtc=05/13/2014 07:47:52.077
grp0.file2.Server=BACKUP01
grp0.file2.Path=c:\backup\srv04\srv042014-05-13T000053.vib
grp0.file2.ModifyDateUtc=05/13/2014 07:04:24.38
grp0.file3.Server=BACKUP01
grp0.file3.Path=c:\backup\srv04\srv042014-05-12T230102.vib
grp0.file3.ModifyDateUtc=05/13/2014 06:04:25.003
grp0.file4.Server=BACKUP01
grp0.file4.Path=c:\backup\srv04\srv042014-05-12T220051.vib
grp0.file4.ModifyDateUtc=05/13/2014 05:03:53.817
grp0.file5.Server=BACKUP01
grp0.file5.Path=c:\backup\srv04\srv042014-05-12T210105.vbk
grp0.file5.ModifyDateUtc=05/13/2014 04:07:55.047

• For reverse incremental backup chains, a session indexing file contains information about all restore points
engaged in the backup job session. In a reverse incremental chain, the last restore point is always a full
backup. To produce a full backup and calculate incremental changes, Veeam Backup & Replication needs
to address all points in the job. For this reason, the session indexing file refers not only to the restore
point created with the backup job session, but also to all restore p oints preceding it. Additionally, a
session indexing file describes groups of files that are required to restore a machine to all possible restore
points. For every restore point, there is a separate group of files.

For example, if you have a reverse incremental chain of 3 restore points, the session indexing file for the
last backup job session will contain information about 3 restore points and will describe three groups of
files:

o Group 0 will list restore points that are required to restore the machine to the 1st, the earliest restore
point.

o Group 1 will list restore points that are required to restore the machine to the 2nd restore point.

23 | V eeam Backup Enterprise Manager | User Guide

 o Group 2 will list restore points that are required to restore the machine to the 3rd, the latest restore
point.

BackupServer=SRV02
JobName=srv01_reversed
SessionDateUtc=05/14/2014 11:20:18.952
####################################################
# OIBS
oib0.VmName=srv01
oib0.BackupTimeUtc=05/14/2014 10:56:55.993
oib0.OibUID=47c62e82-3066-478c-8272-1fb65a47d601
oib0.Platform=EVmware
oib0.Group=grp1
oib1.VmName=srv01
oib1.BackupTimeUtc=05/14/2014 11:02:20.15
oib1.OibUID=d39f4a3c-2b5b-415a-ae0d-e9acc49f63a0
oib1.Platform=EVmware
oib1.Group=grp2
oib2.VmName=srv01
oib2.BackupTimeUtc=05/14/2014 11:16:52.779
oib2.OibUID=1f3c31bf-9541-46ac-9826-62ecfd76a291
oib2.Platform=EVmware
oib2.Group=grp3
####################################################
# BACKUP FILE GROUPS
grp0.file0.Server=BACKUP
grp0.file0.Path=c:\backup\srv01_reversed\srv01_reversed2014-05-14T035606.vrb
grp0.file0.ModifyDateUtc=05/14/2014 10:56:55.993
grp0.file1.Server=BACKUP
grp0.file1.Path=c:\backup\srv01_reversed\srv01_reversed2014-05-14T040137.vrb
grp0.file1.ModifyDateUtc=05/14/2014 11:18:14.43
grp0.file2.Server=BACKUP
grp0.file2.Path=c:\backup\srv01_reversed\srv01_reversed2014-05-14T041612.vbk
grp0.file2.ModifyDateUtc=05/14/2014 11:18:45.973
grp1.file0.Server=BACKUP
grp1.file0.Path=c:\backup\srv01_reversed\srv01_reversed2014-05-14T040137.vrb
grp1.file0.ModifyDateUtc=05/14/2014 11:18:14.43
grp1.file1.Server=BACKUP
grp1.file1.Path=c:\backup\srv01_reversed\srv01_reversed2014-05-14T041612.vbk
grp1.file1.ModifyDateUtc=05/14/2014 11:18:45.973
grp2.file0.Server=BACKUP
grp2.file0.Path=c:\backup\srv01_reversed\srv01_reversed2014-05-14T041612.vbk
grp2.file0.ModifyDateUtc=05/14/2014 11:18:45.973
BSessionVersion=5

A full backup file “moves forward” with every new backup job run, and Veeam Backup & Replication updates
groups of files. This helps maintain valid groups of files required to restore a machine to a necessary point in
time.

The session indexing files maintain groups of files for all restore points that have ever existed in the backup
chain. This behavior lets you search and restore machine guest OS files in archived backups.

24 | V eeam Backup Enterprise Manager | User Guide

When a backup is archived to tape or to a secondary backup repository, you can still browse the machine file
system to this point in time using historical indexing data. Once you find a necessary file, Veeam Backup
Enterprise Manager uses the session indexing file to inform you what group of files is required to restore the
machine to the selected point in time.

Current and Historical Indexing Data

Indexing data structures in Veeam Backup Catalog are divided into two groups:

• Current indexing data stores information for valid restore points that are currently available in the backup
chain in the backup repository. For example, if the retention policy for a backup job is set to 14, Veeam
Backup Catalog will contain indexing data for 14 restore points and 14 backup job sess ions.

• Historical indexing data stores information for obsolete restore points: the points that were removed from
the backup chain. When you run a backup job to create a new restore point, the earliest restore point is
marked as obsolete and removed from the backup chain. Indexing data for this restore point in the Veeam
Backup Catalog is not removed. Instead, it is marked as historical.

Historical indexing data helps the user accomplish file search in backup files that were archived to tape or
to a secondary backup repository.

25 | V eeam Backup Enterprise Manager | User Guide

By default, Veeam Backup Enterprise Manager keeps historical indexing data for 3 months. To change this value,
navigate to the Configuration > Settings > Session History > Guest file system catalog section in Veeam Backup
Enterprise Manager.

26 | V eeam Backup Enterprise Manager | User Guide

Indexing Data Retention
The retention policy for Veeam Backup Catalog helps you maintain the necessary amount of indexing data on
the Veeam Backup Enterprise Manager server.

The retention policy for Veeam Backup Catalog is controlled by two values:

• Retention policy for a backup job on the Veeam backup server: the number of restore points in the backup
chain

• Retention period for indexing data in Veeam Backup Enterprise Manager

The retention period is calculated differently for backup chains created with different backup methods:

• Retention for forward incremental backup chains

• Retention for reverse incremental backup chains

Retention for Forward Incremental Backups

The retention policy for the forward incremental backup chain is calculated by the following formula:

Retention period = MAX (Catalog Retention, X)

where:

• Catalog Retention is the retention period specified in Veeam Backup Enterprise Manager.

• X is the amount of time for which restore points are kept by a backup job.
For example, the retention policy settings are specified in the following manner:

• The retention policy for a backup job is set to 5 points. The backup job is run daily.

• The retention period in Veeam Backup Enterprise Manager is set to 1 month, or 30 days.

In this case, Veeam Backup Enterprise Manager will retain indexing data for 30 days, because this value is
greater than the number of restore points in the job.

Retention for Reverse Incremental Backups

For reverse incremental backup chains, Veeam Backup Enterprise Manager keeps more indexing data in Veeam
Backup Catalog than it may seem to be required according to the retention policy. This happens due to
backward nature of reverse incremental backups.

When Veeam Backup Enterprise Manager deletes indexing data by retention, it removes the whole set of files:
machine indexing data and session indexing data. Before removing indexing data for a specific machine restore
point, Veeam Backup Enterprise Manager makes sure that this restore point is not referenced by any of backup
job sessions:

• If no relations are detected, indexing data for this machine restore point is removed from Veeam Backup
Catalog.

• If the machine restore point is referenced by any backup job session, indexing data for this machine
restore point remains in Veeam Backup Catalog.

27 | V eeam Backup Enterprise Manager | User Guide

However, in reverse incremental chains, session indexing data references the machine restore point that was
created in the backup job sessions, and restore points preceding it. To learn more, see Session Index.

For this reason, Veeam Backup Enterprise Manager retains more indexing data for reverse incremental chains.
The retention period is calculated by the following formula:

Retention period = MAX (Catalog Retention, X) + X

where:

• Catalog Retention is the retention period specified in Veeam Backup Enterprise Manager.

• X is the amount of time for which restore points are kept by a backup job.
For example, the retention policy settings are specified in the following manner:

• The retention policy for the backup job is set to 3 points. The backup job is run daily.

• The retention period in Veeam Backup Enterprise Manager is set to 1 month, or 30 days.

In this case, Veeam Backup Enterprise Manager will retain in Veeam Backup Catalog indexing data for 30 days
plus indexing data for 3 restore points in the backup chain.

IMP ORTANT

The longer the backup chain, the more indexing data is stored in Veeam Backup Catalog.

In case of long backup chains, indexing data may take a lot of space on the Veeam Backup Enterprise
Manager server. To overcome this situation, you can adjust the retention policy scheme or provide enough
space for indexing data in Veeam Backup Catalog on Veeam Backup Enterprise Manager.

28 | V eeam Backup Enterprise Manager | User Guide

SAML Authentication Support
Veeam Backup Enterprise Manager supports single sign-on authentication based on the SAML 2.0 protocol.
Enterprise organizations who use a single sign-on (SSO) service in their IT infrastructure can extend single sign-
on capabilities to Veeam Backup Enterprise Manager. Once a user of the organization is logged in to the single
sign-on service, the user can access Veeam Backup Enterprise Manager without the need to provide their
credentials.

You can enable SSO for the following Veeam Backup Enterprise Manager components:

• Veeam Backup Enterprise Manager website

• vSphere Self-Service Backup Portal

SAML authentication scenario in Veeam Backup Enterprise Manager comprises the following parties:

• User that logs in to the Veeam Backup Enterprise Manager website or vSphere Self -Service Backup Portal.

• Service provider (SP) — an application accessed by the user. In the Veeam backup infrastructure, the
service provider is the Veeam Backup Enterprise Manager website or vSphere Self -Service Backup Portal.

• Identity provider (IdP) — an external service (hosted on premises or in the public cloud) that facilitates
SSO. The IdP keeps user identity data in a user store (or attribute store). Upon requests from the SP, the
IdP issues SAML authentication assertions, that is, identifies the user and provides the SP with required
information about the user.

Veeam Backup Enterprise Manager supports identity providers that support the SAML 2.0 protocol, for
example, Active Directory Federation Services (AD FS), Azure Active Directory (Azure AD), Okta, Auth0,
Keycloak and so on.

The SP and IdP exchange information in the XML format in accordance with the SAML V2.0 Standard. The
Enterprise Manager administrator can specify what information is required from the IdP to set up SAML
authentication in Enterprise Manager and how SAML requests and responses are sent.

How It Works
In Veeam Backup Enterprise Manager, SAML authentication is performed in the following way:

1. The user accesses the website under an account of the External type. The account must be registered in
advance in Enterprise Manager by the Enterprise Manager administrator.

2. Veeam Backup Enterprise Manager redirects a SAML authentication request to the IdP.

3. If the user has not previously logged in with the single sign-on service of the IdP, the IdP redirects the
user to the URL of the single sign-on webpage.

Alternatively, if the user is already logged in with the single sign-on service, the user proceeds directly to
the step 6.

4. If the user has not previously logged in with the single sign-on service, the user specifies the password of
their account on the single sign-on webpage.

5. The IdP issues a SAML assertion and redirects it to Veeam Backup Enterprise Manager in the SAML
response. The SAML assertion must meet the following requirements:

o Contain a User Principal Name (UPN) of the user in the <NameID> element of the SAML response.

o Specify that the UPN type is Persistent.

29 | V eeam Backup Enterprise Manager | User Guide

 6. The user gains access to the website and can perform operations according to the role and restore scope
specified for the user account.

Getting Started
To set up SAML authentication, the Enterprise Manager administrator must complete the following tasks in
Enterprise Manager:

1. Obtain SAML metadata from the IdP and import this metadata to Veeam Backup Enterprise Manager. The
IdP metadata includes the IdP entity ID, login URL, SAML binding and public key certificate that will be
used to validate authentication assertions sent by the IdP. For more information, see Specifying Identity
Provider Settings.

2. [Optional] If you want to use a digital certificate to encrypt and sign SP SAML requests, specify certificate
settings. For more information, see Selecting SP Certificate.

3. [Optional] Specify advanced settings for SAML authentication. These settings define how the SP and IdP
will exchange SAML information. You may want to adjust the settings to strengthen SAML information
exchange between the SP and IdP. For more information, see Specifying Advanced SAML Authentication
Settings.

4. Export SP SAML metadata in Veeam Backup Enterprise Manager and pass this metadata to the IdP. The SP
metadata includes the SP entity ID, assertion consumer URL and public key certificate that will be used to
encrypt SAML responses sent by the IdP. For more information, see Obtaining Service Provider Settings.

5. Create user accounts. To provide users of a SSO service with access to the Veeam Backup Enterprise
Manager website or vSphere Self-Service Backup Portal, the administrator must create for these users
accounts of the External User or External Group type. For more information, see Managing Accounts and
Roles and Managing Tenant Accounts.

On the IdP side, the IdP must configure trust relationship with Veeam Backup Enterprise Manager and configure
rules that define what information to provide to the SP. Depending on the IdP, these rules may be configured in
the form of claims, attribute statements and so on. For an example of how to perform this task in AD FS, see
Appendix B. Configuring AD FS for SAML Authentication.

30 | V eeam Backup Enterprise Manager | User Guide

Planning and Preparation
Before you install Veeam Backup Enterprise Manager, you must check that the virtual environment and
machines that you plan to use as backup infrastructure components meet the product hardwa re
recommendations and system requirements.

31 | V eeam Backup Enterprise Manager | User Guide

System Requirements
Make sure that servers that you plan to use as Veeam Backup Enterprise Manager infrastructure components
meet system requirements listed below:

• Veeam Backup Enterprise Manager

• Veeam Cloud Connect Portal

• VMware vCloud Director

Veeam Backup Enterprise Manager

It is recommended to install the same product version on the Veeam Backup Enterprise Manager server and
Veeam backup servers.

Sp ecification Requirement

• CPU: x86-64 processor.

Ha rdware
• Memory: 4 GB RAM (minimum recommended).
• Hard disk space: 2 GB on the system disk (required to extract all
components from the setup package during the product installation).
• Network: 1 Gbps or faster connection to Veeam Backup & Replication
servers.

OS 64-bit versions of the following operating systems are supported:

• Microsoft Windows Server 20221

• Microsoft Windows Server Semi-Annual Channel (from version 1803 to
version 20H2)
• Microsoft Windows Server 2019
• Microsoft Windows Server 2016
• Microsoft Windows Server 2012 R2
• Microsoft Windows Server 2012
• Microsoft Windows 2008 R2 SP1
• Microsoft Windows 10, version 21H11
• Microsoft Windows 10 (from version 1803 to version 20H2)
• Microsoft Windows 8.1
• Microsoft Windows 7 SP1
1
This version is supported starting from Veeam Backup Enterprise Manager 11a (build
11.0.1.1261).

32 | V eeam Backup Enterprise Manager | User Guide

 Sp ecification Requirement

SQL Server Local or remote installation of the following versions of Microsoft SQL Server
(both Full and Express Editions are supported):

• Microsoft SQL Server 2019

• Microsoft SQL Server 2017
• Microsoft SQL Server 2016 (Microsoft SQL Server 2016 SP1 Express
Edition is included in the setup) 1
• Microsoft SQL Server 2014 with Microsoft SQL Server 2014
Management Objects and Microsoft System CLR for SQL Server 2014
• Microsoft SQL Server 2012 (Microsoft SQL Server 2012 SP4 Express
Edition is included in the setup) 2
• Microsoft SQL Server 2008 R2
• Microsoft SQL Server 2008

SQL Server 2008 databases and later with compatibility to SQL Server 2005
are not supported.

Veeam Backup Enterprise Manager configuration database can be deployed in

Microsoft SQL AlwaysOn Availability Groups. For more information, see this
Veeam KB article.
1
For machines running Microsoft Windows Server 2012 or later.
2
For machines running Microsoft Windows 7 or Microsoft Windows Server 2008 R2.

• Microsoft Internet Information Services 7.5 or later: support for

Server Software
extentionless URLs for IIS 7.5 or later, ASP.NET 4.5, .NET Extensibility
4.5 for IIS 8.0.

For IIS 8.5, the URL rewrite module is required if you plan to use Veeam
Self-Service Backup Portal or vSphere Self-Service Backup Portal.
• Directory Browsing component, Default Document component, HTTPS
Errors component, Static Content component, Windows Authentication
component, WebSocket Protocol component.
• Microsoft .NET Framework 4.7.2 (included in the setup).
• Windows Installer 4.5 (included in the setup).

• Browsers: Microsoft Internet Explorer 11.0 or later, Microsoft Edge,

Client Software
latest versions of Mozilla Firefox and Google Chrome are supported.
The browser must have JavaScript and WebSocket protocol enabled.
• Microsoft Excel 2007 or later (view reports exported to Microsoft Excel
format).

IMP ORTANT

To restore Microsoft Exchange items with Veeam Backup Enterprise Manager, Microsoft Exchange servers
must be members of the same Microsoft Active Directory forest.

33 | V eeam Backup Enterprise Manager | User Guide

[Optional] Veeam Cloud Connect Portal

Sp ecification Requirement

Ha rdware and software Refer to hardware system requirements and software system requirements
for Veeam Backup Enterprise Manager.

Sup ported browsers For PC:

• Microsoft Internet Explorer 11.0 or later
• Microsoft Edge
• Latest versions of Mozilla Firefox and Google Chrome

For portable devices (tablets): latest versions of Apple Safari for iOS or
Google Chrome for Android.

[Optional] VMware vCloud Director

Sp ecification Requirement

VMwa re vCloud Director VMware vCloud Director 9.5–10.2. For vCD replication: 9.7–10.2.

Other software If your Enterprise Manager deployment uses IIS 8.5, then URL rewrite
module is required to work with Veeam Self-Service Backup Portal for
vCloud Director.

34 | V eeam Backup Enterprise Manager | User Guide

Required Permissions
This section provides information on the account permissions required for installing/upgrading and using Veeam
Backup Enterprise Manager and its components.

Veeam Backup Enterprise Manager

Account Required P ermission

The account used for product installation must have the local Administrator
permissions on the target machine.

To create a new Veeam Backup Enterprise Manager database during the setup
process, the account must have the CREATE ANY DATABASE permission on the SQL
Account used to run Server level. After the database is created, this account automatically gets a
the setup db_owner role and can perform all operations with the database.

Note: If a database is created in advance (by a database administrator or SQL Server

administrator), the setup account must have the db_owner role for the database.

To upgrade an existing Enterprise Manager database, the account must have the
db_owner role.

Veeam Backup It is recommended to use the Local System account as the Veeam Backup Enterprise
E nterprise Manager Manager Service account. If you set another account to run this service, this account
service account must have the following permissions:

• Local Administrator permissions on the Veeam Backup Enterprise Manager

server.
• Log on as service right (granted automatically to the Veeam Backup Enterprise
Manager Service account).
• Db_datareader and db_datawriter roles, as well as permissions to execute
stored procedures for the Enterprise Manager database on the Microsoft SQL
Server. Alternatively, you can assign this account the db_owner role for the
Enterprise Manager database.
• Full Control NTFS permissions for the VBRCatalog or another folder where
index files are stored.

To add Active Directory user or group accounts to the Veeam Backup Enterprise
Manager roles, the Veeam Backup Enterprise Manager service must be started under
the Active Directory service account that has permissions to enumerate Active
Directory domains. Active Directory users have enough permissions to enumerate
Active Directory domains by default. If you use the local machine account instead,
you will get the " Cannot find user account DOMAIN\username" error.

35 | V eeam Backup Enterprise Manager | User Guide

 Account Required P ermission

E nterprise Manager To be able to work with the Veeam Backup Enterprise Manager web UI, users must
user be assigned the Portal Administrator, Portal User or Restore Operator role. For more
information, see Configuring Accounts and Roles.

vSp here W eb Client The account used to install the plug-in and the vCenter server account must belong
P lug-in for Veeam to the same Active Directory domain in case of cross-domain access.
Ba ckup & Replication
( op tional) The account used to install the plug-in must be assigned the following vCenter
Server permissions:

• To install the plug-in: E x tension > Register extension

• To uninstall the plug-in: E x tension > Unregister extension

vSp here Self-Service The account used to work with vSphere Self-Service Backup Portal must have
Ba ckup P ortal user interactive logon permissions on the Enterprise Manager server.

36 | V eeam Backup Enterprise Manager | User Guide

Used Ports
This section covers typical connection settings for Veeam Backup Enterprise Manager, including:

• Enterprise Manager Operation Ports

• Ports for Restore Operations

NOTE

For more information on ports specific for Veeam Backup & Replication infrastructure components, see the
Used Ports section of the Veeam Backup & Replication User Guide.

Veeam Backup Enterprise Manager Connections

The following ports must be opened to ensure proper operation of Veeam Backup Enterprise Manager and
communication between components.

From To P rotocol P ort Notes

Veeam Veeam backup server TCP 9392 Default port used by Veeam Backup
Ba ckup Enterprise Manager for collecting data
E nterprise from Veeam backup servers. Can be
Ma nager customized during Veeam Backup &
Replication installation. For more
information, see Specify Service Ports.

9393 Default port used by the Veeam Guest

Catalog service for catalog replication.
Can be customized during Veeam
Backup & Replication installation.

2500 to Ports used by the Veeam Guest Catalog

2600 service for replicating catalog data.

135 Default RPC port.

49152 to Dynamic RPC port range. For more

65535 (for information, see this Microsoft KB
Microsoft article.
Windows
2008 and
later)

37 | V eeam Backup Enterprise Manager | User Guide

 From To P rotocol P ort Notes

SQL Server hosting the TCP 1433 Default port used for communication
Enterprise Manager with Microsoft SQL Server hosting a
configuration database Veeam Backup Enterprise Manager
database. For more information, see
Specify Installation Settings.

Additional ports may be needed

depending on your configuration. For
more information, see the Microsoft
SQL Docs Configure the Windows
Firewall to Allow SQL Server Access
article.

vCenter Server TCP 443 Default port used for connection to a

vCenter Server and deploying the
Veeam Plug-in for vSphere web client.
Can be customized during Veeam
Backup Enterprise Manager
installation. For more information, see
Specify Service Ports.

Active Directory TCP, UDP 389 Port used by Enterprise Manager

Domain Controller service to communicate with Active
Directory over the LDAP protocol.

TCP 636 Port used by Enterprise Manager

service to communicate with Active
Directory over the LDAPS (LDAP over
TLS/SSL) protocol.

TCP 3268 Port used by Enterprise Manager

service to communicate with LDAP
Global Catalog.

TCP 3269 Port used by Enterprise Manager

service to communicate with LDAP
Global Catalog over TLS/SSL.

TCP 49152 to Ports used by Enterprise Manager

65535 (for service to communicate with Active
Microsoft Directory. These ports are also used
Windows during restore through Veeam Self-
2008 and Service File Restore Portal. This is a
later) default dynamic port range. For more
information, see Microsoft Support KB
832017.

38 | V eeam Backup Enterprise Manager | User Guide

 From To P rotocol P ort Notes

Veeam License Update TCP 443 Default port used for license auto-
Server update.
(vbr.butler.veeam.com,
autolk.veeam.com)

Veeam Veeam Backup TCP 9394 Default port used by IIS extension to
Ba ckup Enterprise Manager communicate with Veeam Backup
E nterprise service Enterprise Manager. Can be
Ma nager customized during Veeam Backup
website (IIS Enterprise Manager installation. For
ex tension) more information, see Specify Service
Ports.

Veeam Veeam Backup TCP 9397 Default port used by IIS extension to
Cloud Enterprise Manager communicate with Veeam Backup
Connect service Enterprise Manager. This port value is
P ortal built-in and cannot be customized
website (IIS during installation.
ex tension)

Browser Veeam Backup HTTP 9080 Default ports used to communicate

Enterprise Manager with the website. Can be customized
website (IIS extension) during Veeam Backup Enterprise
HTTPS 9443 Manager installation. For more
information, see Specify Service Ports.

When you work with Veeam Self-

Service Backup Portal (accessed by the
portal URL or from the vCD
environment) and vSphere Self-Service
Backup Portal, your browser also
communicates with the Veeam Backup
Enterprise Manager website over this
port.

Veeam Cloud Connect HTTPS 6443 Default ports used to communicate

Portal website (IIS with the website. Can be customized
extension) during Veeam Backup Enterprise
Manager installation. For more
information, see Specify Service Ports.

HTTP 9399

39 | V eeam Backup Enterprise Manager | User Guide

 From To P rotocol P ort Notes

Veeam Veeam Backup HTTPS 9398

Ba ckup Enterprise Manager
E nterprise REST API
Default ports used to communicate
Ma nager
with Veeam Backup Enterprise
RE ST API
Manager REST API. Can be customized
client
during Veeam Backup Enterprise
a nd
Manager installation. For more
VMwa re
information, see Specify Service Ports.
vSp here
web client
p lug-in

Veeam Veeam Backup TCP Dynamically If you use Veeam Availability Suite and
ONE Server Enterprise Manager assigned add a Veeam Backup Enterprise
( op tional) ports Manager server to Veeam ONE
monitoring scope, you must open ports
required to gather data through WMI.
For more information on enabling and
disabling WMI traffic, see the
Connecting to WMI Remotely with
VBScript and Setting up a Remote WMI
Connection articles of the Microsoft
Windows Dev Center.

NOTE

Consider the following:

• During installation, Veeam Backup & Replication automatically creates firewall rules for default ports
to allow communication for the application components.
• For more information on Enterprise Manager network connectivity, refer to the Enterprise Manager
article of the Veeam Backup and Replication Best Practices documentation.

Ports for Restore Operations

Guest OS File Restore (Windows)

From To P rotocol P ort Notes

Veeam Mount server TCP 2500 to Ports used for file download.
Backup associated 6000
Enterprise with backup
Manager repository

40 | V eeam Backup Enterprise Manager | User Guide

Guest OS File Restore (non-Windows)

From To P rotocol P ort Notes

Veeam Helper TCP 2500 to Ports used for file download. For more
Backup appliance 6000 information on the helper appliance, see
Enterprise Preparing for File Search and Restore
Manager (non-Windows machines).

NOTE

Consider the following:

• For more information on the list of ports used by the mount server associated with the backup
repository during file-level restore, see the Mount Server Connections section of the Veeam Backup
& Replication User Guide.
• For more information on the list of ports used by the components involved in 1-Click Restore to
Original Location, see the Used Ports section of the Veeam Backup & Replication User Guide.

SQL Server Database Restore

From To P rotocol P ort Notes

Target Mount server TCP 3260 to 3270 Ports used for transfer of iSCSI traffic
remote SQL associated during database restore to the original
Server with backup Microsoft SQL Server. These ports are
repository used during the restore process only.

Oracle Database Restore (1-Click)

From To P rotocol P ort Notes

Target Machine TCP 3260 to 3270 Range of ports used by Veeam Backup
remote running and Replication for iSCSI traffic. Ports are
machine to mount open only during the application item
which service1 restore session.
application
items are
restored

1
Mount server associated with the repository (if restoring from backup), or a backup server (if restoring from replica).

NOTE

For more information on 1-Click Database Restore to the original Oracle server machine (remote machine),
see 1-Click Restore to Original Location.

41 | V eeam Backup Enterprise Manager | User Guide

Oracle Database Restore (Custom Settings)

From To P rotocol P ort Notes

Machine Oracle on TCP 49152 to Recommended dynamic RPC port range

running Windows 65535 for Microsoft Windows 2008 and later.
mount server For more information, see Microsoft
service1 Support KB 832017.

TCP 1025 to 1034 Default port range for the runtime

component installed on the guest
machine to support restore operations in
most scenarios. These ports are opened
only during application item restore.

Oracle on TCP 22 Default SSH port used as a control

Linux server channel.

TCP 2500 to Default port range for data transmission.

5000

1
Mount server associated with the repository (if restoring from backup), or a backup server (if restoring from replica).

NOTE

For more information on the process of database restore with custom settings, see Restore with Custom
Settings.

42 | V eeam Backup Enterprise Manager | User Guide

Licensing
The Veeam Backup & Replication infrastructure requires license instances to process backup and replication jobs.

When you run a job, Veeam Backup & Replication uses a number of instances required for each type of protected
workloads (for per-instance licenses) or applies a license to the protected hosts (for per-socket license).

Veeam Backup Enterprise Manager collects information about the type of license installed on Veeam backup
servers connected to it and the number of instances in the license. When Veeam Enterprise Manager replicates
databases from backup servers, it also synchronizes license da ta: checks if the license installed on the Veeam
backup server coincides with the license installed on the Veeam Backup Enterprise Manager server. If the
licenses do not coincide, the license on the Veeam backup server is automatically updated with that on the
Veeam Backup Enterprise Manager server.

Keep in mind that you cannot use the same Veeam Backup Enterprise Manager server to manage backup servers
that require different licenses, for example, a backup server of a Veeam Cloud Connect service provider a nd a
regular backup server used to process Veeam Backup & Replication jobs.

For example, you add to Veeam Backup Enterprise Manager a backup server with the Veeam Cloud Connect
service provider license installed. Veeam Backup Enterprise Manager will obtain information about the license
and save it to its database. If you then add another backup server with a different type of license installed,
Veeam Backup Enterprise Manager will install the Veeam Cloud Connect service provider license on this backup
server. As a result, you will be able to use the second backup server to configure the Veeam Cloud Connect
infrastructure, and will not be able to use this server to run backup and replication jobs.

Using Veeam Backup Enterprise Manager to work with Veeam Backup & Replication licenses reduces
administration overhead. You can manage and activate licenses for the entire backup infrastructure from a
single web console. You can view what workloads consume instances in the license, install a new license, or
revoke the license from protected workloads.

For information on Veeam Backup & Replication license types, see the Licensing section of the
Veeam Backup & Replication User Guide.

For information on Veeam Cloud Connect license types and license management tasks, see the Licensing for
Service Providers section of the Veeam Cloud Connect Guide.

For more information on Veeam licensing, see Veeam Licensing Policy.

43 | V eeam Backup Enterprise Manager | User Guide

Installing License
You can install a new license on the Veeam Backup Enterprise Manager server. The new license is automatically
applied to all backup servers connected to Enterprise Manager. This approach simplifies tracking license usage
and license updates across multiple backup servers.

NOTE

Starting from Veeam Backup Enterprise Manager 11a (build 11.0.1.1261), Veeam Backup Enterprise Manager
applies its license to connected backup servers that have Veeam Backup & Replication version 10 or later
installed.

To install a license:

1. Sign in to Veeam Backup Enterprise Manager using an account with the Portal Administrator role.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Configuration view, open the Licensing section.

4. On the Summary tab, click Install license.

5. Select the necessary LIC file and click Op en.

44 | V eeam Backup Enterprise Manager | User Guide

Viewing License Details
To view license details:

1. Sign in to Veeam Backup Enterprise Manager using an account with the Portal Administrator role.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Configuration view, open the Licensing section.

On the Summary tab of the Licensing section, you can find information about the license edition, license state
and a spreadsheet of the available and used instances per each type of protected workloads: virtual machines,
physical servers and workstations, cloud machines, applications and file shares.

Each type of workloads processed by Veeam Backup & Replication consumes a specific number of instances in
the license. For more information on Veeam licensing, see Veeam Licensing Policy.

TIP

You can configure Veeam Backup Enterprise Manager to send notifications if your license expires. For more
information on the Veeam Backup Enterprise Manager notification functionality, see the Configuring
Notification Settings section of this guide.

NOTE

Veeam Backup Enterprise Manager does not display information about instances consumed in the Veeam
Cloud Connect service provider license by tenant workloads. This information is available only in the Veeam
backup console on the Veeam backup server of the service provider. For more information, see the
Licensing for Service Providers section of the Veeam Cloud Connect Guide.

45 | V eeam Backup Enterprise Manager | User Guide

To display detailed information about the current license, including license type, expiration date and the
number of instances, click the Details link.

TIP

You can also view detailed information about current license usage. To do this, click the Rep ort link.

46 | V eeam Backup Enterprise Manager | User Guide

Updating License
Updating License Manually
You can update the license manually on demand. When you update the license manually, Veeam Backup
Enterprise Manager connects to the Veeam License Update Server, downloads a new license from it (if the
license is available) and installs it.

To update the license:

1. Sign in to Veeam Backup Enterprise Manager using an account with the Portal Administrator role.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Configuration view, open the Licensing section.

4. On the Summary tab, click Details.

5. Click the Up date now link.

Updating License Automatically

You can instruct Veeam Backup Enterprise Manager to schedule automatic connection with Veeam License
Update Server and periodically send requests for a new license. When the automatic update is enabled,
Enterprise Manager requests a new license weekly, and 7 days before current license expiration date — daily.

To enable automatic update:

1. Sign in to Veeam Backup Enterprise Manager using an account with the Portal Administrator role.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Configuration view, open the Licensing section.

4. On the Summary tab, click Details.

47 | V eeam Backup Enterprise Manager | User Guide

 5. In the Details window, select the Up date license key automatically check box.

NOTE

If this option is enabled in Enterprise Manager (even if deactivated in the Veeam backup console),
automatic update will be performed anyway: Enterprise Manager will obtain a new key from Veeam
licensing server and propagate it to all managed Veeam backup servers.

For information on license management in Veeam Backup and Replication, see the Licensing section of the
Veeam Backup & Replication User Guide.

For information on license management for Veeam Cloud Connect Server Providers, see the Licensing for
Service Providers section of the Veeam Cloud Connect Guide.

Grace Period
Veeam Backup Enterprise Manager supports a grace period after the license expiration date. For subscription
license, it lasts for 30 days, for rental license — 2 months. During this period the product will be running, but a
warning about license expiration (grace period) will appear in the main window and in the sessions information.

You must update your license before the end of the grace period.

Messages that can appear in the automatic license update session log are listed in the Appendix A. Similar
messages are received as pop-ups after you force the immediate update.

48 | V eeam Backup Enterprise Manager | User Guide

Revoking License
You can use Enterprise Manager to revoke instances from machines — that is, reclaim the instance used for a
machine to apply it to another machine.

To revoke the license:

1. Sign in to Veeam Backup Enterprise Manager using an account with the Portal Administrator role.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Configuration view, open the Licensing section.

4. Select the Instances tab.

5. Select the required object in the list and click Revoke.

49 | V eeam Backup Enterprise Manager | User Guide

Managing Monthly Usage Reports
Veeam Cloud & Service Provides (VCSPs) who have a rental license installed in Veeam Backup Enterprise
Manager must monthly submit a license usage report from Enterprise Manager.

Veeam offers two methods of usage reporting: automatic and manual. The automatic reporting is used if
automatic license update is enabled. For more information about how license usage reporting works, see the
License Usage Reporting section of the Veeam Cloud Connect Guide.

Veeam Backup Enterprise Manager generates a monthly usage report on the first day of the month. The report is
based on the number of instances used for backup and replication in the previous month.

50 | V eeam Backup Enterprise Manager | User Guide

Reviewing Monthly Usage Report
You can review a monthly usage report before sending it to Veeam.

To review a report:

1. In the monthly usage report notification, click the sub mit link.

2. In the Monthly Usage Report window, click Review.

3. In the monthly usage report, check the number of reported instances. The report contains the following
data:

o License information: Veeam Backup & Replication edition, license expiration date, name of the
company to which the license was issued and support ID.

o The number of instances used by each type of protected workloads (VMs, workstations, servers and
file shares) and the total number of used instances.

o For each type of protected workloads, the report displays information about processed workloads and
jobs that process these workloads.

o For each type of protected workloads, the report also displays the number of new objects that are not
included in the report.

On the report page, you can perform the following actions:

• Print the report

• Adjust the number of processed VMs in the report

• Download the report

• [For automatic reporting] Submit the report

51 | V eeam Backup Enterprise Manager | User Guide

Adjusting Monthly Usage Report
You can remove specific VMs from a monthly usage report. For every VM removal, you must specify a reason.

To adjust a report:

1. In the monthly usage report notification, click the sub mit link.

2. In the Monthly Usage Report window, click Review.

3. On the report page, click Ad just.

4. In the list of VMs, select the VM that you want to remove from the report and click Remove.

By default, the list of VMs contains all managed VMs included in the report. To quickly find the necessary
VM, you can use the search field at the top of the window. You can also select a backup server and job
from the drop-down lists to view a list of VMs added to a specific job on a specific backup server.

5. In the Remove Instance window, in the Ty p e in note field, provide a reason for removing the VM from the
report.

6. Click OK, then click Finish. The change will be reflected in the report.

TIP

To reset changes introduced in the report, in the Monthly Usage Report window, click Reset.

52 | V eeam Backup Enterprise Manager | User Guide

Downloading Monthly Usage Report
You can download a monthly usage report as a PDF or JSON file.

To download a monthly usage report:

1. In the monthly usage report notification, click the sub mit link.

2. Download the report. The procedure differs depending on the reporting method. For more information,
see the License Usage Reporting section of the Veeam Cloud Connect Guide.

o In case of automatic reporting, do the following:

i. In the Monthly Usage Report window, click Review.

ii. On the report page, click Download and select the report format: PDF or JSON.

o In case of manual reporting, in the Monthly Usage Report window, click Download and select the
report format: PDF or JSON.

You can also download the report after review. To do this, take the same steps as in case of automatic
reporting.

53 | V eeam Backup Enterprise Manager | User Guide

Submitting Monthly Usage Report
On the first day of the month, Veeam Backup Enterprise Manager shows a warning on the Da shboard tab. The
warning prompts to submit a monthly usage report and informs on the number of days within which the report
must be submitted.

You can submit a monthly usage report in one of the following ways:

• Automatically

• Manually

For more information about how license usage reporting works, see the License Usage Reporting section of the
Veeam Cloud Connect Guide.

Submitting Report Automatically

Automatic report submission allows you to send the report to Veeam directly from Veeam Backup Enterprise
Manager. If you do not submit the report within 10 days, Veeam Backup Enterprise Manager sends the report on
the eleventh day of the month.

To submit a monthly usage report automatically:

1. In the monthly usage report notification, click the sub mit link.

2. In the Monthly Usage Report window, to check or change the number of used instances, click Review.

For more information, see Reviewing Monthly Usage Report and Adjusting Monthly Usage Report.

3. To submit the report, click Send.

You can also postpone the report submission. To do this, click P ostpone. In this case, Veeam Backup
Enterprise Manager closes the Monthly Usage Report window. Until the report is sent to Veeam, on the
Da shboard tab, Enterprise Manager keeps displaying a warning prompting to submit the report.

54 | V eeam Backup Enterprise Manager | User Guide

Submitting Report Manually
You must send the report before the day defined by the agreement with Veeam or your Aggregator (if any is
involved). The default day is the tenth day of the month.

To submit a monthly usage report manually:

1. In the monthly usage report notification, click the sub mit link.

2. In the Monthly Usage Report window, to check or change the number of used instances, click Review. For
more information, see Reviewing Monthly Usage Report and Adjusting Monthly Usage Report.

3. To download the report, click Download.

You can also postpone the report submission. To do this, click P ostpone. In this case, Veeam Backup
Enterprise Manager closes the Monthly Usage Report window. Until the report is sent to Veeam, on the
Da shboard tab, Enterprise Manager keeps displaying a warning prompting to submit the report.

4. Send the downloaded report to Veeam.

55 | V eeam Backup Enterprise Manager | User Guide

Deployment
To start working with Veeam Backup Enterprise Manager, you must install Veeam Backup Enterprise Manager
components on a machine that meets the system requirements. To do this, you can use the setup wizard or
install the product in the unattended mode.

You can install Veeam Backup Enterprise Manager either on a physical or virtual machine, co-install it with
Veeam Backup & Replication or install it separately.

56 | V eeam Backup Enterprise Manager | User Guide

Installing Veeam Backup Enterprise
Manager
Before you install Veeam Backup Enterprise Manager, check prerequisites. Then use the Veeam Backup
E nterprise Manager setup wizard to install the product.

1. Start the setup wizard.

2. Read and accept the license agreement.

3. Provide a license file.

4. Review components and select an installation folder.

5. Install missing software.

6. Specify installation settings.

7. Specify service account settings.

8. Select Microsoft SQL Server.

9. Specify service ports.

10. Specify data locations.

11. Begin installation.

For more information on Veeam Backup Enterprise Manager installation in unattended mode, see the Veeam
Backup Enterprise Manager Server subsection of the Installing Veeam Backup & Replication in Unattended Mode
section of the Veeam Backup & Replication User Guide.

57 | V eeam Backup Enterprise Manager | User Guide

Before You Begin
Before you install Veeam Backup Enterprise Manager, check the following prerequisites:

• A machine on which you plan to install Veeam Backup Enterprise Manager must meet the system
requirements. For more information, see System Requirements.

• A user account that you plan to use for installation must have sufficient permissions. For more
information, see Required Permissions.

• Backup infrastructure components communicate with each other over specific ports. These ports must be
open. For more information, see Used Ports.

• .NET 3.5.1 WCF HTTP Activation Windows component prevents Veeam Backup Enterprise Manager from
functioning. Make sure there is no .NET 3.5.1 WCF HTTP Activation Windows component on the Veeam
Backup Enterprise Manager server prior to the installation.

• Local antivirus or antimalware software can interfere with Veeam Backup Enterprise Manager installation
and upgrade. If you receive the "Failed to create website 0x80070020" message, disable your local
antivirus or antimalware software and run the installation process again. You can re -enable your antivirus
software once the installation process completes. For more information, see this Veeam KB article.

• Check the Known Issues section of the Veeam Backup & Replication 11 Release Notes.

58 | V eeam Backup Enterprise Manager | User Guide

Step 1. Start Setup Wizard
To start the setup wizard:

1. Download the latest version of the Veeam Backup & Replication installation image from
https://www.veeam.com/downloads.html.

2. Use disk image emulation software to mount the installation image to the machine where you plan to
install Veeam Backup Enterprise Manager or burn the image file to a blank CD/DVD. If you plan to install
Veeam Backup Enterprise Manager on a VM, use built-in tools of the virtualization management software
to mount the installation image to the VM. To extract the content of the ISO, you can also use the latest
versions of utilities that can properly extract data from ISOs of large size and can properly work with long
file paths.

3. After you mount the image or insert the disk, Autorun will open a splash screen with installation options.
If Autorun is not available or disabled, run the Setup.exe file from the image or disk.

4. In the Sta ndalone components section of the splash screen, click Install Veeam Backup Enterprise
Manager.

5. Before installing the product, the setup will analyze the prerequisites and prompt to ins tall .NET
Framework if it is missing on the machine. Click OK to install this component. After you install the
component, you will have to reboot your computer.

IMP ORTANT

It is strongly recommended that you install Veeam Backup Enterprise Manager using Autorun or the
Setup.exe file. If you run other installation files from the ISO folders, you may miss some components
that need to be installed, and Veeam Backup Enterprise Manager may not work as expected.

59 | V eeam Backup Enterprise Manager | User Guide

Step 2. Read and Accept License Agreement
At the License Agreement step of the wizard, you must accept the license agreement for Veeam and 3rd party
components that Veeam incorporates. If you do not accept the license agreements, you will not be able to pass
to next step of the setup wizard.

1. Read the license agreement. To view the license agreement for 3rd party components, click View.

2. Select the I a ccept the terms of the Veeam license agreement check box.

3. Select the I a ccept the terms of the 3rd party components license agreements check box.

60 | V eeam Backup Enterprise Manager | User Guide

Step 3. Provide License File
At the P rovide License step of the wizard, you must specify what license for Veeam Backup Enterprise Manager
you want to install. You can install the following types of licenses:

• Trial license that was sent to you after you downloaded the product.

• Purchased full license.

If a valid license is already installed on the machine, the setup wizard will inform you about it. In this case, you
can skip the P rovide License step and move to the next step of the wizard.

To install a license:

1. Next to the License file for Veeam Backup Enterprise Manager field, click Browse.

2. Select a valid license file for Veeam Backup Enterprise Manager.

61 | V eeam Backup Enterprise Manager | User Guide

Step 4. Review Components and Select
Installation Folder
At the P rogram features step of the wizard, you can select what Enterprise Manager components to install on
the machine and specify the installation folder.

Selecting Components
For on-site deployments, the setup wizard offers the following components:

• Veeam Backup Enterprise Manager

• Veeam Backup Catalog

Service providers can also install Veeam Cloud Connect Portal. For more information on Veeam Cloud Connect
Portal, see the Veeam Cloud Connect Guide.

To choose components to install:

1. Click the hard drive icon next to a component.

2. Select the This feature will be installed on local hard drive option.

If the Veeam Backup Catalog or Cloud Connect Portal for Service Providers component is already installed, the
setup will exclude it from the list of components to install.

The setup wizard also installs components in the background. For more information on the installed
components, see Enterprise Manager Components.

Selecting Installation Folder

To choose the installation folder:

1. On the right of the Install to field, click Browse.

2. In the Browse for Folder window, select the installation folder for the product. The default installation
folder is %ProgramFiles%\Veeam\Backup and Replication.

62 | V eeam Backup Enterprise Manager | User Guide

Step 5. Install Missing Software
At the Sy stem Configuration Check step of the wizard, the setup wizard checks if all prerequisite software is
installed on the machine. If required software components are missing, the setup wizard will offer you to install
them.

You can install missing components automatically or manually.

• To install missing components automatically, click Install. The setup wizard will not interrupt the
installation process and install the missing components during the current work session.

• To install missing components manually:

a. Click Ca ncel and exit the setup wizard.

b. Install and enable the necessary components manually on the machine.

c. Start the setup wizard again, pass to the Sy s tem Configuration Check step of the wizard and click Re-
run to repeat the verification.

NOTE

If all required components are already installed on the machine, the Sy stem Configuration Check step will
be skipped. For more information on the necessary software, see System Requirements.

63 | V eeam Backup Enterprise Manager | User Guide

Step 6. Specify Installation Settings
At the Default Configuration step of the wizard, you can select to install Veeam Backup E nterprise Manager with
default installation settings or specify custom installation settings.

By default, the setup wizard installs Veeam Backup Enterprise Manager with the following settings:

• Installation folder: C:\Program Files\Veeam\Backup and Replication.

• Guest catalog folder: the VBRCatalog folder on a volume with the maximum amount of free space, for
example, C:\VBRCatalog.

The guest catalog folder stores indexing data for VM guest OS files. Indexing data is required for browsing
and searching for VM guest OS files inside backups and performing 1-click restore.

• Ca talog service port: 9393. The catalog service port is used by the Veeam Guest Catalog Service to
replicate catalog data from backup servers to Veeam Backup Enterprise Manager.

• Service account: LOCAL SYSTEM. The service account is the account under which the Veeam Backup
Enterprise Manager runs.

• Service port: 9394. The service port is used by Veeam Backup Enterprise Manager to collect data from
backup servers.

• SQL Server: LOCALHOST\VEEAMSQL2012 or LOCALHOST\VEEAMSQL2016. During installation, the Veeam

Backup Enterprise Manager setup installs a new instance of Microsoft SQL Server locally on the backup
server:

o For machines running Microsoft Windows Server 2008 or Microsoft Windows Server 2008 R2, the
setup installs Microsoft SQL Server 2012 SP3 Express Edition.

o For machines running Microsoft Windows Server 2012 and later, the setup installs Microsoft SQL
Server 2016 SP2 Express Edition.

• Da tabase name: VeeamBackupReporting . Veeam Backup Enterprise Manager deploys the Veeam Backup
Enterprise Manager configuration database on the locally installed instance of Microsoft SQL Server.

• W eb UI ports: 9080 (for HTTP protocol) and 9443 (for HTTPS protocol). These ports are used for
accessing Veeam Backup Enterprise Manager web interface.

• RE ST API ports: 9399 (for HTTP protocol) and 9398 (for HTTPS protocol). These ports are used for
accessing Veeam Backup Enterprise Manager REST API.

• Cloud Connect P ortal port : 6443. This port is used for accessing Veeam Cloud Connect Portal by tenants.

To use default installation settings:

1. Leave the Let me specify different settings check box not selected.

2. Click Install. The installation process will begin.

64 | V eeam Backup Enterprise Manager | User Guide

To use custom installation settings, select the Let me specify d ifferent settings check box. The setup wizard will
include additional steps that will let you configure installation settings.

65 | V eeam Backup Enterprise Manager | User Guide

Step 7. Specify Service Account Settings
The Service Account Credentials step of the wizard is available if you have selected to configure installation
settings manually.

You can select an account under which you want to run the Veeam Backup Enterprise Manager Service:

• LOCAL SYSTEM account (recommended, used by default)

• Another user account

The user name of the custom account must be specified in the DOMAIN\USERNAME format.

NOTE

The user account must have Veeam Backup Enterprise Manager service account permissions to run the
Veeam Backup Enterprise Manager Service. For more information, see Required Permissions.

66 | V eeam Backup Enterprise Manager | User Guide

Step 8. Select Microsoft SQL Server
The SQL Server Instance step of the wizard is available if you have selected to configure installation settings
manually.

You can select a Microsoft SQL Server on which you want to deploy the configuration database, and choose the
authentication mode.

1. Select a Microsoft SQL Server:

o If a Microsoft SQL Server is not installed locally or remotely, select the Install new instance of SQL
Server option. The setup will install Microsoft SQL Server locally on the backup server:

▪ For machines running Microsoft Windows Server 2008 or Microsoft Windows Server 2008 R2,
the setup will install Microsoft SQL Server 2012 SP3 Express Edition.

▪ For machines running Microsoft Windows Server 2012 and later, the setup will install Microsoft
SQL Server 2016 SP2 Express Edition.

o If a Microsoft SQL Server is already installed locally or remotely, select the Use existing instance of
SQL Server option. Enter the instance name in the HOSTNAME \INSTANCE format. In the Da tabase
field, specify a name for the Veeam Backup Enterprise Manager configuration database.

2. Select an authentication mode to connect to the Microsoft SQL Server instance: Microsoft Windows
authentication or Microsoft SQL Server authentication. If you select the SQL Server authentication, enter
credentials for the Microsoft SQL Server account.

If the configuration database already exists on the Microsoft SQL Server (for example, it was created by a
previous installation of Veeam Backup Enterprise Manager), the setup wizard will notify about it. To connect to
the detected database, click Y es . If necessary, Veeam Backup Enterprise Manager will automatically upgrade the
database to the latest version.

67 | V eeam Backup Enterprise Manager | User Guide

Step 9. Specify Service Ports
The Ad d itional Configuration step of the wizard is available if you have selected to configure installation
settings manually.

You can customize port number values that will be used for communication between backup infrastructure
components.

NOTE

For more information about Veeam Backup Enterprise Manager used ports, see Used Ports.

Provide HTTP and HTTPS port numbers and select the certificate to be used by Veeam Backup Enterprise
Manager. This certificate is needed to establish secure communication with the Enterprise Manager website
using HTTPS (default port 9443); Veeam plug-in for vSphere Web Client and RestAPI client also will use this
certificate to receive data using HTTPS protocol.

If the setup wizard does not find an appropriate certificate to be used, it generates a self -signed certificate.

Click View certificate to review the details of the selected certificate.

To enforce TLS 1.2 encryption protocol for network connections, select the Hig h security mode check box.

NOTE

The Hig h security mode option disables using weak ciphers for all communications with the machine on
which Veeam Backup Enterprise Manager runs. This may interfere with the operation of 3rd party software
installed on the same machine.

If you are installing Veeam Cloud Connect Portal, you can also provide port number that will be used by browser
to access its website (default port is 6443).

68 | V eeam Backup Enterprise Manager | User Guide

Step 10. Specify File Locations
The File Locations step is available if you have selected to install Veeam Backup Catalog at the Program features
step of the wizard and to configure installation settings manually at the Default Configuration step of the
wizard.

You can specify location for the guest file system catalog folder. Specify a path to the folder where index files
must be stored.

By default, the setup wizard creates the VBRCatalog folder on a volume with the maximum amount of free
space, for example: C:\VBRCatalog. To change the location, click Browse.

69 | V eeam Backup Enterprise Manager | User Guide

Step 11. Begin Installation
The Ready to Install step of the wizard is available if you have selected to configure installation settings
manually.

You can review the Veeam Backup Enterprise Manager installation settings and start the installation process:

1. Click Install to begin the installation.

2. Wait for the installation process to complete and click Finish to exit the setup wizard.

70 | V eeam Backup Enterprise Manager | User Guide

Maintaining Veeam Backup Enterprise
Manager
You can repair your installation of Veeam Backup Enterprise Manager. To do this:

1. Start the setup wizard on the Veeam Backup Enterprise Manager server. For more information, see Start
Setup Wizard.

2. Read and accept the License Agreement. For more information, see Read and Accept License Agreement.

3. At the Ma intenance Mode step of the setup wizard, select the Repair option and click Nex t.

4. Specify the service account credentials that will be used during the Veeam Backup Enterprise Manager
repair. For more information, see Specify Service Account Settings.

5. At the Rea dy to Install step of the Setup Wizard check the installation prerequisites and click Install.

The setup wizard will re-install the Veeam Backup Enterprise Manager components. Wait for the installation
process to complete and click Finish to exit the setup wizard.

71 | V eeam Backup Enterprise Manager | User Guide

Upgrading Veeam Backup Enterprise
Manager
Before You Start Upgrade
Upgrade of Veeam Backup Enterprise Manager to version 11 is supported for version 9.5 Update 4b (build
9.5.4.2866) and later. To upgrade from earlier versions, contact Veeam Customer Support.

NOTE

Starting from Veeam Backup Enterprise Manager 11a (build 11.0.1.1261), Veeam Backup Enterprise Manager
applies its license to connected backup servers that have Veeam Backup & Replication version 10 or later
installed.

Before starting the upgrade procedure, read and follow the recommendations below:

1. With Veeam Backup Enterprise Manager and connected Veeam backup servers, remember to begin the
backup infrastructure upgrade process with Veeam Backup Enterprise Manager. Backup servers should be
upgraded after that. If you have Veeam backup server installed on the same machine, upg rade it
immediately after completing upgrade of the Veeam Backup Enterprise Manager server.

2. It is recommended to disable local antivirus and antimalware software to prevent it from interfering with
Veeam Backup Enterprise Manager setup. You can enable it after the upgrade procedure is completed. For
more information, see this Veeam KB article.

3. Ensure there is no active processes, such as running jobs and restore sessions. We recommend that you do
not stop running jobs and let them complete successfully instead. Disable any periodic and backup copy
jobs, so that they do not start during upgrade.

4. Perform backup of the SQL Server configuration databases used by Veeam backup servers and Veeam
Backup Enterprise Manager server, so that you can easily go back to a previous version in case of issues
with upgrade. Note that built-in configuration backup functionality does not protect Veeam Backup
Enterprise Manager configuration.

Upgrade Procedure
To upgrade Veeam Backup Enterprise Manager, take the following steps:

1. Download the latest version of Veeam Backup & Replication ISO from the Veeam website.

2. Mount the product ISO and use autorun, or run the Setup.exe file.

3. Click Up grade Veeam Backup E nterprise Manager.

4. Follow the setup wizard steps. At the SQL Server Instance step, select the SQL server instance and
database that were used by the previous version of Veeam Backup Enterprise Manager.

5. If you have Veeam Backup & Replication installed on the same machine, upgrade it immediately after
completing upgrade of the Veeam Backup Enterprise Manager server, otherwise this local backup server
will not be able to run jobs.

6. Proceed with upgrade of your Veeam backup servers.

72 | V eeam Backup Enterprise Manager | User Guide

 IMP ORTANT

After you upgrade Veeam Backup & Replication servers, Veeam Backup Enterprise Manager starts
maintenance jobs to optimize the state of its database. The initial maintenance jobs session may take
significant amount of time (up to an hour, depending on the database size). After the job finishes,
the database will be brought to an optimal state, and subsequent maintenance job sessions will take
much less time.

7. New features of Veeam Backup Enterprise Manager version 11 will b e available after all managed Veeam
backup servers are upgraded, and initial collection of data from these servers in Veeam Backup Enterprise
Manager completes successfully.

8. Download and install the latest available update (if any) from https://www.veeam.com/updates.html.

73 | V eeam Backup Enterprise Manager | User Guide

Uninstalling Veeam Backup Enterprise
Manager
To uninstall Veeam Backup Enterprise Manager:

1. From the Sta rt menu, select Control Panel > P rograms and Features.

2. In the programs list, right-click Veeam Backup & Replication and select Uninstall.

3. In the Uninstall window, make sure the check box next to Veeam Backup Enterprise Manager is selected. If
this component is co-installed with the Veeam Backup & Replication server, make sure the check box next
to Veeam Backup & Replication is cleared. Click Remove and wait for the process to complete.

The Veeam Backup Enterprise Manager configuration database (default name is VeeamBackupReporting ) is not
removed during the uninstall process. All configuration data stored in the database remains as well.

74 | V eeam Backup Enterprise Manager | User Guide

Migrating Veeam Backup Enterprise
Manager
You may need to migrate Veeam Backup Enterprise Manager or its configuration database, or both to another
server.

Before you migrate Enterprise Manager, you must export Enterprise Manager keysets and prepare the
credentials stored in the Enterprise Manager configuration database so you will be able to re -enter the
credentials on a new server. If you migrate the Enterprise Manager configuration database only, the credentials
and keysets will remain valid.

For more information on migration scenarios, see this Veeam KB article.

75 | V eeam Backup Enterprise Manager | User Guide

Getting to Know Veeam Backup
Enterprise Manager
After you install Veeam Backup Enterprise Manager, you can learn how to access the main product UI and get
familiar with it.

76 | V eeam Backup Enterprise Manager | User Guide

Accessing Enterprise Manager Website
When you access Veeam Backup Enterprise Manager for the first time, you must log in as a user with
administrative rights. To do that, enter credentials of a user account with local administrative rights or a user
account that was used to install Enterprise Manager. Later you can add other account in Enterprise Manager. For
more information, see Managing Accounts and Roles.

To access the Veeam Backup Enterprise Manager website:

1. Double-click the Veeam Backup Enterprise Manager icon on the desktop or select P rograms > Veeam >
Veeam Backup Enterprise Manager from the Sta rt menu.

Alternatively, open your web browser and enter the following URL in the address bar:

https://<hostname>:9443

For example:

https://vbr-em:9443

2. From the drop-down list, select a display language.

For more information, see Managing Languages.

3. Log in using your credentials:

o To log in with Enterprise Manager credentials:

i. In the Username and P a ssword fields, specify your Enterprise Manager credentials. Provide the
user account name in the DOMAIN\Username format.

ii. To save the entered credentials for future access, select the Rema in signed in option.

iii. Click Sig n in.

o To log in with single sign-on, click Use Single Sign-On ( SSO). Enterprise Manager will redirect you to
the login webpage of the single sign-on service. Complete the sign-in procedure on the login page. If
the account is already authenticated in the single sign-on service, you will immediately access the
Enterprise Manager website.

NOTE

The Use Single Sign-On (SSO) option is available if SAML authentication is configured for Veeam
Backup Enterprise Manager. For more information, see Configuring SAML Authentication
Settings.

When you log in under a user account which is not assigned a role for Enterprise Manager, you are automatically
redirected to the Veeam Self-Service File Restore Portal. On this portal, you can browse and restore only
machines on which your user account has local administrative rights. For more information on configuring
Enterprise Manager security roles, see Managing Accounts and Roles.

77 | V eeam Backup Enterprise Manager | User Guide

 NOTE

Veeam Self-Service File Restore Portal is available in the Enterprise Plus edition of Veeam Backup &
Replication.

If you cannot access web UI over HTTPS, this can be due to several reasons. For more information, see this
Veeam Knowledge Base article.

TIP

If you use Internet Explorer, then to be able to access the Enterprise Manager website using an account
currently logged in to the Microsoft Windows OS, you can add this website to Local intranet sites in the
Internet Options. In case the current user cannot be authenticated using this method, the Enterprise
Manager login window will be displayed. This method works only for Internet Explorer. If you use another
web browser, you may be prompted for login.

After you finish working with the Enterprise Manager website, or if you need to switch the user account, click
the user name in the top right corner of the main window and then click Sig n Out.

78 | V eeam Backup Enterprise Manager | User Guide

Veeam Backup Enterprise Manager UI
Home View
After you log in to Veeam Backup Enterprise Manager, the Home view opens. In the Home view, you can
navigate through tabs to perform management and restore operations. A user can navigate only the tabs they
are authorized to view in accordance with their security role. For more information on the Enterprise Manager
roles and operations allowed to them, see Managing Accounts and Roles.

Below is the list of operations that you can perform in the Home view of the Veeam Backup Enterprise Manager
UI:

• View on-going statistics for your backup infrastructure using the Da shboard tab. For more information,
see Viewing Operation Statistics.

• View detailed information about Veeam backup servers managed by Enterprise Manager using the Rep orts
tab. For more information, see Reports on Backup Servers.

• Manage jobs on all managed Veeam backup servers using the Job s tab. For more information, see
Managing Jobs.

• Browse for file share backups, search for file shares, delete file shares and perform tile -level restore from
file share backups using the File Shares tab. For more information, see Working with File Shares.

• Browse for machine backups, search for machines, delete machines and perform failover and replication
operations with managed virtual or physical machines using the Ma chines tab. For more information, see
Working with Machines.

• Browse the guest OS file system in a machine backup, search for guest OS files and restore necessary files
using the Files tab. For more information, see Restoring Guest OS Files.

• Perform item-level recovery from application-aware backups created by Veeam Backup & Replication
using the Items tab. For more information, see Backup and Restore of Application Items.

79 | V eeam Backup Enterprise Manager | User Guide

 • Approve submitted virtual lab requests, reject them or prolong the time for which a requested virtual lab
should be up using the Requests tab. For more information, see Working with Virtual Lab Requests.

Configuration View
If you logged in with an administrative account, on the Home view you can click Configuration to open the
Configuration view.

The tabbed pane, located on the left of the window, allows you to navigate to the configuration settings you
need — for example, notifications, security roles, and others. The working area is located on the right; it allows
you to view data, perform the necessary operations or manage the settings you need.

Below is the list of operations that you can perform in the Configuration view of the Veeam Backup Enterprise
Manager UI:

• Add, edit or remove Veeam Backup servers using the Ba ckup Servers tab. For more information, see
Managing Backup Servers.

• Work with vCenter servers managed by Enterprise Manager using the vCenter Servers tab. For more
information, see Viewing vCenter Servers.

• Manage vCloud Director organizations and vSphere tenant accounts using the Self-Service tab. For more
information, see Working with VMware vCloud Director and vSphere Self-Service Backup Portal.

• View and manage data collection job sessions using the Sessions tab. For more information, see Collecting
Data from Backup Servers.

• Configure Enterprise Manager security roles using the Roles tab. For more information, see Managing
Accounts and Roles.

• Configure Enterprise Manager settings using the Settings tab. For more information, see Managing
Encryption Keys, Configuring SAML Authentication Settings, Customizing Chart Appearance and
Configuring Retention Settings for Index and History.

80 | V eeam Backup Enterprise Manager | User Guide

 • Manage licenses and view detailed reports on license consumption using the Licensing tab. For more
information, see Licensing.

• Set email notifications using the Notifications tab. For more information, see Configuring Notification
Settings.

• View product versions, URLs and log paths using the Ab out tab. For more information, see Viewing
Information About Enterprise Manager.

81 | V eeam Backup Enterprise Manager | User Guide

Viewing Operation Statistics
On the Da shboard tab of the home page, Veeam Backup Enterprise Manager displays on-going statistics on
backup servers, their jobs, processed machines and file shares as well as data size, processing speed and so on.

Statistics are divided into the following blocks:

• The Summary block shows the total number of managed backup servers, performed jobs, processed
machines and file shares.

• The Image Data block shows the average processing speed, total size of processed machines, full backups
and incremental backups.

• The File Data block shows the average processing speed, total size of processed file shares, backed -up and
archived files.

This block is displayed only if one or more file shares are added on a backup server connected to Veeam
Backup Enterprise Manager.

• The La st 24 hours / Last 7 days block shows the total number of job runs, successful jobs, jobs with
warnings and failed jobs.

To switch between the time ranges, select a necessary tab in the top left corner.

• The Sta tus block shows the status of backup files, managed backup servers, Veeam Backup Enterprise
Manager management server, and licenses.

License status is displayed as follows:

o OK — current license is valid

o Warning — working in grace period, or failed to update the license

o Error — license is expired, and grace period is over

You can use the links in these blocks to drill down into detailed reports on specific aspects of the backup
infrastructure.

Backup Servers Chart

The Ba ckup Servers chart shows date and time when backup jobs were performed, and the network throughput
rate during the backup jobs. Jobs related to each backup server have their own color on the chart. The lege nd on
the right interprets the color scheme used for all managed backup servers.

You can view the chart for one of the time ranges:

• Last 24 hours

• Last 7 days

To switch between the ranges, select a necessary tab in the top left corner.

82 | V eeam Backup Enterprise Manager | User Guide

In the La st 24 hours view, the highlighted part of the chart represents the configured backup window. You can
configure the backup window in the chart settings. For more information, see Customizing Chart Appearance.

Customizing Chart Appearance

To customize the appearance of the chart:

1. Open the Configuration view.

2. Click the Settings section on the left of the Configuration view.

3. Use the Activity graph scale options on the Cha rt Settings tab to switch between graph types: Linear and
Log arithmic.

4. By default, the time interval specified under the selected Show backup window check box is highlighted
on the activity graph. Default interval is from 8:00 PM to 8:00 AM. You can change the highlighted
interval to correlate with your planned backup window by editing the start and stop time. If you do not
want to highlight the backup window on the graph, clear the Show backup window check box.

83 | V eeam Backup Enterprise Manager | User Guide

 5. Save the changes.

84 | V eeam Backup Enterprise Manager | User Guide

Configuring Veeam Backup Enterprise
Manager
As part of the Veeam Backup Enterprise Manager configuration process, you can perform the following tasks:

• Manage backup servers

• Collect data from backup servers

• View vCenter servers and install Veeam plug-in for vSphere Web Client on necessary servers

• Configure retention settings for index and history

• Configure security settings

• Configure notification settings

• Manage display languages

To start working with Veeam Backup Enterprise Manager, you must perform initial configuration. For more
information, see Initial Configuration.

85 | V eeam Backup Enterprise Manager | User Guide

Initial Configuration
To start working with Veeam Backup Enterprise Manager, perform the following steps:

1. Log in to the Veeam Backup Enterprise Manager website. For more information, see Accessing Enterprise
Manager Website.

2. Add backup servers you want to manage. For more information, see Adding Backup Servers.

3. Retrieve data from added backup servers. For more information, see Collecting Data from Backup Servers.

4. Assign the Portal Administrator, Restore Operator or Portal User roles to users who will work with Veeam
Backup Enterprise Manager. For more information, see Configuring Accounts and Roles.

5. Provide email notification settings to be able to receive emails with summary on performed backup and
replication jobs, lab request status changes and file restore operations. For more information, see
Configuring Notification Settings.

Once you have performed initial configuration, you can start working with managed backup servers. You can
change the necessary settings in the Configuration view at any time.

NOTE

The initial configuration tasks can be performed either by the user who installed Veeam Backup Enterprise
Manager or any of the users listed in the local Administrators group (these accounts are automatically
included in the Portal Administrators group).

86 | V eeam Backup Enterprise Manager | User Guide

Managing Backup Servers
With Veeam Backup Enterprise Manager, you can perform the following actions with backup servers:

• Add backup servers

• Edit backup servers

• Remove backup servers

• View reports on backup servers

• View audit reports

• Collect data from backup servers

Adding Backup Servers

Veeam Backup Enterprise Manager allows users to manage jobs across several Veeam Backup & Replication
servers and perform restore operations with backups using the information from these backup servers.

To add a backup server to the Enterprise Manager infrastructure:

• Log in to Enterprise Manager using an administrative account.

• To open the Configuration view, click Configuration in the top right corner.

• Go to the Ba ckup Servers section on the left.

• Click Ad d at the top of the Ba ckup Servers section.

• In the Ba ckup Server Settings window, enter a full DNS name or IP address of the server you want to add,
and provide a server description.

• Provide a name and password of the user with administrative rights on the added server. The Veeam
Backup Enterprise Manager user must be assigned the Veeam Backup Administrator role on the backup
server. For more information see Configuring Backup Server Roles.

• Specify the port used by Veeam Backup Service. By default, port 9392 is used.

87 | V eeam Backup Enterprise Manager | User Guide

 • Click OK to add the server.

Limitations for Adding Backup Servers

Consider these limitations when you add backup servers to the Veeam Backup Enterprise Manager
infrastructure:

• You must not add a backup server to multiple instances of Veeam Backup Enterprise Manager.

• You must not add a backup server cloned from an added backup server.

• You must not add a backup server that holds the same configuration database as an added backup server,
even after you remove the original backup server from Enterprise Manager. You may have two backup
servers with the same configuration database when, for example, you restore the configuration database
from one backup server to another. In case you want to manage such a backup server with Enterprise
Manager, contact Veeam Customer Support.

• You must not add more than one backup server that has a vCloud Director server in its infrastructure.

• Install the same product version on the Veeam Backup Enterprise Manager server and Veeam backup
servers. If you use different versions of Veeam Backup Enterprise Manager and
Veeam Backup & Replication, you may not be able to leverage all features in Veeam Backup Enterprise
Manager.

Veeam Backup Enterprise Manager supports adding backup servers with Veeam Backup & Replication 9.5
Update 4 and later.

Editing Backup Servers

To edit settings of a server after it was added, select the sever in the Ba ck up Servers list and click E d it on the
toolbar.

Removing Backup Servers

To delete an added Veeam backup server, select it in the Ba ckup Servers list and click Remove on the toolbar.

88 | V eeam Backup Enterprise Manager | User Guide

Collecting Data from Backup Servers
Veeam Backup Enterprise Manager retrieves data from added backup servers using the data collection job. The
data collection job collects information about backup and replication jobs from Veeam Backup & Replication
databases on the managed backup servers. The collected data is stored to the Veeam Backup Enterprise
Manager configuration database and can be accessed by multiple users on the Veeam Backup Enter prise
Manager website.

There are two options for running the data collection job:

• Periodic data collection (default)

• Manual data collection

Every run of the data collection job initiates a new data collection job session. For more information, see Data
Collection Job Sessions.

NOTE
• Data collection job collects data from all added backup servers at once.
• To ensure periodic update of the information available to Veeam Backup Enterprise Manager users,
use periodic data collection.

Periodic Data Collection

By default, Veeam Backup Enterprise Manager collects data from added backup servers every 15 minutes.

To change the data collection interval:

1. Select Ba ckup Servers on the left of the Configuration view and click Schedule on the toolbar.

2. In the Da ta Collection Settings window, specify the desired interval in the P eriodically every option.

3. Click OK.

You can also disable periodic data collection. In this case, you can only start the data collection job manually.

89 | V eeam Backup Enterprise Manager | User Guide

To disable periodic data collection:

1. Select Ba ckup Servers on the left of the Configuration view and click Schedule on the toolbar.

2. In the Da ta Collection Settings window, select the Ma nually option.

3. Click OK.

Manual Data Collection

You can start the data collection job manually at any time.

To start the data collection job manually:

1. Select Ba ckup Servers on the left of the Configuration view.

2. Click Sta rt Collecting on the toolbar.

You can view the details on the started job session in the Sessions section of the Configuration view. For more
information, see Data Collection Job Sessions.

Data Collection Job Sessions

Every run of the data collection job initiates a new data collection job session.

To view details on job sessions:

1. Select Sessions on the left of the Configuration view.

2. In the list of sessions, select the necessary session and click the link in the Sta tus column.

3. In the displayed window, Veeam Backup Enterprise Manager shows the list of the job session events. For
each job session event, Enterprise Manager shows the time of the event, its current status and information
about the event.

90 | V eeam Backup Enterprise Manager | User Guide

Reports on Backup Servers
On the Rep orts tab, you can view statistical information about backup servers added to the Enterprise Manager
infrastructure.

For each backup server, the report contains the following data.

P a rameter Description

Ba ckup Server Name of the backup server.

Sta tus Status of the last data collection job session for the backup server. For more
information on data collection, see Collecting Data from Backup Servers.

Possible values:

• Never processed — data collection has never been started for the
backup server
• Processing — data collection is in progress
• OK — data was collected successfully
• Warning — data collection completed with a warning
• Error — data collection failed

Job s Number of jobs on the backup server.

Ma chines Number of machines processed by the backup server, including the machines
from imported or orphaned backups.

File Shares Number of file shares processed by the backup server, including the file
shares from imported or orphaned backups.

Verification Jobs Count Number of SureBackup jobs on the backup server.

Source Data Size Size of source data processed by the backup server.

Server Description Backup server description that was specified when adding the server to the
Enterprise Manager infrastructure.

You can drill down into this data by clicking a link in the Ba ckup Server column to move through the levels in the
following succession: Backup servers > Jobs > Job sessions > Session details . Each level contains a list of entries
with details for that particular level.

91 | V eeam Backup Enterprise Manager | User Guide

 NOTE

You can export displayed information to a file using the E x p ort link on the toolbar. To open the file on your
machine, use the associated application.

92 | V eeam Backup Enterprise Manager | User Guide

Audit Reports
Audit reports contain records of user activity performed on the selected backup serv er for the specified period.
Users with the Portal Administrator role can generate audit reports for backup servers added to the Veeam
Backup Enterprise Manager infrastructure. For more information, see Generating Audit Report.

Audit reports include the following details about user activity:

• Date and time when a user performed an operation

• User name

• User security identifier (SID)

• Name of the operation performed by the user

• Operation result

• Details on the performed operation

Generating Audit Report

When you generate an audit report, it is downloaded in the CSV format to the local machine.

The generated file is also saved on the Enterprise Manager machine. Enterprise Manager does not clean up
these files. You can find all reports in the following folder: %ProgramData%\Veeam\Backup\WebRestore.

To generate an audit report:

1. Log in to Enterprise Manager using an administrative account.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Ba ckup Servers section, select a backup server whose report you want to export.

4. Click Aud it report.

93 | V eeam Backup Enterprise Manager | User Guide

 5. In the Aud it Report window, specify a time period covered by the report and click Generate.

The report contains only the audit records whose retention period is not expired. The retention period is
defined by the E vent history setting of Enterprise Manager. For more information on retention settings,
see Configuring Retention Settings for Index and History.

94 | V eeam Backup Enterprise Manager | User Guide

Viewing vCenter Servers
On the vCenter Servers tab of the Configuration view, you can view information on vCenter servers added to
your Veeam backup infrastructure.

You can perform the following operations with vCenter servers:

• Check version — use this command to request vCenter server version and operation status. If Veeam plug -
in for vSphere Web Client is deployed, its version, status and installation account will be also displayed.

• Install — use this command to install Veeam plug-in for vSphere Web Client on the selected server. For
details, see Controlling Backup Infrastructure with vSphere Web Client.

• Remove — use this command to uninstall Veeam plug-in for vSphere Web Client from selected server.

IMP ORTANT

To perform these operations, you should supply a user account with sufficient permissions to access
vCenter Server. User account information is not imported from the Veeam Backup & Replication
configuration database to the Enterprise Manager database for security reasons.

95 | V eeam Backup Enterprise Manager | User Guide

Configuring Retention Settings for Index
and History
Veeam Backup Enterprise Manager allows you to configure retention settings for the index files, as well as for
the event history.

• If you are using the Standard edition of Veeam Backup & Replication in your virtual environment, Veeam
Backup Enterprise Manager will keep index files only for those backups that are currently stored on disk
(that is, the backups are available on backup repositories).

• If you are using the Enterprise or Enterprise Plus edition, Veeam Backup Enterprise Manager will keep
index files for backups that are currently stored on disk and for archived backups (for example, backups
that were recorded to tape). Thus, you will be able to browse and search through backup contents even if
the backup in repository is no longer available or it was removed by Remove from Backups or Remove
from Disk command in Veeam Backup console. For more information, see Managing Backups and
Managing Replicas sections of the Veeam Backup & Replication User Guide.

IMP ORTANT

Consider that, by default, backup repository is the primary destination for the search. This means, in
particular, that if a backup (with indexed guest) is stored in both locations — repository and tape — then
Enterprise Manager search results will only include files from b ackup stored in the repository. Files from
tape-archived backup will appear in search results only if not found in the repository.

To configure retention settings:

1. To open the Configuration view, click Configuration in the top right corner.

2. Open the Settings section on the left of the Configuration view.

3. On the Session History tab, in the Guest file system catalog section, specify how long index files must be
stored on the Veeam Backup Enterprise Manager server:

a. Enter the desired number of months in the Retention period, months field. The default value is
3 months, the minimum allowed value is 1 month, and the maximum allowed value is 99 months.

b. When finished, click the Sa ve button under the E vent history section. New retention settings will be
saved in the Enterprise Manager database, and pop -up message notifying you on the update will be
displayed at the top of the window.

4. In the E vent history section, specify the period for which Veeam Backup Enterprise Manager should keep
historical data available in the main working area of the Veeam Backup Enterprise Manager website.

a. Enter the desired number of weeks or select Keep all. By default, the retention period for session data
is set to Keep only last 13 weeks. The minimum allowed value is 1 week, and the maximum allowed
value is 53 weeks.

96 | V eeam Backup Enterprise Manager | User Guide

 b. When finished, click the Sa ve button below the section. New retention settings will be saved in the
Enterprise Manager database, and pop-up message notifying you on the update will be displayed at
the top of the window.

Note that the retention settings you specify in Veeam Backup Enterprise Manager are propagated to all Veeam
backup servers connected to it. These settings override the Session history retention values specified at the
level of the Veeam backup server.

97 | V eeam Backup Enterprise Manager | User Guide

For example, if the retention options of the Veeam backup server are configured to keep the session history for
50 weeks, and in Veeam Backup Enterprise Manager you select to Keep only last 53 weeks, the latter value will
be propagated to the Veeam backup server; so the history will be kept for 53 weeks.

98 | V eeam Backup Enterprise Manager | User Guide

Configuring Security Settings
To establish secure connection with Veeam Backup Enterprise Manager, make sure you configure the following
security settings:

• Configure accounts and roles of Veeam Backup Enterprise Manager

• Configure users and roles on added backup servers

• [Optional] Configure SAML authentication settings

• Update an expired security certificate

99 | V eeam Backup Enterprise Manager | User Guide

Configuring Accounts and Roles
Veeam Backup Enterprise Manager implements security based on user roles by limiting access to features and
data. This empowers the administrator to delegate permissions in a granular way, on an as-needed basis. For
example, the administrator can grant permissions to another user to recover files without being able to see the
content of the files.

Administrators grant users and groups access to Enterprise Manager by adding accounts. When adding an
account, administrators assign a role to the account to provide it with permissions.

Enterprise Manager offers the following roles:

• Portal Administrator

• Portal User

• Restore Operator

For the Portal User and Restore Operator roles, administrators can also configure restore scope and restrictions
for delegated restore.

NOTE

This section describes management of user accounts and roles required to work with the main Enterprise
Manager UI. If you plan to provide a user with access to vSphere Self-Service Backup Portal (and not to the
main Enterprise Manager UI), you do not need to configure an account for this user in the Roles tab of the
Configuration view. Such accounts are configured in the Self-service tab of the Configuration view. For
more information, see Managing Tenant Accounts.

Accounts and Roles Overview

Accounts
Administrators can add accounts to Veeam Backup Enterprise Manager to grant users access to the website.
Enterprise Manager offers the following account types: User, Group, External User and External Group.

Ty p e Description How to Sign In Na me Format

User Local or AD user By specifying a user name and DOMAIN\Username

password
Domain is optional

Group Local or AD group By specifying a user name and DOMAIN\Groupname

password
Domain is optional

E x ternal User IdP user By using single sign-on* Username@Suffix

E x ternal Group IdP group By using single sign-on* Free-form string

* For more information on the single sign-on capability, see SAML Authentication Support.

100 | V eeam Backup Enterprise Manager | User Guide

Roles
To provide an account with permissions, administrators assign one of the following roles to the account: Portal
Administrator, Portal User or Restore Operator.

Role How Is Assigned Access to P ermissions

Configuration

• Initially by default to
P ortal Yes Full access to all available
Ad ministrator the users listed in the operations on all tabs of the web
local Administrators UI
group and the user who
installed Enterprise
Manager
• By Portal Administrator
in Configuration >
Roles

• Access objects from the

P ortal User By Portal Administrator in No
Configuration > Roles restore scope on the
Ma chines and Files tabs
• Run Quick Backup for
machines from the restore
scope on the Ma chines tab
• Perform restore operations
as permitted by the
delegation settings
• View information about all
backup servers and jobs on
the Da shboard, Reports,
Job s and P olicies tabs

• Access objects from the

Restore Operator By Portal Administrator in No
Configuration > Roles restore scope on the
Ma chines and Files tabs
• Perform restore operations
as permitted by the
delegation settings

Users with the Portal User or Restore Operator role can access their restore scope — a list of objects that can be
recovered by appropriate personnel. For example, the restore scope of database administrators is database
servers (SQL, Oracle or other), the restore scope of Exchange administrators is Exchange server machines, and
so on. For more information on configuring restore scope, see Configuring Restore Scope.

101 | V eeam Backup Enterprise Manager | User Guide

 IMP ORTANT

You can customize the restore scope if you have the Enterprise Plus edition of Veeam Backup &
Replication. In other editions, this list includes all objects and cannot be customized. However, you can
delegate recovery of entire machines, guest files, or selected file types. For more information, see
Configuring Restrictions for Delegated Restore.

Managing Accounts
Administrators can perform the following actions with accounts:

• Add account

• Edit account

• Remove account

Adding Account
To add an account:

1. Select the Roles section of the Configuration view.

2. Click Ad d on the toolbar.

3. From the Account type list, select a type of the account: User, Group , External User or External Group . For
more information, see Accounts.

4. In the Account field, specify an account name in the DOMAIN\Username or Username@Suffix format
depending on the account type. For more information, see Accounts.

5. From the Role list, select a role you want to assign to the account: Portal Administrator , Portal User or
Restore Operator . For more information, see Roles.

102 | V eeam Backup Enterprise Manager | User Guide

 NOTE

To be able to assign any of portal roles to Active Directory domain users or groups, make sure that
Veeam Backup Enterprise Manager service account has sufficient rights to enumerate Active
Directory domains (by default, Active Directory users have enough rights to enumerate Active
Directory domains).

6. [For Portal User or Restore Operator] In the Restore scope section, you can allow a user to restore all
objects (machines and file shares) processed by managed backup servers or the selected objects only. For
more information, see Configuring Restore Scope.

In the Allow restore of section, you can configure additional restrictions for the restore scope. For more
information, see Configuring Restrictions for Delegated Restore.

Editing Account
To edit settings of an added user or group, select it in the list of roles and click E d it on the toolbar. Then edit
user or group settings as required.

Removing Account
To remove an added user or group, select it in the list and click Remove on the toolbar.

103 | V eeam Backup Enterprise Manager | User Guide

Configuring Restore Scope
Default restore scope for users with a non-administrative role includes All objects from available backups. If you
have the Enterprise Plus edition of Veeam Backup & Replication deployed in your environment, you can
customize restore scope for non-administrative users.

To narrow the restore scope, perform the following steps when adding or editing a Portal User or Restore
Operator account:

1. Open the Roles section of the Configuration view.

2. Click Ad d to add an account, or select an existing account and click E d it.

3. In the Restore scope section, select the Selected objects only option and click Choose.

104 | V eeam Backup Enterprise Manager | User Guide

 4. In the Ma nage Scope Objects window, click Ad d object and select what type of objects to display. You can
select from the following types: Hyper-V, vSphere, vCloud , Protection Group , File share or Nutanix AHV
object.

5. In the Ad d Objects window, select the objects you allow the user to restore.

To search for an object, type a name or its part in the search field. Specify the type of the object from the
drop-down list next to the search field.

You can also switch between virtual infrastructure views using the buttons in the top right corner:

o For VMware objects, you can switch between the Hosts and Clusters, VMs and Templates, Datastores
a nd VMs and Ta g s and VMs views.

o For Hyper-V objects, you can switch between the Hosts and VMs, Hosts and Volumes, and Hosts and
VM Groups views.

NOTE

For setting up self-service recovery restore scope, consider that reverse DNS lookup on Veeam
Backup Enterprise Manager server must be functional. Otherwise, the Ad d Objects window will
display incomplete infrastructure.

105 | V eeam Backup Enterprise Manager | User Guide

 4. Click OK to save the settings.

After a user logs in to Enterprise Manager, they will be able to view objects and files included in their restore
scope.

NOTE

The Ma chines and File Shares tabs display only machines and file shares that have been backed up. The
Files tab displays guest OS files only for machines that have been backed up with guest file indexing
enabled. For more information on indexing, see Preparing for File Browsing and Searching.

Restore scope is automatically refreshed daily on built-in schedule and after any role modification. It may
happen that some newly created machines, file shares and backups are not yet presented to users in the
Ma chines, File Shares or Files tabs right after the login to Enterprise Manager. If you cannot find an object after
making a search query, click the link I d on’t see my VM to refresh the view. This link, however, will not be visible
until you have made an unsuccessful search.

Administrative user can click Reb uild Roles in the Roles section of Configuration page to refresh all scopes of all
accounts manually. Consider that this operation will affect all configured roles.

Portal Administrators can watch the progress of security scope rebuild process on the Sessions page.

Configuring Restrictions for Delegated Restore

By default, users can restore all types of files from available backups. Files can be restored either to the local
machine or the original location. For security purposes, you can configure additional restrictions for the restore
scope. For example, you can specify the list of file types available to the oper ator or prohibit downloading of
restored files at all.

To restrict the restore operator actions, perform the following steps when adding or editing the account:

1. Open the Roles section of the Configuration view.

2. Click Ad d to add an account, or select an existing account and click E d it.

106 | V eeam Backup Enterprise Manager | User Guide

 3. In the Allow restore of section, to allow restore of entire machines and VM disks of machines included in
the restore scope, select the E ntire machines and disks check box.

4. To allow restore of guest OS files, select the Files and folders check box. If you select this check box, you
can also select the following options:

o Allow in-place file restores only — select this option to allow file-level restore to the original location
only. Consider that the restored files will be available only to accounts that have access to the original
machine.

o Allow restore of files with these extensions only — select this option to define which file types are
allowed for restore. In the text box, enter a list of extensions for allowed file types, separated by
commas.

5. To allow restore of Microsoft Exchange items (mail, calendars, tasks), select the Microsoft Exchange items
check box.

6. To allow restore of databases, select the Da tabases check box. If you select this check box, you can also
select the following options:

o Microsoft SQL Server databases — select this option to allow restore of Microsoft SQL databases on
machines included in the user's restore scope.

o Ora cle databases — select this option to allow restore of Oracle databases on machines included in the
user's restore scope.

o Deny in-place database restores — select this option to restrict the restore operator from overwriting
the original databases during the database restore process.

7. Click OK.

107 | V eeam Backup Enterprise Manager | User Guide

Configuring Backup Server Roles
Veeam Backup Enterprise Manager communicates with backup servers under accounts that you specified when
adding the backup servers. For more information, see Adding Backup Servers.

All operations on the backup server side are performed by Veeam Backup Service. The service verifies
beforehand if the account used by Enterprise Manager has rights to accomplish the necessary actions. For that,
the account must have the Veeam Backup Administrator role assigned in Veeam Backup & Replication.

By default, when you install Veeam Backup & Replication on a backup server, the Veeam Backup Administrator
role is assigned to the Windows Server Administrators group, so you can choose a user from the Administrators
group as an account that will be used to communicate with the backup server. As soon as the group settings can
be changed, it is recommended to explicitly assign the Veeam Backup Administrator role to the user account.
For more information on assigning roles, see the Roles and Users section of the Veeam Backup & Replication
User Guide.

108 | V eeam Backup Enterprise Manager | User Guide

Configuring SAML Authentication Settings
Organizations who use single sign-on (SSO) in their IT infrastructure can allow users to access the Veeam Backup
Enterprise Manager website and vSphere Self-Service Backup Portal with their SSO credentials. To do this, the
Enterprise Manager administrator must configure SAML authentication settings.

NOTE

If SAML authentication is enabled, users can log in to vSphere Self-Service Backup Portal under SSO
accounts only.

To configure SAML authentication settings:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. To open the Configuration view, click Configuration in the top right corner.

3. Open the Settings section of the Configuration view.

4. Click the SAML Authentication tab.

5. Select the E na ble SAML 2.0 option.

6. In the Id entity Provider Configuration section, specify identity provider settings. For more information, see
Specifying Identity Provider Settings.

7. [Optional] If you want to use a certificate to encrypt and sign service provider SAML requests, specify
certificate settings. For more information, see Selecting Service Provider Certificate.

8. [Optional] Click the Ad vanced Settings link and specify advanced SAML authentication settings. For more
information, see Specifying Advanced SAML Authentication Settings.

9. In the E nterprise Manager Configuration section, export or manually copy metadata of the service provider
(the Veeam Backup Enterprise Manager website, vSphere Self-Service Backup Portal, or both) for which
you configure SSO. Use the metadata to register the service provider on the identity provider side. For
more information, see Obtaining Service Provider Settings.

10. Click Sa ve.

After you configure SAML authentication settings, you can register user accounts that will be able to log in to
the Veeam Backup Enterprise Manager website or vSphere Self-Service Backup Portal using SSO. For more
information, see Managing Accounts and Roles and Managing Tenant Accounts.

Specifying Identity Provider Settings

To set up SAML authentication, you must obtain SAML authentication settings from the identity provider and
specify them in Enterprise Manager. You can specify identity provider settings in one of the following ways:

• Import identity provider settings from a SAML metadata file obtained from the identity provider.

• Specify identity provider settings manually.

To import identity provider settings from the SAML metadata file, in the Id entity P rovider Configuration section
of the SAML Authentication view, click the Imp ort from File link and browse to the metadata file. The metadata
file structure must conform to the SAML 2.0 Metadata Schema.

109 | V eeam Backup Enterprise Manager | User Guide

Alternatively, you can specify identity provider settings manually:

1. In the Id entity Provider Configuration section, in the E ntity ID field, specify a unique ID of the identity
provider.

2. In the Log in URL field, specify the URL of the single sign-on login page provided by the identity provider.

3. From the Binding list, select a SAML binding used by the identity provider to send SAML r esponses:
HttpRedirect or HttpPost.

4. In the Id P certificate field, specify a certificate that will be used to validate the signature of the signed
authentication assertions and decrypt assertions sent by the identity provider.

NOTE

Veeam Backup Enterprise Manager does not support identity provider certificate rollover.

Selecting Service Provider Certificate

If you want to sign and encrypt authentication requests sent from Veeam Backup Enterprise Manager to the
identity provider, you must select a certificate with a private key that will be used for encryption and signing. To
select a certificate:

1. In the E nterprise Manager Configuration section of the SAML Authentication view, click the Select link
next to the Certificate field.

2. In the Select Service Provider Certificate window, Veeam Backup Enterprise Manager will display
certificates located in the certificate store on the Enterprise Manager server. Choose the necessary
certificate from the list and click Select.

If you use a certificate to sign end encrypt SAML authentication requests, you must pass the public key
certificate to the identity provider. The identity provider will use this certificate to encrypt requests and validate
the request signature. For more information, see Obtaining Service Provider Settings.

110 | V eeam Backup Enterprise Manager | User Guide

 TIP

Consider the following:

• To change the service provider certificate, click the Remove link next to the Certificate field. Then
select another certificate from the certificate store.
• You can choose whether to include the certificate in the service provider metadata. For more
information, see Specifying Advanced SAML Authentication Settings.

Specifying Advanced SAML Authentication Settings

In the SAML Advanced Settings window you can specify advanced settings for SAML authentication.

1. To include in the service provider SAML metadata a security certificate required to decrypt service
provider authentication requests, select the Include encryption certificate in metadata check box.

2. To validate the signature of the signed requests, select the Include signing certificate in metadata check
box.

3. From the Minimum accepted incoming signing algorithm and Outbound sign algorithm lists, select what
type of signed requests and responses Enterprise Manager will be able to send and receive. By default, the
SHA256 option is selected. With this option selected, Enterprise Manager will send and receive requests
and responses signed using the SHA256 or stronger algorithm.

4. By default, to provide for single sign-on authentication for groups of users, Veeam Backup Enterprise
Manager accepts information about groups from the identity provider in statements of the Group type. If
it is required to use for this purpose statements of a different type, in the Group claim type field, specify
the necessary type.

5. If you want to sign authentication requests sent from Enterprise Manager to the identity provider with a
digital certificate, in the Id entity Provider Settings section, select the Sig n AuthnRequests to IdP check
box.

6. From the Authentication context comparison list, select a comparison method for authentication context:
Exact, Minimum, Maximum or Better.

7. From the Authentication context class list, select one of the classes to specify an authentication method
used by the Identity Provider. For example, for VMware Platform Services Controller, select
PasswordProtectedTransport. By default, the Password option is selected.

111 | V eeam Backup Enterprise Manager | User Guide

 8. Click Ap p ly.

Obtaining Service Provider Settings

To set up SAML authentication for the Veeam Backup Enterprise Manager website and vSphere Self -Service
Backup Portal, you need to register each of them individually as a service provider on the identity provider side.
To do this, you need to obtain service provider settings and pass them to the identity provider.

You can obtain service provider settings in one of the following ways:

• Export service provider settings to an XML file

• Copy service provider settings

Exporting Service Provider Settings

You can export settings of each service provider to a SAML metadata file — an XML file that conforms to the
SAML 2.0 Metadata Schema. If you plan to use a certificate to sign end encrypt SAML authentication requests,
and need to pass the public key certificate to the identity provider, you must include the certificate in the
metadata file. For more information, see Specifying Advanced SAML Authentication Settings.

• To export service provider settings of the Veeam Backup Enterprise Manager website, click the Download
link next to the Veea m Backup Enterprise Manager field.

• To export service provider settings of vSphere Self-Service Backup Portal, click the Download link next to
the vSp here Self-Service Backup P ortal field.

Copying Service Provider Settings

To copy service provider settings:

1. Copy the links next to the SP E ntity ID / Issuer and Assertion consumer URL fields.

2. If you have selected a certificate that will be used to sign end encrypt SAML authentication requests, you
must also pass the public key certificate to the identity provider. To copy the certificate, click the
Download link next to the Certificate field.

112 | V eeam Backup Enterprise Manager | User Guide

Updating Security Certificate
Security certificate ensures secure connection with the Veeam Backup Enterprise Manager website using HTTPS.
You can specify path to existing certificate or generate a new self-signed certificate during Enterprise Manager
installation. In case of installing on the same machine with Enterprise Manager, this certificate will be also used
by Veeam plug-in for vSphere Web Client and REST API client to receive data using HTTPS protocol.

• To update the Enterprise Manager certificate, you can use Internet Information Services (IIS) Manager. For
more information, see this Microsoft Docs article.

• To update the Enterprise Manager REST API certificate, use the netsh command. For more information,
see the TLS Certificate section of the Veeam Backup Enterprise Manager REST API Reference.

113 | V eeam Backup Enterprise Manager | User Guide

Configuring Notification Settings
You can configure Veeam Backup Enterprise Manager to send email notifications.

To receive email notifications, configure SMTP server settings. For more information, see Email Server Settings.

After that, you can switch on or off the necessary notifications. You can configure the following notifications:

• Job Summary

• Lab Requests

• Restore Operations

• License Information

• Key Management

114 | V eeam Backup Enterprise Manager | User Guide

Email Server Settings
SMTP server is a server that is used for sending emails to the specified email address.

To configure email server settings:

1. Open the Notifications section of the Configuration view.

2. On the Server Settings tab, specify a full DNS name or IP address of the SMTP server. If necessary, change
the port number that will be used to communicate with the mail server. The default port number is 25.

3. In the Timeout field, specify a timeout for email server — this should be a value from 1 to 3600 seconds.
Default is 100 seconds.

4. If the SMTP server requires SSL connection, select the Use SSL check box.

5. If the SMTP server requires authentication, select the Requires authentication check box and specify
authentication credentials.

6. Click Sa ve.

115 | V eeam Backup Enterprise Manager | User Guide

Notifications on Job Results
You can configure Veeam Backup Enterprise Manager to send daily notification emails with the results of
finished jobs. The notification email contains a report about the number of jobs performed with the Error,
Warning and Success statuses, and provides a link to the Veeam Backup Enterprise Manager web UI so that you
can see jobs statistics in detail.

To receive daily email notifications about job results, do the following:

1. Open the Notifications section of the Configuration view.

2. Open the Job Summary tab.

3. Select the Send daily notification at check box and specify the time when you want a notification email to
be sent.

4. In the From field, enter an email address of the notification sender.

5. In the To field, enter an email address of the notification recipient. Use a comma to specify multiple
addresses.

6. In the Sub ject field, enter a subject of email notifications. You can use the following variables in the
subject:

o %1 — number of jobs that ended with errors for the last 24 hours

o %2 — number of jobs that ended with warnings for the last 24 hours

o %3 — number of jobs that ended successfully for the last 24 hours

Job retries performed in the last 24 hours are also included in the report.

o %4 — number of jobs whose last session ended with an error.

o %5 — number of jobs whose last session ended with a warning.

o %6 — number of jobs whose last session ended successfully.

Jobs which were in Disabled state during the last session are also included in the report.

7. Click Sa ve.

116 | V eeam Backup Enterprise Manager | User Guide

 TIP

To verify that you have configured email settings correctly, click Test. Veeam Backup Enterprise Manager
will send a test email to all specified email addresses.

117 | V eeam Backup Enterprise Manager | User Guide

Notifications on Lab Requests
You can configure Veeam Backup Enterprise Manager to send notification emails about virtual lab requests
created by users who need to perform universal application item-level restore.

To receive notifications about lab requests, do the following:

1. Open the Notifications section of the Configuration view.

2. Open the La b Requests tab.

3. Select the Send lab request notifications check box.

4. In the From field, enter an email address of the notification sender.

5. In the To field, enter an email address of the notification recipient. Use a comma to specify multiple
addresses.

6. Specify the subject of the email message.

7. Select request statuses for a report. The notification email will be sent if the request is P ending, Ready,
Ca nceled, Ap proved, Failed or Stopped.

8. Click Sa ve.

TIP

To verify that you have configured email settings correctly, click Test. Veeam Backup Enterprise Manager
will send a test email to all specified email addresses.

For more information about the universal application item-level restore, see Veeam Universal Application Item
Recovery Guide.

118 | V eeam Backup Enterprise Manager | User Guide

Notifications on Restore Operations
You can configure Veeam Backup Enterprise Manager to send notification emails about performed file r estore
operations.

To receive notifications about performed file restore operations, do the following:

1. Open the Notifications section of the Configuration view.

2. Open the Restore Operations tab.

3. Select Send notifications on restore operations.

4. In the From field, enter an email address of the notification sender.

5. In the To field, enter an email address of the notification recipient. Use a comma to specify multiple
addresses.

6. Click Sa ve.

TIP

To verify that you have configured email settings correctly, click Test. Veeam Backup Enterprise Manager
will send a test email to all specified email addresses.

119 | V eeam Backup Enterprise Manager | User Guide

Notifications on Licensing
You can configure Veeam Backup Enterprise Manager to send the following email notifications:

• Notifications on product updates

• [For perpetual licenses] Notifications on support contract expiration

• [For rental licenses] Notifications on license usage

Notifications on Product Updates

By default, Veeam Backup Enterprise Manager checks periodically and notifies you about new product versions
and patches available on the Veeam website. Leave the update notifications enabled so you do not miss critical
updates and patches.

To disable notifications on product updates:

1. Open the Notifications section of the Configuration view.

2. Open the License Information tab.

3. Select the Check for product and hypervisor updates periodically check box.

Notifications on Support Contract Expiration

If you have a perpetual license installed and your support contract is expired, Veeam Backup Enterprise Manager
adds the SUPPORT EXPIRED prefix to the subject of all its email messages. You can configure Enterprise
Manager to remove the prefix.

To remove the SUPPORT EXPIRED prefix from the message subject:

1. Open the Notifications section of the Configuration view.

2. Open the License Information tab.

3. Select the Disable support contract expiration notifications check box.

Notifications on License Usage

If you have a rental license installed, you can configure Veeam Backup Enterprise Manager to send email
notifications on license usage. Every notification contains a monthly usage report about instances used for
backup and replication in the previous month. For more information on the reports, see Managing Monthly
Usage Reports.

Enterprise Manager sends notifications on license usage on the first day of the month. If
Veeam Backup & Replication does not perform any backup and replication jobs for the whole month, Enterprise
Manager does not send the notifications.

To enable email notifications on license usage:

1. Open the Notifications section of the Configuration view.

2. Open the License Information tab.

3. Select the Send notifications on license usage check box.

4. In the From field, enter an email address of the notification sender.

120 | V eeam Backup Enterprise Manager | User Guide

 5. In the To field, enter an email address of the notification recipient. Use a comma to specify multiple
addresses.

6. Click Sa ve.

TIP

To verify that you have configured email settings correctly, click Test. Veeam Backup Enterprise Manager
will send a test email message to all specified email addresses.

121 | V eeam Backup Enterprise Manager | User Guide

Notifications on Key Management
Veeam Backup Enterprise Manager allows you to perform operations with encryption keys. For more
information, see Managing Encryption Keys.

You can configure Enterprise Manager to send notifications about the following key mana gement operations:
key expiration, key deletion, key modification.

To receive key management notifications, do the following:

1. Open the Notifications section of the Configuration view.

2. Open the Key Management tab.

3. Select the Send notifications on key management operations check box.

4. In the From field, enter an email address of the notification sender.

5. In the To field, enter an email address of the notification recipient. Use a comma to specify multiple
addresses.

6. Click Sa ve.

TIP

To verify that you have configured email settings correctly, click Test. Veeam Backup Enterprise Manager
will send a test email to all specified email addresses.

122 | V eeam Backup Enterprise Manager | User Guide

Viewing Information About Enterprise
Manager
You can view detailed information about Enterprise Mana ger and its components, URLs of REST API and Veeam
Self-Service File Restore Portal, as well as the paths to the Enterprise Manager logs.

To view information about Enterprise Manager:

1. Log in to Enterprise Manager using an administrative account.

2. Open the Ab out section of the Configuration view.

The Enterprise Manager log files are available at the following paths:

• Veeam Backup Enterprise Manager Service logs

C:\ProgramData\Veeam\Backup\Svc.VeeamBES.log

• Veeam Guest Catalog Service logs

C:\ProgramData\Veeam\Backup\Svc.VeeamCatalog.log

• Enterprise Manager website logs

C:\ProgramData\Veeam\Backup\Veeam.WebApp.log

123 | V eeam Backup Enterprise Manager | User Guide

Managing Languages
Veeam Backup Enterprise Manager interface is available in several languages. You can select a language for the
following Veeam Backup Enterprise Manager components:

• Veeam Backup Enterprise Manager website

• Veeam Self-Service Backup Portal

• vSphere Self-Service Backup Portal

Available Languages
Veeam Backup Enterprise Manager is available in the following languages:

• Chinese (Simplified, PRC)

• English

• French

• German

• Italian

• Japanese

• Spanish

Selecting Language
The first time you visit one of the Veeam Backup Enterprise Manager components, the content is displayed in
the language of your browser. If the website does not support the browser language, the interface is displayed
in English.

You can select a preferred language from the drop -down list on the login page. If the language you need is not
available, you can add it. For more information, see Adding Languages.

124 | V eeam Backup Enterprise Manager | User Guide

Language Files Overview
To support multiple languages, Veeam Backup Enterprise Manager uses the GNU gettext tools. Veeam Backup
Enterprise Manager languages are stored in POT, JSON and PO files. The files are located in the lang folder on
the Enterprise Manager server. By default, the path to the folder is the following:
%PROGRAMFILES%\Veeam\Backup and Replication\Enterprise
Manager\WebApp\scripts\build\production\resources\lang.

All files names must follow the naming conventions. For more information, see File Names.

File Formats
Enterprise Manager languages are stored in text files of the following formats:

• POT files that contain UI texts in the source language. The source language of Enterprise Manager is
English.

• [Optional] PO files that contain UI texts as pairs of strings: source string and its translation. Each language
is stored in a separate file. You can create PO files from the POT files and use them in the translation
process. After you finish the translation, you must convert PO files to the JSON format.

• JSON files that contain UI texts as pairs of strings: source string and its translation. Enterprise Manager
uses these files to display the interface in a language other than English.

File Names
In order for Veeam Backup Enterprise Manager to recognize files within the lang folder as language files, their
names must follow the naming conventions.

POT files must have the following names:

• messages.pot — file used for the Veeam Backup Enterprise Manager website

• vcloud_messages.pot — file used for Veeam Self-Service Backup Portal

• vsphere_messages.pot — file used for vSphere Self-Service Backup Portal

JSON files must have the following names:

• messages.<code>.json — file used for the Veeam Backup Enterprise Manager website

• vcloud_messages.<code>.json — file used for Veeam Self-Service Backup Portal

• vsphere_messages.<code>.json — file used for vSphere Self-Service Backup Portal

where <code> is an ISO 639-1 code that represents the language. The code consists of a two-letter lowercase
culture code and optional two-letter uppercase region code. For example: en, fr-CA, fr-FR, pt-BR or pt-PT.

125 | V eeam Backup Enterprise Manager | User Guide

Adding Languages
Veeam Backup Enterprise Manager is available in several languages. If the language you need is not available,
you can add it. Before you start adding new languages, check whether the languages are supported by the
server where Veeam Backup Enterprise Manager is deployed.

To check whether a language is supported, run the following command:

New-Object -TypeName 'System.Globalization.CultureInfo' -ArgumentList "<code>"

where <code> is an ISO 639-1 code that represents the language. The code consists of a two-letter lowercase
culture code and optional two-letter uppercase region code. For example: en, fr-CA, fr-FR, pt-BR or pt-PT.

To add new languages:

1. Translate source UI texts to the new languages.

For more information, see Translating Source Texts.

2. Convert the translation files.

For more information, see Converting PO to JSON.

3. Save the translation files to the lang folder. The default path is the following:
%PROGRAMFILES%\Veeam\Backup and Replication\Enterprise
Manager\WebApp\scripts\build\production\resources\lang.

IMP ORTANT

Make sure the JSON translation files are named as follows: messages.xx.json,
vcloud_messages.xx.json, vsphere_messages.xx.json. For more information on file
naming, see File Names.

4. In IIS Manager, restart the VeeamBackup website and recycle the VeeamBackup application pool. For more
information, see the Site <site> and Recycling Settings for an Application Pool <recycling> sections of
Microsoft Docs.

Translating Source Texts

Source texts are stored in POT files. The files are located in the lang folder on the Enterprise Manager server.
By default, the path to the folder is the following: %PROGRAMFILES%\Veeam\Backup and
Replication\Enterprise Manager\WebApp\scripts\build\production\resources\lang.

To translate source texts:

1. Get the source files from the lang folder:

o messages.pot

o vcloud_messages.pot

o vsphere_messages.pot

For more information on file names and formats, see Language Files Overview.

126 | V eeam Backup Enterprise Manager | User Guide

 2. For each language, create PO files using the POT files as templates.

For more information, see this GNU gettext article.

3. Name the PO files as follows:

o messages.<code>.po

o vcloud_messages.<code>.po

o vsphere_messages.<code>.po

For more information, see File Names.

4. Translate PO files in a text editor or a CAT tool.

For more information on PO files, see PO File Structure.

TIP

Although PO files are not used by Veeam Backup Enterprise Manager, you can save them in the lang
folder to keep them together with other language files.

PO File Structure
Each PO file contains the following elements:

• Header

• Translation entries

Header
Header contains meta data of the PO file: language code in the ISO 639-1 format, content type and encoding,
and plural form information.

P a rameter Description

La nguage ISO 639-1 code of the translation language.

MIME-Version MIME version. Set it to 1.0.

Content-Type Content type and character encoding used for the translation language. Set the
type value to text/plain. You can use the UTF-8 encoding for any language.

Content-Transfer- Content transfer encoding. Set the value to 8bit.

E ncoding:

P lural-Forms Number of plural forms and the plural form formula of the translation language.

127 | V eeam Backup Enterprise Manager | User Guide

For example:

"Project-Id-Version: \n"
"POT-Creation-Date: \n"
"PO-Revision-Date: \n"
"Language-Team: \n"
"Language: de\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Plural-Forms: nplurals=2; plural=(n != 1);\n"
"X-Generator: \n"

For more information on the PO header, see this GNU gettext article.

Translation entries
In a PO file, translation entries are separated with a blank string. Each entry consists of the following elements:

• msgid — string in the source language

• [Optional] msgid_plural — plural form of the msgid string

• msgstr — string in the translation language

Before you begin translating, consider the following:

• Do not modify msgid strings. They are references to the source code. Veeam Backup Enterprise Manager
uses them to find their translation.

• If an msgid string contains variables, do not translate them.

Variables are placed inside braces. For example, the following entry contains the restoreItemsCount
variable:

msgid "Pending restore ({restoreItemsCount} items)"

msgstr "Ausstehende Wiederherstellung ({restoreItemsCount} Elemente)"

• If an msgid string is followed by its plural form msgid_plural, provide translation for each form.

For example:

msgid "${ pointsCount } point"

msgid_plural "${ pointsCount } points"
msgstr[0] "${ pointsCount } Punkt"
msgstr[1] "${ pointsCount } Punkte"

For more information on translating plural forms, see this GNU gettext article.

Converting PO to JSON
Veeam Backup Enterprise Manager loads translated strings from JSON files. After you finish translating PO files,
convert them to the JSON format.

128 | V eeam Backup Enterprise Manager | User Guide

To convert a file from the PO format to the JSON format, use the
Veeam.Backup.Localization.PoConverter.exe utility.

1. To locate the utility, use the cd command. By default, the utility is located in the Enterprise Manager
folder.

cd '<path>'

where <path> is a path to the utility file.

For example:

cd 'C:\Program Files\Veeam\Backup and Replication\Enterprise Manager'

2. Run the utility with the following command:

.\Veeam.Backup.Localization.PoConverter.exe '<po_file>'

where <po_file> is a path to the PO file.

For example:

.\Veeam.Backup.Localization.PoConverter.exe 'C:\Program Files\Veeam\Backup

and Replication\Enterprise Manager\WebApp\scripts\build\production\resourc
es\lang\messages.zh_CN.po'

The JSON file will be created in the folder of the PO file.

TIP

To view help for the Veeam.Backup.Localization.PoConverter.exe utility, run the utility with the /help
parameter.

129 | V eeam Backup Enterprise Manager | User Guide

Managing Jobs
Veeam Backup Enterprise Manager acts as a single point for managing jobs from all added backup servers. Users
with the Portal Administrator role can centrally manage jobs that have been previously configured on added
backup servers: start, stop, retry, clone, delete jobs and edit selective job settings.

Consider the following limitations:

• For Nutanix AHV VMs, Enterprise Manager displays only backup copy jobs.

• For physical machines, Enterprise Manager displays the following job types:

o Backup copy jobs.

o Veeam Agent backup jobs managed by the backup server. For more information, see Support for
Veeam Agents.

130 | V eeam Backup Enterprise Manager | User Guide

Viewing Jobs
From Veeam Backup Enterprise Manager, you can view information about jobs configured on all backup servers
added to Enterprise Manager. To view the jobs, open the Job s tab. Every job in the list is described with the
following data: job name, type, platform of the objects it processes, backup server on which the job was
created, current job status, date of the latest run, date of the next run (if the job is scheduled) and job
description.

To quickly find a job, you can use filters and the search field.

• To filter the list of jobs:

o Use the Ba ckup server drop-down list to view the jobs of the selected backup server only.

o Use the Sta tus filter to view the jobs with the selected job statuses.

Once you have selected necessary statuses, click the Ap p ly button to apply the filter.

• To find a job by its name, use the search field.

Besides the information presented in the list of jobs, the Job s tab allows you to view advanced job data:

• To see a list of job sessions, click the job name link in the Na me column.

• To see detailed statistics on the last job run, click the state link in the Sta tus column.

NOTE

You can export displayed information to a file using the E x p ort link on the toolbar. This file then can be
opened on the client machine using the associated application.

131 | V eeam Backup Enterprise Manager | User Guide

Starting, Stopping and Retrying Jobs
Users with the Portal Administrator role can control backup and replication jobs without the need to access the
Veeam Backup & Replication console on the backup server.

On the Job s tab, you can start, stop or retry a job.

• To start a job, select the job from the list and click Sta rt.

• To stop a job, select the job from the list and click Stop .

• To retry a failed job, select the job from the list and click Retry.

NOTE

• For more information on starting a backup copy job, see the Starting Backup Copy Jobs Manually
section of the Veeam Backup & Replication User Guide.

• For more information on starting and stopping an Oracle or SQL server backup job with transaction
log processing enabled, see the Starting and Stopping Transaction Log Backup Jobs section of the
Veeam Backup & Replication User Guide.

132 | V eeam Backup Enterprise Manager | User Guide

Enabling and Disabling Jobs
Veeam Backup Enterprise Manager allows you to enable and disable jobs of the following types:

• Scheduled backup jobs

Disabled backup jobs do not start by the specified schedule. When you disable a job that backs up
Microsoft SQL Server or Oracle VMs, transaction log processing (if enabled for that job) will be also
disabled.

• Scheduled replication jobs

Disabled replication jobs are not started by the specified schedule.

• Backup copy jobs

Disabled backup copy jobs do not monitor source backup repositories and do not copy restore points to
the target backup repository.

To enable or disable a job:

1. On the Job s tab, select a job from the list.

2. On the toolbar, click Job .

3. Select E na ble or Disable from the list of commands.

133 | V eeam Backup Enterprise Manager | User Guide

Editing Jobs
Users with the Portal Administrator role can modify settings of VMware and Hyper -V backup and replication
jobs that have been previously configured on backup servers connected to Veeam Backup Enterprise Manager.
In Enterprise Manager, you can change only a subset of the job settings. To edit other job settings, use the
Veeam Backup & Replication console.

IMP ORTANT
• You can edit jobs if you have an Enterprise or Enterprise Plus license installed.
• From Veeam Backup Enterprise Manager, you cannot edit jobs that are managed by backup servers of
earlier versions as well as Veeam Agent backup jobs, file share backup jobs, and backup copy jobs. To
edit settings of such jobs, use the Veeam Backup & Replication console.

In Veeam Backup Enterprise Manager, you can change the following job settings:

• Change a job name, description and retention settings for the restore points.

• Manage a list of machines that the job should process (add and remove machines or containers, exclude
individual machines from containers, change the order in which the job will process machines).

• Configure guest processing settings.

• Change a job schedule.

The changes take effect with the next job run.

NOTE

If the Location properties of the source object and target object do not match, you will receive a warning
message after you finish editing. For example, you may have a backup job targeted at repository located in
Sydney, and source machines located in London.

To edit a job, use the E d it Backup Job (or E d it Replication Job) wizard.

1. Launch the wizard for job editing

2. Edit job name and retention settings

3. Edit the list of VMs

4. Change the VM processing order

5. Configure guest processing settings

6. Edit job scheduling settings

134 | V eeam Backup Enterprise Manager | User Guide

Step 1. Launch Wizard
To launch the wizard for job editing:

1. Open the Job s tab and select the necessary job in the list.

2. On the toolbar, click Job to expand the list of available actions.

3. Select E d it.

135 | V eeam Backup Enterprise Manager | User Guide

Step 2. Edit Job Name and Retention Settings
At the Job Settings step of the wizard, you can modify name and description for the selected job, as well as its
retention policy.

1. In the Job name field, enter a name for the job.

2. In the Description field, provide an optional description for future reference. The default description
contains information about the user who created the job, date and time when the job was created.

3. Specify backup retention policy settings:

o From the Retention p olicy list, select Restore points and specify the number of restore points that you
want to store in the backup repository. When this number is exceeded, the earliest restore point will
be removed from the backup chain.

o From the Retention p olicy list, select Days and specify the number of days for which you want to store
restore points in the backup repository. After this period is over, a restore point will be removed from
the backup chain.

For more information on retention, see the Short-Term Retention Policy section of the Veeam Backup &
Replication User Guide. Also, see this Veeam KB article.

4. To use the GFS (Grandfather-Father-Son) retention scheme, select the Keep certain full backups l onger
for archival purposes check box and click Configure. In the Configure GFS window, specify how often full
backups are retained. For more information, see the Long-Term Retention Policy (GFS) section of the
Veeam Backup & Replication User Guide.

136 | V eeam Backup Enterprise Manager | User Guide

Step 3. Edit List of VMs
At the Virtual Machines step of the wizard, you can add or remove individual VMs or VM containers, for example,
entire hosts or clusters. Jobs with VM containers are dynamic in their nature: if a new machine is added to the
container after the job is created, the job is automatically updated to include the added machine.

NOTE
• For vCD backup jobs, you can add and remove the following vCD objects: VMs, vApps, organization
vDCs, organizations and the vCD instance. The scope depends on your vCD access rights.
• For vCD replication jobs, you cannot add or remove single VMs. You can manage only vApps and
other vCD containers.

Adding VMs and VM containers

To add a VM or a VM container:

1. Click the Ad d .

137 | V eeam Backup Enterprise Manager | User Guide

 2. In the virtual infrastructure tree, select the necessary VMs or VM containers.

If you select a VM container and later add a new VM to the container, Veeam Backup & Replication will
update job settings automatically to include the VM.

TIP

To quickly find the necessary objects, you can do the following:

• Search for objects: type a name or part of a name in the search field. Specify the type of the
object from a scroll list next to the search field.
• Switch between virtual infrastructure views using the buttons in the top right corner:
o For VMware objects, you can switch between the Hosts and Clusters, VMs and Templates,
Da tastores and VMs and Ta gs and VMs views.
o For Hyper-V objects, you can switch between the Hosts and VMs, Hosts and Volumes, and
Hosts and VM Groups views.

3. Click OK to save the changes.

Removing VMs and VM containers

To remove a VM or VM container, select it in the list and click Remove.

Excluding VMs
You can also exclude individual VMs from VM containers (for example, if you need to back up the whole VMware
or Hyper-V server except several machines running on this server).

To exclude VMs from a VM container:

1. Select a VM container in the list and click E x clusions.

2. In the E x clusions window, click Ad d and select machines that you want to exclude.

138 | V eeam Backup Enterprise Manager | User Guide

Step 4. Change VM Processing Order
At the Virtual Machines step of the wizard, you can change the VM processing order. It can be helpful if specific
VMs must be processed first, if you want to ensure that processing of a MV does not overlap with other
scheduled activities, or that VM processing is completed before the certain time.

To change the VM processing order, select the necessary machines and move them up or down the list using the
Up and Down buttons on the right. In the same manner, you can set the backup order for containers in the
backup list.

NOTE
• VMs inside a VM container are processed at random. To ensure that VMs are processed in the defined
order, add them as standalone VMs, not as a part of containers.
• The processing order may differ from the order that you have defined. For ex ample, if resources of a
VM that is higher in the priority are not available, and resources of a VM that is lower in the priority
are available, the VM with the lower priority will be processed first.
• For vCD backup jobs you can change the order of the following vCD objects: VMs, vApps,
organization vDCs, organizations and the vCD instance. The scope depends on your vCD access rights.
• For vCD replication jobs, you cannot change the VM processing order. You can manage only vApps
and other vCD containers.

139 | V eeam Backup Enterprise Manager | User Guide

Step 5. Configure Guest Processing Settings
At the Guest Processing step of the wizard, you can select to create a transactionally consistent backup,
configure transaction log handling settings, and enable guest file system indexing.

Application-Aware Processing
If VMs run Microsoft Active Directory, Microsoft SQL Server, Microsoft SharePoint, Microsoft Exchange or
Oracle, you can enable application-aware processing to create transactionally consistent backups or replicas.
The transactionally consistent replicas guarantee proper recovery of applications without data loss.

To configure application-aware processing:

1. Select the E na ble application-aware processing check box.

2. Click the Customize Application link.

3. To define custom settings for a machine in the list, select it and click E d it.

Consider the following:

o To customize settings of a machine added to the job as part of a container, add the machine as a
standalone instance. For that, click Ad d machine and choose the necessary VM. Next, select the
machine from the list and click E d it to customize VM settings.

o To discard custom settings of a machine, select the machine in the list and click Remove.

4. Configure the necessary settings for the selected applica tion server:

o General Settings

o SQL Server Processing Settings

o Oracle Server Processing Settings

o File Exclusions

140 | V eeam Backup Enterprise Manager | User Guide

General Settings
Applications Section
In this section, select the option that corresponds to a transactionally-consistent backup creation scenario of
your choice:

• Select Require successful processing (default option) if you want Veeam Backup & Replication to stop the
backup job if an error occurs.

• Select Try application processing, but ignore failures if you want to continue the backup process even if an
error occurs. This option guarantees completion of the job. The created backup image will not be
transactionally consistent, but rather crash-consistent.

• Select Disable application processing if you do not want to enable application-aware processing for the
VM. This option makes the Tra nsaction Logs Processing section unavailable.

Transaction Logs Processing Section

In this section, specify whether this job should process transaction logs upon a successful backup:

• Select P rocess transaction logs with this job if you want Veeam Backup & Replication to handle transaction
logs. With this option enabled (default setting), Veeam will support log pruning for Microsoft Exchange
and Microsoft SQL Servers, as well as for Oracle databases archived logs:

o Truncation of transaction logs for Microsoft Exchange Server machines will be performed after the job
completes successfully: the Veeam runtime process will wait for the machine backup to complete and
then trigger truncation of transaction logs. If truncation of transaction logs is not possible for some
reason, the logs will remain untouched in the machine guest OS until the next start of the Veeam
runtime process.

o Settings for SQL Server transaction log handling can be configured separately on the SQL tab — it
becomes available to you with this option selected.

o Similarly, you can configure settings for Oracle database archived logs processing on the Ora cle tab.

• Select P erform copy only if you want to use native application means or a third-party tool to process
transaction logs. Veeam Backup & Replication will create a copy-only backup for the selected machine.
The copy-only backup preserves a chain of full/differential backup files and transaction logs, so Veeam
Backup & Replication will not trigger transaction log truncation. This option is recommended if you are
using another backup tool to perform the machine guest-level backup, and this tool maintains consistency
of the database state. To learn more, see the Guest Processing section of the Veeam Backup & Replication
User Guide.

141 | V eeam Backup Enterprise Manager | User Guide

 NOTE

With this option selected, the SQL and Ora cle tabs are not available.

SQL Server Processing Settings

For more information on configuring Microsoft SQL Server processing settings, see Backup and Restore of
Microsoft SQL Server Databases.

Oracle Server Processing Settings

For more information on configuring Ora cle processing settings, see Backup and Restore of Oracle Databases.

File Exclusions
On the File Exclusions tab, specify whether to exclude or include specific files in the backup. Exclusions can help
decrease the backup file size. However, selective processing takes additional time that depends on the number
of excluded files; also, it requires obtaining per-file metadata (stored in backups). Thus, it is recommended to
use this option for excluding large files. By default, exclusions are disabled.

• E x clude the following files and folders — with this option selected, you can specify what files and folders
must be excluded from the backup.

• Include only the following files and folders — with this option selected, you can specify exactly what files
and folders must be only included in the backup.

142 | V eeam Backup Enterprise Manager | User Guide

Click Ad d and specify what files and folders you want to include or exclude.

To form the list of exclusions or inclusions, you can use full paths to files and folders, environmental variables,
and file masks with the asterisk (*) and question mark (?) characters. For more information, see the VM Guest OS
Files section of the Veeam Backup & Replication User Guide.

Guest OS File Indexing

To quickly find the necessary guest OS files in backups, select the E na ble guest file system indexing check box.
This setting provides, in particular, advanced search capabilities when viewing guest OS files and performing 1-
Click file restore using Enterprise Manager web UI. If indexing is disabled, you can only use quick search within
the selected restore point.

NOTE

For proper file indexing of Linux machines, Veeam Backup & Replication requires several utilities to be
installed on the machines: mlocate, gzip, and tar. If these utilities are not found, you are prompted to
deploy them to support index creation.

To provide granular indexing options for individual machines:

1. Click the Customize Indexing link.

2. In the Guest File System Indexing Options window, select a machine from the list and click E d it.

Consider the following:

o To customize settings of a machine added to the job as part of a container, add the machine as a
standalone instance. For that, click Ad d Machine and choose the necessary VM. Next, select the
machine from the list and click E d it to customize VM settings.

143 | V eeam Backup Enterprise Manager | User Guide

 o To discard custom settings of a machine, select it from the list and click Remove.

3. In the Ind exing Settings window displayed for the selected machine, go to the W ind ows or Linux tab and
specify what files should be indexed:

o Select Disable indexing if you do not want to index guest OS files of the machine.

o Select Ind ex everything if you want to index all guest OS files inside the machine.

o Select Ind ex everything except folders if you want to index all guest OS files except those defined in
the list. By default, system folders are excluded from indexing. You can add or delete folders to
exclude using the Ad d and Remove buttons.

144 | V eeam Backup Enterprise Manager | User Guide

 o Select Ind ex only following folders to select specific folders that you want to index. To form the list
of folders, use the Ad d and Remove buttons.

4. Click OK to save the settings and close the window.

Guest OS Credentials
To coordinate guest processing activities, Veeam Backup & Replication deploys a runtime process on the VM
guest OS. The process runs only during guest processing and is stopped immediately after the processing is
finished.

145 | V eeam Backup Enterprise Manager | User Guide

You must specify credentials that will be used to connect to the VM guest OS (Windows or Linux) and to deploy
the runtime process.

In the Guest OS credentials section, you can select credentials from the list, or click the Ad d button to add new
credentials.

• For Windows guest OS, specify a user account (name and password) with local administrative rights on
target machine, and optional description. Credentials must be specified in the following format:

o For Active Directory accounts: DOMAIN\Username

o For local accounts: Username or HOST\Username

• For Linux guest OS, specify a user name, password, and SSH port (by default, port 22 is used).
If you specify data for a non-root account that does not have root permissions on a Linux server, you can
use the Non-root account section to grant sudo rights to this account.

a. To provide a non-root user with root account privileges, select the E levate specified account to root
check box.

b. To add the user account to the sudoers file, select the Ad d account to the sudoers file automatically
check box. In the Root password field, enter the password for the root account.
If you do not enable this option, you will have to manually add the user account to the sudoers file.

c. If you plan to use the account to connect to Linux servers where the sudo command is not available
or may fail, you have an option to use the su command instead. To enable the su command, select
the Use "su" if "sudo" fails check box and in the Root password field, enter the password for the root
account.

Veeam Backup & Replication will first try to use the sudo command. If the attempt fails,
Veeam Backup & Replication will use the su command.

146 | V eeam Backup Enterprise Manager | User Guide

 IMP ORTANT

For machine guest OS indexing of Linux-based machines, a user account with root privileges on the
machine is required. It is recommended that you create a separate user account for work with Veeam
Backup & Replication on the Linux-based machine, grant root privileges to this account and specify settings
of this account in the Guest OS credentials section.

It is also recommended to avoid additional commands output for the specified user (like messages echoed
from within ~/.bashrc or command traces before execution), because they may affect Linux machine
processing.

Linux Private Key

Another option is to use Linux private key. This method eliminates the need to supply password at each login,
helps to protect against malicious applications like keyloggers, thus strengthening security, and simplifies
launch of automated tasks, decreasing administrative load in Linux environments. For this method, a user must
create a pair of keys:

• Private key is stored on the client (user’s) machine — that is, on the machine where Veeam Backup &
Replication runs. The key is usually stored in the encrypted form. To decrypt a private key, you need to
supply a passphrase specified at key creation.

• Public key is stored on the server (Linux machine) in a special authorized_keys file that contains a list
of public keys.

If you plan to use Linux private key for authentication, make sure you have created private and public keys and
stored them appropriately: private key on the client side (Veeam backup server) and public key on the server
side (Linux machine). You should also have the passphrase for the private key if it is encrypted. If you select to
use Linux private key credentials, you should specify the following:

• User name

• Passphrase for private key

• Private key stored on the client side (Veeam backup server)

• SSH port (default is 22)

147 | V eeam Backup Enterprise Manager | User Guide

 • Non-root account elevation options

Special Credentials for Machine

By default, for all machines in the list, Veeam Backup & Replication uses common credentials you provided in
the Guest OS credentials section. To use a different account for deploying the agent inside a specific machine,
you can customize credentials for the machine.

To customize credentials:

1. In the Guest OS credentials section, select Customize Credentials.

2. Select the necessary machine from the list and click Set User.

3. Specify custom guest OS credentials and click OK.

To remove custom credentials for a machine:

1. In the Guest OS credentials section, select Customize Credentials.

2. Select the necessary machine from the list and click Remove.

148 | V eeam Backup Enterprise Manager | User Guide

 NOTE

To customize settings of a machine added as part of a container, the machine should be included in the list
as a standalone instance. For that, click Ad d machine and choose a machine whose settings you want to
customize.

149 | V eeam Backup Enterprise Manager | User Guide

Step 6. Edit Job Schedule
At the Job Schedule step of the wizard, you can select to run the job manually or schedule the job to run on a
regular basis.

To edit the job schedule:

1. Select the Run the job automatically check box. If the check box is not selected, you will need to start the
job manually.

2. Edit the scheduling settings. You can select to run the job daily, monthly, periodically with a specific time
interval, continuously or after a specific job.

For more information, see Editing Scheduling Settings.

3. In the Automatic retry section, define whether Veeam Backup & Replication must attempt to run the
backup job again if the job fails for some reason. During a job retry, Veeam Backup & Replication processes
failed machines only. Enter the number of attempts to run the job and define time intervals between
them. If you select continuous backup, Veeam Backup & Replication will retry the job for the defined
number of times without any time intervals between the job runs.

4. In the Ba ckup window section, edit the time interval within which the backup job must complete. The
backup window prevents the job from overlapping with production hours and ensures that the job does
not provide unwanted overhead on the production environment. To set up a backup window for the job:

a. Select the Terminate job if it gets out of a llowed backup window check box and click W indow.

b. Define the allowed hours and prohibited hours for backup. If the job exceeds the allowed window, it
will be automatically terminated.

150 | V eeam Backup Enterprise Manager | User Guide

 NOTE

If the Location property of the source object and target object do not match, you will receive a warning
message after you click Finish. For example, you may have a backup job targeted at repository located in
Sydney, and source machines located in London.

Editing Schedule Settings

If you have selected to run the job automatically, you can select one of the following options:

• To run the job at specific time daily, on defined week days or with specific periodicity, select Da ily at this
time. Use the fields on the right to configure the necessary schedule.

• To run the job once a month on specific days, select Monthly at this time. Use the fields on the right to
configure the necessary schedule.

NOTE

When you configure the job schedule, keep in mind possible date and time changes (for example,
related to daylight saving time transition).

• To run the job repeatedly throughout a day with a specific time interval, select P eriodically every. In the
field on the right, select the necessary time unit: Hours or Minutes. Click Schedule and use the time table
to define the permitted time window for the job. In the Sta rt time within an hour field, specify the exact
time when the job must start.

A repeatedly run job is started by the following rules:

o Veeam Backup & Replication always starts counting defined intervals from 12:00 AM. For example, if
you configure to run a job with a 4-hour interval, the job will start at 12:00 AM, 4:00 AM, 8:00 AM,
12:00 PM, 4:00 PM and so on.

o If you define permitted hours for the job, after the denied interval is over,
Veeam Backup & Replication will immediately start the job and then run the job by the defined
schedule.

For example, you have configured a job to run with a 2-hour interval and defined permitted hours from
9:00 AM to 5:00 PM. According to the rules above, the job will first run at 9:00 AM, when the denied
period is over. After that, the job will run at 10:00 AM, 12:00 PM, 2:00 PM and 4:00 PM.

151 | V eeam Backup Enterprise Manager | User Guide

 • To run the job continuously, select the P eriodically every option and choose Continuously from the drop-
down list on the right. A new backup job session will start as soon as the previous backup job session
finishes.

• To chain jobs, use the After this job field. In the common practice, jobs start one after another: when job A
finishes, job B starts and so on. If you want to create a chain of jobs, you must define the time schedule for
the first job in the chain. For the rest of the jobs in the chain, select the After this job option and choose
the preceding job from the list. If you start the first job manually, Veeam Backup Enterprise Manager will
display a notification. You will be able to choose whether to start the chained job as well.

NOTE

You can chain jobs that are processed on the same backup server only.

152 | V eeam Backup Enterprise Manager | User Guide

Creating Active Full Backups
You can create an ad-hoc full backup — active full backup, and add it to the backup chain in the backup
repository. The active full backup resets the backup chain. All subsequent incremental backups use the active
full backup as a starting point. The previously used full backup will remain in the backup repository until it is
removed from the backup chain according to the retention policy.

NOTE

Creating active full backups is unavailable for backup copy jobs and file share backup jobs.

To perform an active full backup:

1. Select the required job in the list on the Job s tab.

2. Expand the menu commands by clicking Job , then select Active Full .

153 | V eeam Backup Enterprise Manager | User Guide

Cloning Jobs
In addition to performing job editing tasks, you can add new jobs by means of job cloning. Job cloning allows
you to create an exact copy of any backup or replication job available in the job list. The recommended practice
is to configure a set of ‘job templates’ in advance, using the Veeam Backup & Replication cons ole on every
managed Veeam backup server. These job templates can be used by Enterprise Manager Portal Administrators
for cloning and further editing.

NOTE

Consider the following:

• The job cloning functionality is available only in the Enterprise and Enterprise Plus editions of
Veeam Backup & Replication.
• The job cloning functionality is not available for file share backup jobs.

To clone an existing job:

1. Open the Job s tab.

2. Select the necessary job in the list.

3. Expand the menu commands by clicking Job , then select Clone.

Job clone name is created automatically, with the original job name and suffix of the following format:
_clone<n> where <n> is the sequential number of the clone.

Once a job is cloned, you can edit its settings. For details, see Editing Jobs. Note, however, that not all of the
job settings can be changed with the Enterprise Manager web UI. For example, you cannot change the backup
repository and backup proxies used for the job or define advanced job settings.

Configuration details of a created job clone are written to the same SQL database that stores configuration
details of the original job — thus, the job copy is available and can be managed both with the Veeam Backup
Enterprise Manager web UI and the Veeam Backup & Replication console on the backup server that coordinates
the job. The backup file produced by the clone will be located on the same repository as the backup file of t he
original job.

154 | V eeam Backup Enterprise Manager | User Guide

Deleting Jobs
Users with the Portal Administrator role can delete a job and also instruct Veeam Backup Enterprise Manager to
delete backup files created by this job in the backup repository. Deleted jobs will no longer appear in the UI.
They will be removed from the Enterprise Manager database and from the Veeam Backup configuration
database on the backup server. If you select to delete backup files, they will be removed from backup
repository.

If you have Veeam backup servers of earlier versions added to Enterprise Manager, jobs managed by these
servers cannot be deleted using Enterprise Manager.

To delete a job:

1. On the Job s tab, select the required job in the list.

2. Expand the menu commands by clicking Job , then select Delete.

3. You will be prompted to delete backup files. To delete backup files, select the Delete backup files check
box and click Y es to confirm the operation.

155 | V eeam Backup Enterprise Manager | User Guide

Managing CDP Policies
Veeam Backup Enterprise Manager allows you to manage CDP policies that were previous ly created on added
backup servers. Users with the Portal User role can view CDP policies, and users with the Portal Administrator
role can view, disable and enable, edit and delete CDP policies. For more information on CDP, see the
Continuous Data Protection (CDP) section of the Veeam Backup & Replication User Guide.

156 | V eeam Backup Enterprise Manager | User Guide

Viewing Policies
From Veeam Backup Enterprise Manager, you can view information about all CDP policies from all backup
servers added to Enterprise Manager. To view the CDP policies, open the P olicies tab. Every policy in the list is
described with the following data: policy name, current policy status, policy SLA, recovery point objective
(RPO), maximum delay, target host and policy description.

To quickly find a CDP policy, you can use filters and the search field.

• To filter the list of policies:

o Use the Ba ckup server list to view the policies of the selected backup server only.

o Use the Sta tus filter to view the policies with the selected statuses only.

Once you have selected necessary statuses, click the Ap p ly button to apply the filter.

• To find a policy by its name, use the search field.

In addition to the information presented in the list of policies, the P olicies tab allows you to view advanced
policy data. To see detailed policy statistics, click the state link in the Sta tus column.

NOTE

You can export displayed information to a file using the E x p ort link on the toolbar. This file then can be
opened on the client machine using the associated application.

157 | V eeam Backup Enterprise Manager | User Guide

Enabling and Disabling Policies
Users with the Portal Administrator role can enable and disable CDP policies. Disabled CDP policies are
temporary paused.

To enable or disable a policy:

1. On the P olicies tab, select a policy from the list.

2. On the toolbar, click E na ble or Disable.

158 | V eeam Backup Enterprise Manager | User Guide

Editing Policies
If Veeam Backup Enterprise Manager has an Enterprise or Enterprise Plus license installed, users with the Portal
Administrator role can modify settings of CDP policies that have been previously configured on managed backup
servers. In Veeam Backup Enterprise Manager, you can change only a subset of the CDP policy settings. You can
configure other policy settings with the Veeam Backup & Replication console only.

You can edit the following CDP Policy settings:

• Policy name and description

• List of VMs that the policy processes

• Policy schedule

• Guest processing settings

To edit a CDP policy, use the E d it P olicy wizard.

1. Launch the Edit Policy wizard

2. Edit the policy name and description

3. Edit the list of VMs

4. Configure RPO and retention settings

5. Configure guest processing settings

159 | V eeam Backup Enterprise Manager | User Guide

Step 1. Launch Edit Policy Wizard
To launch the E d it Policy wizard:

1. Open the P olicies tab and select the necessary policy from the list.

2. On the toolbar, click P olicy and select E d it.

160 | V eeam Backup Enterprise Manager | User Guide

Step 2. Edit Policy Name and Description
At the P olicy Settings step of the wizard, you can modify the name and description of the selected CDP policy:

1. In the P olicy name field, specify a name for the policy.

2. In the Description field, provide an optional description for future reference.

161 | V eeam Backup Enterprise Manager | User Guide

Step 3. Edit List of VMs
At the Virtual Machines step of the wizard, you can add or remove individual VMs or VM containers (for
example, hosts or folders). You can also exclude individual VMs from VM containers, for example, if you need to
replicate an entire VMware vSphere server except some machines running on this server.

Adding VMs and VM containers

To add a VM or VM container:

1. Click Ad d .

162 | V eeam Backup Enterprise Manager | User Guide

 2. In the virtual infrastructure tree, select the necessary VMs or VM containers.

If you select a VM container and later add a new VM to the container, Veeam Backup & Replication will
update policy settings automatically to include the VM.

TIP

To quickly find the necessary objects, you can do the following:

• Search for objects: type a name or part of a name in the search field. Specify the type of the
object from a scroll list next to the search field.
• Switch between virtual infrastructure views using the buttons in the top right corner: Hosts
a nd Clusters, VMs and Templates, Datastores and VMs and Ta gs and VMs.

3. Click OK to save the changes.

Removing VMs and VM containers

To remove a VM or VM container, select it in the list and click Remove.

Excluding VMs from VM containers

To exclude VMs from a VM container:

1. Select a VM container in the list and click E x clusions.

2. In the E x clusions window, click Ad d and select machines that you want to exclude.

Changing Object Processing Order

If specific objects must be processed first, you can change the object processing order. The object processing
order can be helpful if you want to ensure that processing of an object does not overlap with other scheduled
activities, or that it is completed before the certain time.

163 | V eeam Backup Enterprise Manager | User Guide

To change the processing order, select the necessary objects and move them up or down the list using the Up
and Down buttons on the right.

NOTE
• VMs inside a VM container are processed at random. To ensure that VMs are processed in the defined
order, add them as standalone VMs, not as a part of containers.
• The processing order may differ from the order that you have defined. For example, if resources of a
VM that is higher in the priority are not available, and resources of a VM that is lower in the priority
are available, the VM with the lower priority will be processed first.

164 | V eeam Backup Enterprise Manager | User Guide

Step 4. Edit Policy Schedule
At the P olicy Schedule step of the wizard, you can edit schedule and retention settings:

1. Configure scheduling settings:

a. In the Recovery point objective section, specify an RPO in seconds or minutes. You can select the
period from 2 seconds to 60 minutes.

During every specified period, Veeam Backup & Replication will create short-term restore points for
VM replicas and send these restore points to the target destination. Note that short-term restore
points are crash-consistent.

b. To specify permitted and denied hours for the policy run, click Schedule on the right and use the
timetable.

165 | V eeam Backup Enterprise Manager | User Guide

 2. To instruct the CDP policy to display a warning or error if a newly created replicated states are not
transferred to the target within the set RPO, click Rep orting. Then specify when the policy must display
errors and warnings.

If you have configured email notification settings, Veeam Backup & Replication will mark the policy with
the Warning or Error status and will also send email notifications.

3. In the Short-term retention section, specify for how long to store short-term restore points.

4. In the Long -term retention section, configure when to create long-term restore points and for how long
to store them:

a. In the Create additional restore points every field, specify how often you want to create long-term
restore points.

b. In the Keep restore points for field, specify for how long to store these long-term restore points.

c. To specify time periods when Veeam Backup & Replication must create application-consistent and
crash-consistent long-term restore points, click VSS. In the Time p eriods window, select the necessary
time area and click Cra sh-consistent or Ap p lication-consistent. By default,
Veeam Backup & Replication creates application-consistent backups if you enable application-aware
processing. If you do not enable application-aware processing, Veeam Backup & Replication will
create crash-consistent long-term restore points.

To shift the schedule, specify the offset in the Sta rt time within a n hour field. For example, you
schedule creation of crash-consistent restore points from 00:00 to 01:00, and set the offset value to
25. The schedule will be shifted forward, and the crash-consistent restore points will be created from
0:25 and to 01:25.

166 | V eeam Backup Enterprise Manager | User Guide

Step 5. Configure Guest Processing Settings
At the Guest Processing step of the wizard, you can select to create a transactionally consistent replicas,
configure transaction log handling settings, and enable guest file system indexing.

Application-Aware Processing
If VMs run Microsoft Active Directory, Microsoft SQL Server, Microsoft SharePoint, Microsoft Exchange or
Oracle, you can enable application-aware processing to create transactionally consistent replicas. The
transactionally consistent replicas guarantee proper recovery of applications without data loss.

To configure application-aware processing:

1. Select the E na ble application-aware processing check box.

2. Click the Customize Application link.

3. To define custom settings for a machine in the list, select it and click E d it.

Consider the following:

o To customize settings of a machine added as part of a container, add the machine as a standalone
instance. For that, click Ad d machine and choose the necessary VM. Next, select the machine from the
list and click E d it to customize VM settings.

o To discard custom settings of a machine, select the machine in the list and click Remove.

4. Configure the necessary settings for the selected application server:

o General Settings

o SQL Server Processing Settings

167 | V eeam Backup Enterprise Manager | User Guide

 o Oracle Server Processing Settings

General Settings
Applications Section
In this section, select the behavior scenario for application-aware processing:

• Select Require successful processing (default option) if you want Veeam Backup & Replication to stop the
CDP replication if an error occurs during application-aware processing.

• Select Try application processing, but ignore failures if you want to continue the CDP replication process
even if an error occurs. This option guarantees the CDP policy will continue working. The created replica
will not be transactionally consistent, but rather crash-consistent.

• Select Disable application processing if you do not want to enable application-aware processing for the
VM. This option makes the Tra nsaction logs processing section unavailable.

Transaction Logs Processing Section

In this section, specify whether the CDP policy should process transaction logs or create copy -only replicas:

• Select P rocess transaction logs with this job if you want Veeam Backup & Replication to handle transaction
logs. With this option enabled (default setting), Veeam will support log pruning for Microsoft Exchange
and Microsoft SQL Servers, as well as for Oracle databases archived logs:

o Truncation of transaction logs for Microsoft Exchange Server VMs will be performed after the CDP
policy completes successfully. If the CDP policy fails, the logs will remain untouched until the next
start of the runtime process.

o Settings for SQL Server transaction log handling can be configured separately on the SQL tab — it
becomes available to you with this option selected.

o Similarly, you can configure settings for Oracle database archived logs processing on the Ora cle tab.

168 | V eeam Backup Enterprise Manager | User Guide

 • Select P erform copy only if you use another replication tool to perform guest level replication, and this
tool maintains consistency of the database state. Veeam Backup & Replication will create a copy-only
replica for the selected VM. The copy-only replica preserves the chain of full and differential backup files
and transaction logs on the VM. For more information, see Microsoft Docs.

NOTE

With this option selected, the SQL and Ora cle tabs are not available.

SQL Server Processing Settings

For more information on configuring Microsoft SQL Server processing settings, see Backup and Restore of
Microsoft SQL Server Databases.

Oracle Server Processing Settings

For more information on configuring Oracle processing settings, see Backup and Restore of Oracle Databases.

Guest OS Credentials
To coordinate guest processing activities, Veeam Backup & Replication deploys a runtime process on the VM
guest OS. The process runs only during guest processing and is stopped immediately after the processing is
finished.

169 | V eeam Backup Enterprise Manager | User Guide

You must specify credentials that will be used to connect to the VM guest OS (Windows or Linux) and to deploy
the runtime process.

In the Guest OS credentials section, you can select credentials from the list, or click the Ad d button to add new
credentials.

• For Windows guest OS, specify a user account (name and password) with local administrative rights on
target machine, and optional description. Credentials must be specified in the following format:

o For Active Directory accounts: DOMAIN\Username

o For local accounts: Username or HOST\Username

• For Linux guest OS, specify a user name, password, and SSH port (by default, port 22 is used).
If you specify data for a non-root account that does not have root permissions on a Linux server, you can
use the Non-root account section to grant sudo rights to this account.

a. To provide a non-root user with root account privileges, select the E levate specified account to root
check box.

b. To add the user account to the sudoers file, select the Ad d account to the sudoers file automatically
check box. In the Root password field, enter the password for the root account.

If you do not enable this option, you will have to manually add the user account to the sudoers file.

c. If you plan to use the account to connect to Linux servers where the sudo command is not available
or may fail, you have an option to use the su command instead. To enable the su command, select
the Use "su" if "sudo" fails check box and in the Root password field, enter the password for the root
account.

Veeam Backup & Replication will first try to use the sudo command. If the attempt fails,
Veeam Backup & Replication will use the su command.

170 | V eeam Backup Enterprise Manager | User Guide

 IMP ORTANT

For machine guest OS indexing of Linux-based machines, a user account with root privileges on the
machine is required. It is recommended that you create a separate user account for work with Veeam
Backup & Replication on the Linux-based machine, grant root privileges to this account and specify settings
of this account in the Guest OS credentials section.

It is also recommended to avoid additional commands output for the specified user (like messages echoed
from within ~/.bashrc or command traces before execution), because they may affect Linux machine
processing.

Linux Private Key

Another option is to use Linux private key. This method eliminates the need to supply password at each login,
helps to protect against malicious applications like keyloggers, thus strengthening security, and simplifies
launch of automated tasks, decreasing administrative load in Linux environments. For this method, a user must
create a pair of keys:

• Private key is stored on the client (user’s) machine — that is, on the machine where Veeam Backup &
Replication runs. The key is usually stored in the encrypted form. To decrypt a private key, you need to
supply a passphrase specified at key creation.

• Public key is stored on the server (Linux machine) in a special authorized_keys file that contains a list
of public keys.

If you plan to use Linux private key for authentication, make sure you have created private and public keys and
stored them appropriately: private key on the client side (Veeam backup server) and public key on the server
side (Linux machine). You should also have the passphrase for the private key if it is encrypted. If you select to
use Linux private key credentials, you should specify the following:

• User name

• Passphrase for private key

• Private key stored on the client side (Veeam backup server)

• SSH port (default is 22)

171 | V eeam Backup Enterprise Manager | User Guide

 • Non-root account elevation options

Special Credentials for Machine

By default, for all machines in the list, Veeam Backup & Replication uses common credentials you provided in
the Guest OS credentials section. To use a different account for deploying the agent inside a specific machine,
you can customize credentials for the machine.

To customize credentials:

1. In the Guest OS credentials section, select Customize Credentials.

2. Select the necessary machine from the list and click Set User.

3. Specify custom guest OS credentials and click OK.

To remove custom credentials for a machine:

1. In the Guest OS credentials section, select Customize Credentials.

2. Select the necessary machine from the list and click Remove.

172 | V eeam Backup Enterprise Manager | User Guide

 NOTE

To customize settings of a machine added as part of a container, the machine should be included in the list
as a standalone instance. For that, click Ad d machine and choose a machine whose settings you want to
customize.

173 | V eeam Backup Enterprise Manager | User Guide

Deleting Policies
Users with the Portal Administrator role can permanently delete CDP policies. The deleted policies will no
longer appear in the UI. They are removed from the Enterprise Manager database and from the Veeam Backup
configuration database on the backup server.

Before you delete a CDP policy, you must disable it.

To delete a policy:

1. On the P olicies tab, select the required policy in the list.

2. On the toolbar, click P olicy and select Delete.

3. In the displayed window, click Y es to confirm the operation.

174 | V eeam Backup Enterprise Manager | User Guide

Support for Veeam Agents
Veeam Backup Enterprise Manager allows you to browse and restore guest OS files and application items from
backups created with the following Veeam Agents:

• Veeam Agents for Microsoft Windows

• Veeam Agent for Linux

• Veeam Agent for Mac

• Veeam Agent for Oracle Solaris

• Veeam Agent for IBM AIX

NOTE

File restore from backups of Veeam Agent for Mac, Veeam Agent for Oracle Solaris and Veeam Agent for
IBM AIX to the original location is not available.

Before you start browsing or restore, check the following prerequisites:

1. You have the Enterprise or Enterprise Plus edition of Veeam Backup & Replication.

2. For 1-Click restore of guest OS files and for restore of application items, you must have the Server edition
of Veeam Agents. For more information, see Veeam Availability Suite: Product Comparison.

3. Veeam Agent should be integrated with Veeam Backup & Replication. For more information, see the
Integration with Veeam Backup & Replication section of the following user guides:

o Veeam Agent for Windows User Guide

o Veeam Agent for Linux User Guide

o Veeam Agent for Mac User Guide

o Veeam Agent for Oracle Solaris User Guide

o Veeam Agent for IBM AIX User Guide

NOTE

Veeam Agent backup policies, that is, Veeam Agent backup jobs managed by Veeam Agent, are not
displayed in the Enterprise Manager web UI. Enterprise Manager displays only Veeam Agent backup jobs
managed by the backup server. For more information on Veeam Agent backup jobs and policies, see the
Working with Veeam Agent Backup Jobs and Policies section of the Veeam Agent Management Guide.

175 | V eeam Backup Enterprise Manager | User Guide

Guest File Browsing and 1-Click Restore
If you have Veeam Backup & Replication and Veeam Agent that both meet the prerequisites, you can browse,
search and restore guest OS files from the backups created by Veeam Agent.

176 | V eeam Backup Enterprise Manager | User Guide

Preparing for File Browsing and Restore
You can browse and restore files from a backup of a physical server created by Veeam Agent with or without
enabling guest OS file indexing. Take some preparatory steps for the server processed by Veeam Agent:

• Preparing for restore from a Windows Server backup

• Preparing for restore from a Non-Windows Server backup

Windows Server

Preparing Backup
You can restore files from a backup of a physical Windows server created with or without indexing.

To prepare a backup with guest file indexing:

1. Enable guest file system indexing on the Guest Processing step of the backup job wizard. For details, see
the File Indexing section of the Veeam Agent for Microsoft Windows User Guide.

2. Run the backup job with guest file system indexing enabled.

3. Make sure the indexing data is imported to the Veeam backup database, and catalog replication is
completed successfully. For details, see the Performing Catalog Replication and Indexing section.

If you restore files from an indexed guest OS, you do not need to mount the restore point for browsing purposes
— file hierarchy is presented using the index. The restore point will be only mounted once (during 1-Click file
restore process itself) — to the mount server associated with backup repository where Veeam Agent backups are
stored.

Alternatively, you can process the backups created without guest file system indexing — for example, if indexing
was disabled at restore point creation time, or if indexing operation failed. For such a server, its selected restore
point first will be mounted (for the browsing and search purposes) to the Veeam backup server integrated with
Veeam Agent. After you locate the necessary file and initia tes 1-Click file restore, the restore point will be
mounted to the mount server associated with the repository.

Other Prerequisites
During guest file restore to the original location, you are prompted for the credentials to access the target
Windows server. Enter a user name and password; make sure that the account has sufficient access rights.

Non-Windows Server
Preparing Backup
You can restore files from a backup of a physical server created with or without indexing.

NOTE

Veeam Agent for Mac does not support file system indexing.

177 | V eeam Backup Enterprise Manager | User Guide

To prepare a backup with guest file indexing:

1. Check for the following utilities to be installed on the server: mlocate, gzip, and tar. These utilities are
required for file indexing. When you enable file indexing, Veeam Ag ent will prompt you to deploy them in
case they are not found.

2. Enable guest file system indexing in the backup job settings.

For more information, see the File System Indexing section of the following guides:

o Veeam Agent for Linux User Guide

o Veeam Agent for Oracle Solaris User Guide

o Veeam Agent for IBM AIX User Guide

3. Run the backup job with guest file system indexing enabled.

4. Make sure the indexing data is imported to Veeam backup database, and catalog data replication is
completed successfully. For more information, see Performing Catalog Replication and Indexing.

Whether you restore from a backup with or without guest file indexing, prepare a machine to operate as an FLR
helper appliance.

Preparing FLR Helper Appliance

To perform guest file restore, configure an FLR helper appliance on the Veeam backup server with which Veeam
Agent is integrated. FLR helper configuration is similar to that described in the Restoring VM Guest OS Files
(Multi-OS) section of the Veeam Backup & Replication User Guide. The only difference is that for restore of a
physical machine, you can configure a helper appliance to work on a machine running on the platform of your
choice (VMware or Hyper-V). Helper appliance settings are saved in Veeam Backup & Replication database on
per-user basis. The settings are applied each time the user starts file-level restore.

When guest file-level restore is started from Veeam Backup Enterprise Manager, FLR helper configuration
settings are obtained from the database of the Veeam backup server. If no FLR helper configuration is found for
the current user account, Veeam Backup & Replication uses the default settings (set during the latest FLR
appliance configuration process in Veeam backup console). Thus, before you start file -level restore from
Enterprise Manager, make sure that FLR helper setting s are configured on Veeam backup server.

NOTE

If you plan to deploy multiple FLR helper appliances to restore machines backed up by Veeam Agents
integrated with different Veeam backup servers, their initial configuration should be performed on the
backup servers. Centralized configuration from Veeam Backup Enterprise Manager is not supported.

Other Prerequisites
1. Make sure that the DNS name of the target (original) server where you plan to restore the files is resolved
properly.

2. During guest file restore to the original location, you are prompted for the credentials to access the target
server. Specify a user name and password or private key for the account with sufficient access rights.

178 | V eeam Backup Enterprise Manager | User Guide

Browsing and Restore Procedures
To browse guest OS files in a physical server backup:

1. In the Enterprise Manager main window, click the Files tab.

2. Select a necessary server. You can type in a server name or pick it from the list. Note that server icons
indicate server OSes.

3. If the server is backed up without guest indexing, click Mount Backup and wait for the process to
complete.

4. In the Restore point field in the top left corner of the Files tab, select a necessary date of backup and a
restore point. Note that the dates when backup of the selected server was performed are highlighted in
the calendar.

5. To search for a file, take the steps similar to the Searching Guest OS Files in Machine Backups procedure.

6. To restore a file, take the steps similar to the Performing 1-Click File Restore procedure.

NOTE

File restore from backups of Veeam Agent for Mac, Veeam Agent for Oracle Solaris and Veeam Agent for
IBM AIX to the original location is not available.

IMP ORTANT

When restoring files to the original location, you are prompted for user credentials to the target machine.
Make sure the account you provide has sufficient access rights.

179 | V eeam Backup Enterprise Manager | User Guide

Application Item Restore
If your Veeam Backup & Replication is integrated with the Server edition of Veeam Agent, and other
prerequisites are met, you can use the backups of the physical application servers (Microsoft SQL Server and
Microsoft Exchange Server) to restore the necessary application items.

To restore application items, follow the procedures described in the following sections:

• Restore procedure for Microsoft Exchange mailbox items

• Restore procedure for Microsoft SQL Server database items

180 | V eeam Backup Enterprise Manager | User Guide

Working with File Shares
With Veeam Backup Enterprise Manager, authorized users can perform management operations with file shares
processed by Veeam Backup & Replication: search and view file share backups, restore files from these backups
and delete backups.

IMP ORTANT

Restore scope (list of objects a user can recover) can be customized if you have the Enterprise Plus edition
of Veeam Backup & Replication. In other editions, this list includes all objects and cannot be customized.
However, you can delegate recovery of entire file shares or selected file types. Possible delegation options
are described in the Configuring Restrictions for Delegated Restore section.

181 | V eeam Backup Enterprise Manager | User Guide

Viewing File Share Backups
From Veeam Backup Enterprise Manager, you can view information about file shares processed by backup jobs
configured on Veeam backup servers. To view the file shares, open the File Shares tab. Each entry in the list
contains the following data: file share name, path to backup file, number of restore points, backup server to
which the job relates, job name and status of the last job run.

Veeam Backup Enterprise Manager allows you to search for the necessary file share in the list of file shares. This
may be useful in case you manage large backup infrastructure with multiple backup servers that process
multiple file shares.

You can search for file shares in one of the following ways:

• Filter file shares by the backup server. To do this, from the Ba ckup server list, select the necessary backup
server. Veeam Backup Enterprise Manager will display backups of only those file shares that are processed
by the selected backup server.

NOTE

The Ba ckup server filter is only available for users with the Portal Administrator or Portal User role.

• Search file shares by the file share name. To do this, enter the name or a part of the name in the search
field. Veeam Backup Enterprise Manager will display backups of only those file shares whose names match
the text that you entered.

Besides the information presented in the list of file shares, the File Shares tab allows you to view advanced data
about each file share:

• To see detailed information about a file share, click its name in the File Share column.

• To see detailed information about file restore points, click a link in the Restore Points column.

182 | V eeam Backup Enterprise Manager | User Guide

 NOTE

You can export displayed information to a file using the E x p ort link on the toolbar. This file then can be
opened on the client machine using the associated application.

183 | V eeam Backup Enterprise Manager | User Guide

Browsing File Share Backups
You can browse file share backups for backed-up files. Note that with the file browsing functionality, you can
browse for files in the selected file share backup only.

If you use the Enterprise or Enterprise Plus edition of Veea m Backup & Replication in your virtual environment,
consider that Enterprise Manager keeps index files for backups that are currently stored on disk and for archived
backups (for example, backups that were recorded to tape). Thus, you will be able to brows e and search through
backup contents even if the backup in the repository is no longer available.

To browse files in a file share backup:

1. Open the Files tab.

2. In the Sea rch backups of field, enter the name of a file share whose files you want to browse or click the
P ick from List link and select the necessary file share in the Select Object window.

3. Click Mount.

4. Wait while Veeam Backup & Replication mounts the file share from the backup to the backup server. When
the process is completed, Veeam Backup Enterprise Manager displays the content of the backed -up file
share.

5. You can browse files contained in all restore points created by the file share backup job or in a specific
restore point.

o By default, the All restore points option is selected. With this option selected, you can browse files
contained in all restore points created by the file share backup job.

For each file in the backup, Enterprise Manager displays the number of file versions and the date
when the latest file version is created. If a file has more than one version, you can select a necessary
file version during the restore process. For more information, see Performing File Restore.

184 | V eeam Backup Enterprise Manager | User Guide

 o To select a specific restore point, click the calendar icon in the restore point field and select the
necessary backup date and a restore point created on that date. Note that you cannot select a date on
which the backup was not performed.

For each file in the backup, Enterprise Manager displays file size and the date when the file version is
created. Enterprise Manager displays only the file version contained in the selected restore point. For
more information on file restore, see Performing File Restore.

TIP

You can use the search field at the top of the working area to search for specific files and folders.
Depending on the number of files in the file share, the search process may take some time.

185 | V eeam Backup Enterprise Manager | User Guide

Performing File Restore
After you locate the necessary file, you can use Veeam Backup Enterprise Manager to restore it from the backup.
You can choose to restore a file to the original location or download it to the local machine.

Restore operations are only available to authorized users according to their security settings. Users with the
Portal Administrator role can both restore files to the original location or download them to the local machine.

For users with the non-administrative roles, you can configure additional restriction settings. For example, you
can prohibit restore operators to download files to the local machine so that they will be able to restore files to
the original location only. Additionally, you can specify the types of files that can be restored by operators (this
can be helpful if you want to limit operators’ access to sensitive data). For details, see Configuring Accounts and
Roles.

186 | V eeam Backup Enterprise Manager | User Guide

Restoring Files to Original Location
In this restore scenario, Veeam Backup Enterprise Manager will extract the file from the backup and restore it to
the original location in the file share. Restoring files to the original location is the most secure file recovery
method, as the user who initiates the file restore operation in the Enterprise Manager UI cannot access the file
itself.

To restore a file to the original location:

1. Locate the necessary file using browse or search possibilities of Veeam Backup Enterprise Manager.
Multiple selection is also possible. For details, see Viewing File Share Backups and Browsing File Share
Backups.

2. Click Restore and select how to restore selected files:

o If you select Overwrite, the file from the backup will replace the original file in the file share.

o If you select Keep, the file from the backup will be restored next to the original file in the file share.
The restored file will have the _RESTORED_<date>_<time> suffix in the file name.

187 | V eeam Backup Enterprise Manager | User Guide

 3. If you browse for files in all restore points created for the file share, and the restore points contain
multiple versions of the file that you want to restore, Veeam Backup Enterprise Manager will prompt you
to select the file version. In the Select version window, select the restore point that contains the
necessary file version and click OK.

4. In the displayed window, click Y es .

Veeam Backup Enterprise Manager will start the restore operation and display the progress and result of the
operation in the File Restore History view.

188 | V eeam Backup Enterprise Manager | User Guide

Downloading Files
If you choose to download the restored file, Veeam Backup Enterprise Manager interacts with the Veeam backup
server to extract the necessary file from the backup. The user who initiated file restore will be able to download
the file to the local machine, that is, the Veeam Backup Enterprise Manager serve r.

To download a file:

1. Locate the necessary file using browse or search possibilities of Veeam Backup Enterprise Manager. For
details, see Viewing File Share Backups and Browsing File Share Backups.

2. Click Download.

189 | V eeam Backup Enterprise Manager | User Guide

 3. If you browsed for files in all restore points created for the file share, and the restore points contain
multiple versions of the file that you want to restore, Veeam Backup Enterprise Manager will prompt you
to select the file version. In the Select version window, select the restore point that contains the
necessary file version and click OK.

4. In the displayed window, click Y es .

5. Wait for restore session to complete and the file to be retrieved from the backup.

6. Select the file from the list.

7. In the Log tab of the File Restore History view, click the d ownload link in the Restored files are available
for download record of the session log.
The file is saved to the default download folder on your local machine.

190 | V eeam Backup Enterprise Manager | User Guide

 If you download a single file, it is also saved in the %ProgramData%\Veeam\Backup\WebRestore
folder. Multiple files are packed in a ZIP file named FLR_<date>_<time>.zip and stored in the same
folder. Veeam Backup Enterprise Manager cleans up the folder periodically. Files older than 24 hour s are
automatically deleted. To change the default storage folder, contact Veeam Customer Support.

191 | V eeam Backup Enterprise Manager | User Guide

Restoring Multiple Files
In addition to restoring single files from selected restore points, Veeam Backup Enterprise Manager supports
bulk restore. If you need to restore multiple files at once, you can select more than one file in the preview pane
when browsing, and then use the Restore command, or add the necessary files to the restore list and then
restore all files at once. Unlike the Restore command, using the restore list helps you to prepare for restore files
from different file shares and restore points.

To add a file to the restore list:

1. Locate the necessary file using browse or search possibilities of Veeam Backup Enterprise Manager. For
more information, see Viewing File Share Backups and Browsing File Share Backups.

2. Click Ad d to Restore List.

3. If you browsed for files in all restore points created for the file share, and the restore points contain
multiple versions of the file that you want to restore, Veeam Backup Enterprise Manager will prompt you
to select the file version. In the Select version window, select the restore point that contains the
necessary file version and click OK.

NOTE

You cannot add multiple versions of the same file to the restore list using the Select version window. If you
want to restore multiple versions of a file, browse to this file in a specific restore point and add this file to
the restore list.

When a file is added to the restore list, the P ending restore notification appears at the top of the Enterprise
Manager UI window.

To restore files added to the restore list:

1. In the restore list notification, click P ending restore.

192 | V eeam Backup Enterprise Manager | User Guide

 2. In the P ending Restore window, select check boxes next to the files that you want to restore. Use the
check box next to the header of the Na me column to select all files in the list at once.

If you want to remove a file from the restore list, select the file and click Delete.

3. Click the Restore or Download link to perform the necessary restore operation for the selected files.

4. In the displayed window, click Y es .

5. [For the download operation] Wait for restore session to complete. In the Log tab of the File Restore
History view, click the d ownload link.

The files are saved to the default download folder on your local machine.

Multiple files are also saved in a ZIP file named FLR_<date>_<time>.zip in the
%ProgramData%\Veeam\Backup\WebRestore folder. Veeam Backup Enterprise Manager cleans up the
folder periodically. Files older than 24 hours are automatically deleted. To change the default storage
folder, contact Veeam Customer Support.

TIP

Veeam Backup Enterprise Manager keeps links for downloaded files in the history for one day. To
download a file that was previously restored:

1. In the Files tab, click History.

2. In the File Restore History view, select the necessary restore session.
3. In the Log tab, click the d ownload link.

193 | V eeam Backup Enterprise Manager | User Guide

Deleting File Share Backups
You can delete file share data from a backup created by a backup job in a backup repository. The deleted file
share is not removed from the list of file shares immediately. The file share will be removed from the list after
records about the file share are removed from the configuration database on the Veeam backup server. Once
this operation completes, a notification will appear at the top of the Enterprise Manager UI window.

To delete a file share backup:

1. In Veeam Backup Enterprise Manager, open the File Shares tab.

2. In the list of file share backups, select the necessary backup and click Delete.

To locate the necessary backup, you can filter file share backups by the backup server or search by the file
share name.

3. In the displayed window, click Y es .

NOTE

If several file shares are processed by the same backup job, deletion of the selected file share backup will
not affect other file shares in the job.

194 | V eeam Backup Enterprise Manager | User Guide

Working with Machines
With Veeam Backup Enterprise Manager, authorized users can perform the following operations with machines:

• View machines and delete them from backups

• Create on-demand incremental backups (quick backups) for machines

• Restore machines and VM disks from backups

• Failover to VM replicas and vCloud Director vApps

• Run failover plans for VMware vSphere and Microsoft Hyper-V VMs

IMP ORTANT

Restore scope (list of machines a user can recover) can be customized if you have the Enterprise Plus
edition of Veeam Backup & Replication. In other editions, this list includes all machines and cannot be
customized. However, you can delegate recovery of entire machines, guest files, or selected file types.
Possible delegation options are described in the Configuring Restrictions for Delegated Restore section.

195 | V eeam Backup Enterprise Manager | User Guide

Viewing, Searching, Deleting Machines
From Veeam Backup Enterprise Manager, you can view information about all machines engaged in performed
jobs configured on Veeam backup servers. To view the machines, open the Ma chines tab. Each entry in the list
contains the following data: machine name, path to backup file, number of restore points, backup server to
which the job relates, job name and status of the last job run.

You can filter machines in the list by a backup server or search for specific machines by a machine name. To
search for a machine, enter its name or part of the name in the Search field.

Besides the information presented in the list of machines, the Ma chines tab allows you to view advanced data
about each machine:

• To see detailed information about a machine, click its name in the Ma chine column.

• To see detailed information about machine restore points, click a link in the Restore Points column.

196 | V eeam Backup Enterprise Manager | User Guide

 NOTE

You can export displayed information to a file using the E x p ort link on the toolbar. This file then can be
opened on the client machine using the associated application.

Deleting Machine from Backups

To delete a machine from a backup:

1. On the Ma chines tab, select the necessary machine backup from the list of machines.
To quickly find a machine, you can filter machines in the list by a backup server or search for specific
machines by a machine name.

2. Click Delete.

3. To remove backups marked with weekly, monthly and yearly GFS flags, select the Remove GFS full
b a ckups check box.

The check box is displayed if the machine has GFS backups.

4. Click Y es to confirm deletion.

The deleted machine is not removed from the list of machines immediately. The machine will be removed from
the list after records about the machine are removed from the configuration database on the Veeam backup
server. Once this operation completes, a notification appears at the top of the Enterprise Manager UI window.

NOTE

Consider the following:

• If several machines are processed by the same backup job, deletion of the selected machine will not
affect other machines in the job.
• The delete operation is not available for replica machines, storage snapshots and machines bac ked up
to tape.

197 | V eeam Backup Enterprise Manager | User Guide

Performing Quick Backup
You can create an ad-hoc incremental backup for one or more machines — quick backup. This backup will be
added to the backup chain in the backup repository. Quick backup can be helpful if you want to produce an
additional restore point for one or more machines in the backup job and do not want to configure a new job or
modify the existing one.

Quick backup can be performed for machines that meet the following requirements:

• A backup job processing the machine exists on the backup server.

• A full backup file for the machine exists in the backup repository.

NOTE

Quick backup is not available for vCloud Director VMs and Veeam Agent machines.

To perform quick backup, on the Ma chines tab, select the machine you need and click Quick Backup.

Veeam Backup & Replication will trigger a backup job to create a new incremental restore point for the selected
machines. Details of the running quick backup operation are displayed in the job session window.

198 | V eeam Backup Enterprise Manager | User Guide

Performing 1-Click Restore
Authorized users can restore machines from backups to the original location included in their scope. Users with
the Portal Administrator role have no scope limitations. For more information on restore scope, see Configuring
Restore Scope.

IMP ORTANT
• 1-Click Restore is available in the Enterprise and Enterprise Plus editions of Veeam Backup &
Replication.
• 1-Click Restore from any storage snapshots, Veeam Agent backups and backups created with Veeam
Plug-ins for Enterprise Applications are not supported by Veeam Backup Enterprise Manager.

To restore a machine from the backup:

1. On the Ma chines tab, select the necessary machine backup in the list of machines.

To quickly find a machine, you can filter machines in the list by a backup server or search for specific
machines by a machine name.

2. Click Restore and select one of the following restore options:

o Select Overwrite if you want to replace the original machine in the production environment with the
machine from the backup.

o Select Keep if you want to restore the machine from the backup next to the original machine in the
production environment.

NOTE

Veeam Backup Enterprise Manager supports machine restore to the original location only. You
cannot restore a VM to another location or with different settings (such as network settings, format
of restored virtual disks and so on).

3. In the Restore window, select a restore point that will be used to restore the machine.

4. [Optional] Instead of restoring an entire machine from a backup file, you can instruct Enterprise Manager
to recover only those data blocks that are necessary to revert the machine to the selected restore point.
To do this, select the Quick rollback check box. Quick rollback significantly reduces the recovery time and
has little impact on the production environment.

For more information on quick rollback, see the Quick Rollback section of the Veeam Backup & Replication
User Guide.

5. [Optional] To start a machine immediately after recovery, select the P ower on machine after restoring
check box.

199 | V eeam Backup Enterprise Manager | User Guide

 6. Click Restore. Veeam Backup Enterprise Manager will display a message notifying you of the operation
effect (machine from backup will replace the production machine if it is present in the original location).
Click Y es in the message window to start the restore operation.

200 | V eeam Backup Enterprise Manager | User Guide

Performing Failover
Authorized users can perform the following failover operations:

• Failover of a VM processed by a regular replication job

• Failover of a VM processed by a CDP policy

• Failover of a vApp processed by a vCloud Director replication job

Users with the Portal User and Restore Operator roles can perform failover of machines included in the restore
scope. Users with the Portal Administrator role have no restore scope limitations. For more information on
restore scope, see Configuring Restore Scope.

IMP ORTANT

Failover is available in the Enterprise and Enterprise Plus editions of Veeam Backup & Replication.

Performing Failover to VM Replica

If a VM is processed by a regular replication job, you can fail over the VM to its replica. After the failover
operation completes, the VM replica is powered on.

Failover is an intermediate step that needs to be finalized. To do that, you can undo failover, perform
permanent failover or perform failback. You can take the final step in the Veeam Backup & Replication console.
For more information, see the Replica Failover and Failback section of the Veeam Backup & Replication User
Guide.

To perform failover:

1. On the Ma chines tab, select a machine processed by a replication job.

2. Click Restore.

3. In the Restore window, select a restore point of the VM.

4. Click Fa ilover.

201 | V eeam Backup Enterprise Manager | User Guide

 5. To confirm failover, click Y es .

To view the failover progress, on the Ma chines tab, click History.

Performing Failover to CDP Replica

If a VM is processed by a CDP policy, you can fail over the VM to its replica. After the failover operation
completes, the VM replica is powered on.

Failover is an intermediate step that needs to be finalized. To do that, you can undo failover, perform
permanent failover or perform failback. The final step you can take in Veeam Backup & Replication console. For
more information, see the Failover and Failback section of the Veeam Backup & Replication User Guide.

To perform failover:

1. On the Ma chines tab, select a machine processed by a CDP policy.

2. Click Restore.

3. In the Restore window, select the restore point you need. You can fail over to the latest av ailable crash-
consistent state, to the latest application-consistent state or to a specific point in time.

TIP
• To quickly find a long-term restore point, use the calendar.
• To zoom in or zoom out the time line, use the P lus and Minus buttons or switch between the
Hour and Da y views.

202 | V eeam Backup Enterprise Manager | User Guide

 4. Click Fa ilover.

To view the failover progress, on the Ma chines tab, click History.

Performing Failover to vCD Replica

If a VM is processed by a vCD replication job, you can perform failover of the vApp that contains the VM.

Failover is an intermediate step that needs to be finalized. To do that, you can undo failover, perform
permanent failover or perform failback. The final step you can take in Veeam Backup & Replication console. For
more information, see the Failover and Failback section of the Veeam Backup & Replication User Guide.

To perform failover:

1. On the Ma chines tab, select a machine processed by a vCD replication job.

2. Click Restore vApp.

3. In the Restore window, select a restore point of the vApp.

4. Click Fa ilover.

203 | V eeam Backup Enterprise Manager | User Guide

 5. To confirm failover, click Y es .

To view the failover progress, on the Ma chines tab, click History.

204 | V eeam Backup Enterprise Manager | User Guide

Performing Virtual Disk Restore
Authorized users can restore virtual disks of machines included in their restore scope. This may be helpful if a
VM disk becomes corrupted for some reason. The restored virtual disk can be attached to the original VM to
replace a corrupted drive, or connected to any other VM.

For more information on virtual disk restore, see the Virtual Disks Restore section of the
Veeam Backup & Replication User Guide.

IMP ORTANT

Consider the following:

1. This functionality is available in the Enterprise and Enterprise Plus editions of Veeam Backup &
Replication.
2. The disk restore operation is supported for backups of VMware vSphere VMs only.

Users with the Portal Administrator role have no scope limitations. They can restore VM disks to their original
location. Restore scope for other users is defined as described in the Configuring Restore Scope section.

To restore a VM disk from backup:

1. On the Ma chines tab, select the necessary machine backup in the list of machines.

To quickly find a machine, you can filter machines in the list by a backup server or search for specific
machines by a machine name.

2. Click Virtual Disks to launch the Virtual Disk Restore wizard.

3. At the Restore P oint step of the wizard, select the restore point that will be used to restore the VM disk.

205 | V eeam Backup Enterprise Manager | User Guide

 4. At the Disk Mapping step of the wizard, specify VM disk restore settings:

a. By default, Veeam Backup Enterprise Manager offers you to restore virtual disks to the original VM.
To select another VM, click Choose next to the Virtual machine field and select the necessary VM from
the virtual environment.

b. In the Disk Mapping section, select check boxes next to virtual disks that you want to restore .

c. By default, virtual disks are restored in the original format. To change the disk format, select the
necessary option from the Restore disks list: Same as source, Thin, Thick (lazy zeroed) or Thick (eager
zeroed) . For more information about virtual disk types, see VMware Docs.

NOTE

Disk format change is supported only for VMs with Virtual Hardware version 7 or later.

d. [For disk restore to the original location and with original format] Instead of restoring an entire virtual
disk from a backup file, you can instruct Enterprise Manager to recover only those data blocks that are
necessary to revert the disk to the selected restore point. To do this, select the Quick rollback check
box. Quick rollback significantly reduces the recovery time and has little impact on the production
environment.

5. By default, virtual disks are restored to the target machine with the original properties. To change
properties for the restored disks:

a. In the Disk Mapping section, select the necessary virtual disk and click the Cha nge disk mapping link.

b. In the Virtual Disk Properties window, click Choose next to the Da tastore field and select a datastore
where the virtual disk file will be placed.

c. From the Virtual Device Node list, select a virtual device node for the restored disk on the target VM:

▪ If you want to replace an existing virtual disk, select an occupied virtual device node.

206 | V eeam Backup Enterprise Manager | User Guide

 ▪ If you want to attach the restored disk to the VM as a new drive, select a node that is not
occupied yet.

d. Repeat steps a–c for every virtual disk that you want to restore.

6. At the Secure Restore step of the wizard, you can instruct Veeam Backup & Replication to perform secure
restore — scan virtual disk data with antivirus software before restoring the disk. For more information on
secure restore, see the Secure Restore section of the Veeam Backup & Replication User Guide.

To specify secure restore settings:

a. Select the Sca n the restored disk for malware prior to performing recovery check box.

b. Select the action that Veeam Backup & Replication will take if the antivirus finds a virus threat:

▪ P roceed with recovery but do not a ttach infected disks to the target VM. Select this option if
you want to continue the virtual disk restore. In this case, the restored disk will not be attached
to the target VM.

▪ Ab ort disk recovery. Select this option if you want to cancel the restore session.

207 | V eeam Backup Enterprise Manager | User Guide

 c. Select the Sca n the entire image check box if you want the antivirus to continue the machine data
scan after the first malware is found.

7. At the Summary step of the wizard, complete the procedure of VM disk restore. To start a VM immediately
after the restore process completes, select the P ower on target VM after disk is restored check box. Then
click Finish.

To view the progress of the virtual disk restore operation, on the Ma chines tab, click History.

208 | V eeam Backup Enterprise Manager | User Guide

Running Failover Plans
This feature is not available for physical machine backups. If your infrastructure comprises machines running
interdependent applications (for example, Exchange Server and domain controller), it is reasonable to failover
them one by one, as a group. To do this automatically, you can prepare a failover plan using Veeam Backup &
Replication console.

In Veeam Backup Enterprise Manager, you can run failover plans created in Veeam Backup & Replication console
for VMware vSphere and Microsoft Hyper-V VMs.

Failover plan sets the following:

• The order in which the machines should be processed: for example, AD domain services server first,
Exchange server after it.

• The delay time needed to start each machine. The delay time helps to ensure that certain machines (AD
domain services server in our example) are already running at the time the dependent machines start.

The failover process is performed in the following way (either ad -hoc or on schedule):

1. For each machine included in the plan, Veeam Backup & Replication detects its replica (the machines
whose replicas are already in Failover or Failback state are skipped from processing).

2. The replica machines are started sequentially, in the order they app ear in the failover plan, within the set
time intervals.

Consider that failover is a temporary intermediate step that needs to be finalized. The finalizing options for a
group failover are similar to a regular failover: undoing failover, permanent failover or failback. To learn more
about failover planning and recommended course of action, refer to Veeam Backup & Replication User Guide.

Veeam Backup Enterprise Manager allows you to carry out a failover following the existing plan, and also to
undo planned failover.

NOTE

For failover plan creation, as well as for permanent failover or failback, use the Veeam Backup &
Replication console.

To run a failover plan:

1. Log in to Enterprise Manager using an administrative account or user account whose restore scope
contains the machines from the failover plan.

2. Go to the Ma chines tab and click Fa ilover P lan.

3. In the Fa ilover Plan window, select the necessary plan from the list, then specify the starting option you
need.

The following options are available for a failover plan:

o Sta rt now — use this option if you need to fail over to the replicas’ latest restore point.

o Sta rt to most recent replica prior to — use this option if you need to fail over to a certain restore point.
For example, you may want your application server to failover to a state prior to the upgrade. In this
case, for each machine participating in failover, Veeam will find the closest restore point (prior to the
specified date and time) and fail over to it.

o Und o — use this option to switch the workload back to source machines discarding the changes that
were made to the replicas during failover.

209 | V eeam Backup Enterprise Manager | User Guide

 4. Click OK and wait for the process to complete. You can examine session details in the Ma chines > Restore
sessions.

210 | V eeam Backup Enterprise Manager | User Guide

Restoring Guest OS Files
Veeam Backup Enterprise Manager allows you to browse the guest OS file system in a machine backup, search
for guest OS files and restore the necessary files. You can locate and restore files from the machine restore point
created with or without guest OS file indexing.

NOTE
• Enterprise Manager does not support 1-Click restore, 1-Click guest OS file restore, or application
item-level restore for Microsoft Exchange mailbox items or Microsoft SQL Server databases if it is
performed from any storage snapshot.
• In Enterprise Manager, you can browse and restore guest OS files of Nutanix AHV VMs only from the
backups created by backup copy jobs.

To browse and restore guest OS files and application items from a physical machine backup stored in a Veeam
backup repository, you need a certain Veeam Agent deployed on the machine and integrated with
Veeam Backup & Replication. For more information, see Support for Veeam Agents.

Browsing and restoring processes involve appropriate backup job setup, as well as mount and data transfer
operations.

How File Restore Works

When you restore files from the restore point created with guest OS file indexing enabled,
Veeam Backup & Replication uses the following workflow:

1. To provide for browsing and search, Veeam Backup & Replication uses index data to represent the file
system of the machine guest OS.

2. If you then select to download the necessary files, Veeam Backup & Replication will mount machine disks
(from the restore point) on the Veeam backup server and copy these files from the backup server to the
destination location.

3. If you select to restore files to the original location, an additional mount point will be created on the
mount server associated with the backup repository storing the backup file. During restore, machine data
will flow from the repository to the target, keeping the machine traffic in one site and reducing load on
the network.

4. After you download or restore the necessary files, and finish the restore session, the machine disks will be
unmounted.

When you restore files from the restore point that was created without machine guest OS file indexing,
Veeam Backup & Replication uses the following workflow:

1. To provide for browsing, disks of the machine from the backup file are mounted to the Veeam backup
server. If you then select to download the necessary files, Veeam will copy these files from the backup
server to the destination location, using this mount point.

2. If you select to restore files from the backup to the original location on the production machine, an
additional mount point will be created on the mount server associated with the backup repository storing
the backup file.

3. If you restore files from replica, a single mount point for all these operations (browsing, download, restore
to original location) will be created on the Veeam backup server.

4. After you download and restore the necessary files and finish the restore session, machine disks will be
unmounted.

211 | V eeam Backup Enterprise Manager | User Guide

Preparing for File Browsing and Searching
If you have Veeam Backup & Replication and Veeam Backup Enterprise Manager installed, you can use Veeam
indexing capabilities to quickly find the files and folders.

To use guest file system indexing:

1. Enable guest file system indexing on the Guest Processing step of the backup job wizard. For more
information, see Configure Guest Processing Settings.

2. Run the backup job with guest file system indexing enabled.

3. Perform catalog replication. For more information, see Performing Catalog Replication and Indexing.

Alternatively, you can process the machine without guest file system indexing. Veeam Backup & Replication
supports file-level restore not only for machines included in guest catalog but also for the machines that are not
indexed. Indexing may be disabled at the time of restore point creation, or indexing operation may fail. I n this
case, the restore point of a Windows machine is mounted to the backup server that manages the job, and the
restore point of a non-Windows machine is mounted to the helper appliance.

Then a user will be able to locate necessary files and folders and perform restore operation. For more
information, see Browsing Machine Backups for Guest OS Files.

212 | V eeam Backup Enterprise Manager | User Guide

Performing Catalog Replication and Indexing
Once you have run backup jobs with guest OS file system indexing enabled, perform ca talog replication to
consolidate index files from multiple backup servers. During this operation, Veeam Backup Enterprise Manager
aggregates index data from multiple backup servers and stores them on the Veeam Backup Enterprise Manager
server to enable file browsing and search.

NOTE

Catalog replication is performed for the machines with indexed guest OS file systems on all managed
backup servers.

Veeam Backup Enterprise Manager provides two options to perform catalog replication:

• To perform manual catalog replication, open the Settings tab of the Configuration view and click Up date
Now on the Sea rch Catalog tab.

• To automatically run catalog replication after every backup job, open the Settings tab of the Configuration
view. On the Sea rch Catalog tab, select Up d ate catalog automatically after each backup job run and
specify other options as required.

Every run of a catalog replication job initiates a new job session which can be tracked on the Sessions tab of the
Configuration view. To view detailed information for a specific session, select it in the list of sessions and click
the link in the Sta tus column.

213 | V eeam Backup Enterprise Manager | User Guide

Preparing for File Search and Restore (non-
Windows machines)
To view, search and restore guest files of non-Windows machines, take the following preparatory steps:

1. To enable guest file indexing, use one of the options of the machine backup job: Ind ex everything, Index
everything except, or Ind ex only following folders option. For more information, see the Guest OS File
Indexing section of this guide and the VM Guest OS File Indexing section of the Veeam Backup &
Replication User Guide.

Keep in mind that indexing is optional. You can browse and restore machine guest files from the restore
points created without guest indexing. For more information, see Browsing Machine Backups for Guest OS
Files and Performing 1-Click File Restore.

NOTE

If you want Veeam Backup Enterprise Manager to display symbolic links to folders when browsing
through the machine file system at 1-click file restore, enable indexing in the backup job for that
machine (running Linux or another non-Windows OS).

2. For proper file system indexing, Veeam Backup & Replication requires several utilities to be installed on
the machine: mlocate, gzip, and tar. If these utilities are not found, you are prompted to deploy them
to support index creation.

3. By default, guest file restore to the original location is performed using the account specified in the
machine backup job. If it does not have sufficient access to target machine, you are prompted for the
credentials. Specify user account with sufficient access rights.

For more information, see the Guest OS Credentials section of this guide and the Specify Guest Processing
Settings section of the Veeam Backup & Replication User Guide.

Preparing FLR Helper Appliance

To perform guest file restore, configure an FLR helper appliance on the Veeam backup server that controls the
backup job processing the machine. For details on FLR helper configuration, refer to the Restoring VM Guest OS
Files (Multi-OS) section of the Veeam Backup & Replication User Guide. These settings are saved in
Veeam Backup & Replication database on per-user basis. The settings are applied each time the user starts file-
level restore.

When guest file-level restore is started from Veeam Backup Enterprise Manager, FLR helper configuration
settings are obtained from the database of the backup server. If no FLR helper configuration is found for current
user account, Veeam Backup & Replication uses the default settings (set during the latest FLR appliance
configuration process in Veeam backup console). Thus, before starting file-level restore from Enterprise
Manager, make sure that FLR helper settings are configured on Veeam backup server.

214 | V eeam Backup Enterprise Manager | User Guide

 NOTE
• When you configure an FLR helper appliance for tenants that will perform self -service restore (from
Veeam Self-Service Backup Portal or vSphere Self-Service Backup Portal), be aware that multiple
tenants may run the restore procedure at the same time. In this case if you have configured a static IP
address for helper appliances, a tenant will not be able to deploy a helper appliance until the IP
address is in use by a helper appliance of another tenant. To let tenants start multiple helper
appliances, use a DHCP server in your network and configure the helper appliance to obtain an IP
address automatically.
• If you plan to deploy multiple FLR helper appliances to restore machines backed up by different
Veeam backup servers, their initial configuration should be performed on the backup servers.
Centralized configuration from Veeam Backup Enterprise Manager is not supported.

215 | V eeam Backup Enterprise Manager | User Guide

Browsing Machine Backups for Guest OS
Files
After catalog replication, you can browse any machine backup for OS guest files. Note that with the file
browsing functionality, you can browse and search for files in the selected machine backup at a specific restore
point only.

If you are using the Enterprise or Enterprise Plus license edition in your vir tual environment, consider that
Veeam Backup Enterprise Manager keeps index files for backups that are currently stored on disk, and for
archived backups (for example, backups that were recorded to tape). Thus, you will be able to browse and
search through backup contents even if the backup in repository is no longer available.

To browse guest OS files in a machine backup:

1. Open the Files tab.

2. In the Sea rch backups of field, enter the name of a machine whose files you want to restore or click the
P ick from List link and select the necessary machine in the Select Object window.

3. To specify a restore point from which to restore guest OS files, click the calendar icon in the restore point
field and select the necessary date when backup was performed and a restore point created on that date.
Note that you cannot select dates when backup was not performed. By default, the latest restore point is
selected in the restore point field.

4. If the machine has been backed up without guest indexing, click Mount. If the machine guest OS
information has not been collected during the backup, you will be also prompted to specify the guest OS
type. Machine disks from the backup will be mounted to Veeam backup server to present machine file
system to you; wait for the process to complete.

If the machine has been backed up with guest indexing enabled, no additional operations are needed.

216 | V eeam Backup Enterprise Manager | User Guide

 As a result, the file tree of the machine as of the selected backup and restore point date will be displayed.
You can manually browse the file tree or use the search field to find a necessary file. Consider that
depending on the number of files on the machine, the search process may take some time.

IMP ORTANT

For machines processed without indexing, you can only use browsing or search to find the necessary files
within the selected restore point. Advanced search capabilities (including search through multiple restore
points) are available only for machines processed with guest indexing enabled.

217 | V eeam Backup Enterprise Manager | User Guide

Searching Guest OS Files in Machine
Backups
Veeam Backup Enterprise Manager allows you to search for guest OS files in all machine backups created by
managed backup servers with guest indexing enabled.

IMP ORTANT

By default, backup repository is the primary destination for the search. This means, in particular, that if a
backup (with indexed guest) is stored in both locations — repository and tape — then Enterprise Manager
search results will only include files from backup stored in repository. Files from tape -archived backup will
appear in search results only if not found in the repository. (This capability is supported in the Enterprise
and Enterprise Plus editions.)

You can use one of two available search modes: simple or advanced.

The simple search allows you to search for guest OS files in the latest restore point of the selected machine
backup. To perform simple search:

1. Open the Files tab.

2. In the Sea rch backups of field, enter the name of a machine whose files you want to restore or click the
P ick from List link and select the necessary machine in the Select Object window.

3. In the search field, enter the name of the necessary file or a part of it and click Sea rch.

The advanced search allows you to search for guest OS files in all restore points of the sele cted machine backup
and filter search results by certain criteria. To perform advanced search:

1. Open the Files tab and click No Filter next to the search field.

2. In the search field, enter the name of the necessary file or a part of it.

3. In the Set Options window, define the necessary search criteria:

o Loca tion — select a specific folder on the machine to search in.

o La st modification time — specify approximate time when the file was last modified or set a time
interval.

o Ba ckup time — choose to search through the latest backup of the specified machine or all backups of
the machine created within a certain time interval.

o Owner — select to search for files with a specific owner.

o Ty p e — select to search for files of specific type or with a certain extension.

o Size — specify approximate size of file or set a size range.

4. To apply the filter, click Ap p ly.

218 | V eeam Backup Enterprise Manager | User Guide

 5. Click Search on the right of the search field.

219 | V eeam Backup Enterprise Manager | User Guide

Performing 1-Click File Restore
After you find the necessary file, you can use Veeam Backup Enterprise Manager to restore it from backup with
one click. You can choose to restore it to the original location or download it to the local machine.

IMP ORTANT

Consider the following:

• 1-Click file restore capability is available if you have the Enterprise or Enterprise Plus edition.
• 1-Click guest OS files restore from any storage snapshot is not supported by Veeam Backup
Enterprise Manager.

Restore operations are only available to authorized users according to their security settings. Users wi th the
Portal Administrator role can restore files both to the original location or download them to the local machine.

For users with the non-administrative roles, you can configure additional restriction settings. For example, you
can prohibit restore operators to download files to the local machine so that they can restore files to the original
location only. Additionally, you can specify the types of files that can be restored by operators (this can be
helpful if you want to limit operators’ access to sensitive data). For details, see Configuring Accounts and Roles.

NOTE

Consider the following:

• If you plan to restore a file from a machine backed up without guest indexing, consider that for
restore operation this machine disk will be mounted directly from the backup in the repository to the
mount server associated with that repository; if restoring from replica, it will be mounted to Veeam
backup server. If restoring from an indexed machine, no interim mount operations are needed.
• If you want Veeam Backup Enterprise Manager to display symbolic links to folders when browsing
through the machine file system at 1-click file restore, then you should enable indexing in the backup
job for that machine (running Linux or another non-Windows OS).

220 | V eeam Backup Enterprise Manager | User Guide

Restoring Files to Original Location
In this restore scenario, Veeam Backup Enterprise Manager will extract the file from the backup and restore it to
the original production machine. Restoring guest OS files to the original location is the most secure file recovery
method, as the user who initiates the file restore operation in the Veeam Backup Enterprise Manager web UI
cannot access the file itself.

IMP ORTANT

This type of restore is only possible if the original machine is powered on and resides in the original
location.

To restore a file to the original location:

1. Locate the necessary file using browse or search possibilities of Veeam Backup Enterprise Manager.
Multiple selection is also possible. For details, see Browsing Machine Backups for Guest OS Files or
Searching Machine Backups for Guest OS Files.

2. Click Restore and select how to restore selected files:

o If you select Overwrite, the file from the backup will replace the original file on the target machine.

o If you select Keep, the file from the backup will be restored next to the original file on the target
machine; the file from machine backup will have the Restored prefix in the file name.

3. In the displayed window, click Y es .

Veeam Backup Enterprise Manager will start the restore operation and display the progress and result of the
operation in the File Restore History view.

221 | V eeam Backup Enterprise Manager | User Guide

 IMP ORTANT

By default, guest file restore to the original location is performed using the account specified in the backup
job for guest OS access. If it does not have sufficient rights to access the target machine, you are prompted
for the credentials. Specify user account and password, as required. For more information, see Guest OS
Credentials.

222 | V eeam Backup Enterprise Manager | User Guide

Downloading Files to Local Machine
If you choose to download the restored file, Veeam Backup Enterprise Manager interacts with the Veeam ba ckup
server to extract the necessary file from a backup. The user who initiated file restore will be able to download
the file to the local machine.

To restore a file to the local machine:

1. Locate the necessary file using browse or search possibilities of Veeam Backup Enterprise Manager. For
details, see Browsing Machine Backups for Guest OS Files or Searching Machine Backups for Guest OS
Files.

2. Click Download.

3. In the displayed window, click Y es .

4. Wait for restore session to complete and for the file to be retrieved from the backup.

5. Select the file from the list.

6. In the Log tab of the File Restore History view, click the d ownload link in the Restored files are available
for download record of the session log.
The file is saved to the default download folder on your local machine.

223 | V eeam Backup Enterprise Manager | User Guide

 If you download a single file, it is also saved in the %ProgramData%\Veeam\Backup\WebRestore
folder. Multiple files are packed in a ZIP file named FLR_<date>_<time>.zip and stored in the same
folder. Veeam Backup Enterprise Manager cleans up the folder periodically. Files older than 24 hours are
automatically deleted. To change the default storage folder, contact Veeam Customer Support.

224 | V eeam Backup Enterprise Manager | User Guide

Restoring Multiple Files
In addition to restoring single files from selected restore points, Veeam Backup Enterprise Manager supports
bulk restore. If you need to restore multiple files at once, you can select more than one file in the preview pane
when browsing, and then use the Restore command, or add the necessary files to the restore list and then
restore all files at once. Unlike the Restore command, using the restore list helps you to prepare for restore files
from different machines, backups and restore points.

To add a file to the restore list:

1. Locate the necessary file using browse or search possibilities of Veeam Backup Enterprise Manager. For
more information, see Browsing Machine Backups for Guest OS Files or Searching Machine Backups for
Guest OS Files.

2. Click Ad d to Restore List.

When a file is added to the restore list, the P ending restore notification appears at the top of the Enterprise
Manager window.

To restore files added to the restore list:

1. In the restore list notification, click P ending restore.

2. In the P ending Restore window, select check boxes next to files in the restore list that you want to
restore. Use the check box next to the header of the Na me column to select all files in the list at once.

If you want to remove a file from the restore list, select the file and click Delete.

3. Click the Restore or Download link to perform the necessary restore operation for the selected files.

4. In the displayed window, click Y es .

5. [For the download operation] Wait for restore session to complete. In the Log tab of the File Restore
History view, click the d ownload link.

The files are saved to the default download folder on your local machine.

225 | V eeam Backup Enterprise Manager | User Guide

 Multiple files are also saved in a ZIP file named FLR_<date>_<time>.zip in the
%ProgramData%\Veeam\Backup\WebRestore folder. Veeam Backup Enterprise Manager cleans up the
folder periodically. Files older than 24 hours are automatically deleted. To change the default storage
folder, contact Veeam Customer Support.

TIP

Veeam Backup Enterprise Manager keeps links for downloaded files in the history for one day. To
download a file that was previously restored:

1. In the Files tab, click History.

2. In the File Restore History view, select the necessary restore session.
3. In the Log tab, click the d ownload link.

226 | V eeam Backup Enterprise Manager | User Guide

Using Self-Service File Restore Portal to
Restore Machine Guest Files
Veeam Backup Enterprise Manager streamlines delegation of restore capabilities: instead of multiple role
assignments and restore scope fine-tuning, Enterprise Manager administrator can provide users that have local
administrator rights on a Windows-based machine with a link to Self-Service File Restore Portal — a web UI that
displays the controls for file-level restore of the protected machines.

This capability is supported by the Veeam runtime process which performs guest system indexing and also
identifies local administrative accounts. Communication with the self-service webpage is performed over the
HTTPS protocol. In particular, such delegation capabilities and self-service web portal can be used in enterprise
deployments to elevate the first line support to perform in-place restores without administrative access.

Before You Begin

NOTE
• This functionality is supported only in the Enterprise Plus edition of Veeam Backup & Replication.
• Self-Service File Restore Portal is available only for users of Microsoft Windows machines. For Linux -
based machines, guest OS file restore is performed in the Veeam Backup Enterprise Manager UI under
a user account configured in Enterprise Manager. For more information, see Managing Accounts and
Roles.
• Veeam Backup Enterprise Manager does not support guest OS files restore from storage snapshots.
You can use the Veeam Backup & Replication console instead.

To provide a user account with the ability to access Self-Service File Restore Portal, make sure the following
prerequisites are met:

• The account belongs to the trusted or same domain as the Enterprise Manager server (for the user account
to be resolved to SID). Users from untrusted domains cannot utilize self-restore.

• The account has local administrative rights for the required machine guest OS, local user rights are not
sufficient.

IMP ORTANT

A Self-Service File Restore Portal user has access only to restore points created after the user is assigned
with local administrator rights.

Machine restore points will stay available for self-restore to a user account whose local administrative
rights were revoked after the restore point creation until the next restore point is created (then that user
will not be able to access guest files any longer).

227 | V eeam Backup Enterprise Manager | User Guide

Browsing Guest OS Files Through Self-Service Portal
To access the guest files in a machine backup:

1. Start the Self-Service File Restore Portal by clicking its icon in the list of applications or on the desktop.
Alternatively, in the web browser address bar, enter the portal URL, for example:

https://enterprise_manager_host:9443/selfrestore

2. Enter the account credentials to log in. Use the DOMAIN\USERNAME format to specify the user name. The
Files tab will open. By default, it displays guest OS files as of the latest restore point of the machine to
which you logged in with local administrative rights.

4. To view guest files as of earlier restore point, click the ca lendar icon and select the restore point. To view
guest files of another machine (if available to you), use the Sea rch field or the P ick from List link.

5. You can perform all operations supported for machine guest files by Veeam Backup Enterprise Manager.
For more information on file browsing, search and restore, see Browsing Machine Backups for Guest OS
Files, Searching Machine Backups for Guest OS Files, Performing 1-Click File Restore.

If no guest OS files are visible to the user, check the following reasons:

• The backup server that manages the job is not added to the Enterprise Manager infrastructure. For more
information, see Adding Backup Servers.

• The recent backup job data has not been yet collected from the backup server (default time interval is 15
minutes). For more information on how to run data collection manually, see Collecting Data from Backup
Servers.

• The E nable g uest file system indexing option is turned off in the machine backup job. Edit the job setting
and restart the job with indexing enabled.

• When the machine restore point was created, the user was not assigned local administrative rights. To
access the guest OS files the user must be a part of the guest OS local administrator group.

228 | V eeam Backup Enterprise Manager | User Guide

If you cannot find your machine from the P ick from List window, you can select the I d on't see my machine
option to rebuild a security scope for your user account. Once complete, this action will reveal machines that
were added to your security scope.

Disabling Self-Service File Restore Portal

You can prevent local administrators from accessing the self-service file restore functionality. You can do it by
disabling Self-Service File Restore Portal. To disable the portal, change the Enterprise Manager registry key. For
more information, contact Veeam Customer Support.

229 | V eeam Backup Enterprise Manager | User Guide

Backup and Restore of Application Items
Veeam Backup Enterprise Manager supports item-level recovery from application-aware backups created by
Veeam Backup & Replication. This capability can be helpful, for example, to restore operators at Help Desk, as
well as other authorized personnel.

230 | V eeam Backup Enterprise Manager | User Guide

Backup and Restore of Microsoft Exchange
Items
Restore personnel can be delegated the ability to recover the necessary Microsoft Exchange items (ema ils,
tasks, calendars) from the Microsoft Exchange server machine backups. This functionality is provided in the
Enterprise and Enterprise Plus editions of Veeam Backup & Replication.

IMP ORTANT

To be able to restore Microsoft Exchange items from the Veeam Backup Enterprise Manager UI, make sure
Veeam Backup Enterprise Manager is installed on the domain member server from the Microsoft Active
Directory forest in which Microsoft Exchange mailboxes are located.

Restore Requirements and Limitations

• Enterprise Manager supports restore from backups created with Veeam Backup & Replication versions 8.0
and later.

• Enterprise Manager supports restore over a network connection only. Restore with PowerShell Direct, VIX
or Sphere API is not supported.

• Enterprise Manager does not support application item restore from storage snapshots.

231 | V eeam Backup Enterprise Manager | User Guide

Preparing Application-Consistent Backup
To provide for recoverability of Microsoft Exchange items, make sure you have an application-consistent backup
(with VSS enabled) of your Microsoft Exchange server machine created successfully.

To check and configure job settings:

1. Go to the Job s tab and select your Exchange server backup job.

2. Click Job on the toolbar and select E d it to start the job wizard.

3. Proceed to the Guest Processing step of the wizard and make sure the E na ble application-aware
p rocessing check box is selected.

4. Click the Customize Application link. In the displayed window, select the Exchange server machine from
the list and click E d it.

5. On the General tab, make sure that the Require successful processing option is selected in the
Ap p lications section.

6. In the Tra nsaction logs processing section, the P rocess transaction logs with this job option is selected by
default.

7. Click OK to save the settings and close the window.

8. In the Guest OS credentials section you can edit the account credentials under which guest OS will be
accessed.

o By default, for all machines in the job Veeam will use common credentials provided in the Guest OS
credentials section — for that, you can select the account from the list, or click the ‘+’ sign and select
Windows (or Linux) OS. Then you will be prompted to enter a user name and password for guest OS
access. Click OK to save the settings and return to the Guest P rocessing page.

232 | V eeam Backup Enterprise Manager | User Guide

 o Alternatively, you can click the Customize Credentials link and then click Set user. Then you can
specify custom guest OS credentials for the selected machine.

For more information on specifying guest OS access credentials, see Guest OS Credentials.

9. At the final step of the wizard, verify job schedule and click Finish.

233 | V eeam Backup Enterprise Manager | User Guide

Providing Access Rights
Users responsible for Exchange items restore must be assigned a security role in Enterprise Manager, and be
allowed to access and restore Microsoft Exchange items.

To provide a user with access rights, do the following:

1. Assign a security role to the necessary user and allow them to restore Microsoft Exchange items:

a. Open the Roles section of the Configuration view.

b. Click Ad d to add an account, or select an existing account and click E d it.

c. To allow restore of Microsoft Exchange items, select the Microsoft Exchange items check box.

d. Click OK to save the changes.

This makes the Items tab become available to these users after they log in to Enterprise Manager.

For more information on Enterprise Manager accounts and roles, see Configuring Accounts and Roles.

2. Specify an Active Directory account that will be used to restore Exchange items:

a. Open the Settings section of the Configuration view.

b. On the Directory Account tab, specify a user name and password of the necessary account. Make sure
the account meets the following requirements:

▪ The account must be a member of the Organization Management or Domain Administrators

group.

234 | V eeam Backup Enterprise Manager | User Guide

 ▪ The account must have sufficient rights to access mailboxes. To assign these rights, you can use
Exchange Impersonation or grant the Full Access permission to the account. For more
information on Exchange Impersonation, see Microsoft Docs.

c. Click Sa ve to save the changes.

235 | V eeam Backup Enterprise Manager | User Guide

Restore Procedure
To restore a Microsoft Exchange item to the production Exchange Server:

1. Sign in to Veeam Backup Enterprise Manager using an account with the sufficient permissions. For more
information, see Providing Access Rights.

2. Open the Items tab, then click Ma ilbox Items.

3. In the Username field, enter the account of Active Directory user whose mailbox will be restored. You can
leave the Username field empty and click the search icon to display all mailboxes that currently exist in
the production environment, or enter a search criteria. Enterprise Manager uses Global Catalog to examine
Active Directory database and find the specified user mailbox, as well as the DNS name for the Exchange
Server where the data should be restored. Then it looks for the VM backup or replica and its rest ore
points.

4. In the Restore point field, select a restore point.

NOTE

Consider the following:

• Restore points on tape are not supported (only those stored in repository can be used).
• Restore to another domain is supported within the same forest only.

5. In the Items section, select the type of item you want to restore:

o Mail

o Calendar

o Contacts

You can select to Only restore missing items created or received during the certain time period. To specify
the period, use the drop-down list.

6. Click the Restore button. Items that meet specified conditions will be restored to the production Exchange
Server.

To view item restore session information, click History.

236 | V eeam Backup Enterprise Manager | User Guide

 NOTE

Consider the following:

• You can use Veeam Backup Enterprise Manager to restore deleted items to the production mailbox
only.
• If the specified mailbox does not exist in the machine restore point that you selected for restore,
Veeam Backup Enterprise Manager will display an error message.

237 | V eeam Backup Enterprise Manager | User Guide

Backup and Restore of Microsoft SQL
Server Databases
Authorized personnel can use Veeam Backup Enterprise Manager to restore the necessary SQL databases from
Microsoft SQL Server machine backups.

NOTE

This functionality is provided in the Enterprise and Enterprise Plus editions of Veeam Backup & Replication.

Restore Requirements and Limitations

• Enterprise Manager supports restore from backups created with Veeam Backup & Replication versions 8.0
and later.

• Enterprise Manager supports restore over a network connection only. Restore using PowerShell Direct,
VIX or Sphere API is not supported.

• Enterprise Manager does not support database restore from storage snapshots.

238 | V eeam Backup Enterprise Manager | User Guide

Preparing Application-Consistent Backup
To provide for recoverability of SQL database, make sure you have an applica tion-consistent backup (with VSS
enabled) of your SQL server machine created successfully. Also, if you plan to restore the database to its state
as of the certain point in time (not necessarily the restore point, that is, backup or replica), then transact ion log
processing should be configured, as described below, as well as in the Veeam Backup & Replication User Guide.

To configure job settings:

1. Go to the Job s tab and select your SQL server backup job.

2. Click Job on the toolbar and select E d it to start the job wizard.

3. Proceed to the Guest Processing step of the wizard and make sure the E na ble application-aware
p rocessing check box is selected.

4. Click the Customize Application link. In the displayed window, select the SQL server machine from the list
and click E d it.

5. On the General tab, make sure the Require successful processing option is selected in the Ap p lications
section.

6. To be able to specify transaction log handling options, make sure the P rocess transaction logs with this
job option is selected. Otherwise, if you select the P erform copy only option, Veeam Backup & Replication
will create a copy-only backup, and transaction logs will not be purged — that is why the SQL tab with log
handling settings will be deactivated in this case. For more information, see the Microsoft SQL Server
Transaction Log Settings section of the Veeam Backup & Replication User Guide.

7. Open the SQL tab and specify how SQL transaction logs will be handled:

o Select Truncate logs if you want Veeam Backup & Replication to trigger truncation of transaction logs
only after the job is finished successfully. If truncation of transaction logs is not possible f or some
reason, the logs will remain untouched in the machine guest OS until the next start of the Veeam
runtime process responsible for application-aware processing.

239 | V eeam Backup Enterprise Manager | User Guide

 o Select Do not truncate logs if you do not want Veeam Backup & Replication to truncate logs at all.

o Select Ba ckup logs periodically if you need to backup transaction logs of SQL server machine, storing
them to backup repository next to server backup. After transaction logs are placed to repository, they
will be truncated on guest. With this option selected, you should also specify how often Veeam will
process these transaction logs, uploading them to repository. To set the processing frequency, enter
the required value in the Ba ckup logs every <N> minutes field (default is every 15 minutes).

The last option allows you to restore the SQL database to a selected restore point or to a selected
point in time, using Enterprise Manager. Restore to specific transaction can be performed using
Veeam backup management console. For more information, see the Microsoft SQL Server Transaction
Log Settings sections of the Veeam Backup & Replication User Guide.

IMP ORTANT

Consider the following:

• If you select the Do not truncate logs option, make sure the recovery model for the necessary
databases on the SQL server is set to simple (otherwise, logs may drastically increase in size).
• For the Ba ckup logs periodically option to take effect, you should ensure that full or bulk-
logged recovery model is turned on for the required databases on the SQL server machine. If
recovery model is set to simple, no transaction logs will be backed up. If full model is enabled
but neither Ba ckup logs periodically nor Truncate logs option is selected, then logs will
increase in size and occupy disk space.

8. If you selected to back up transaction logs, specify how long they should be kept using options in the
Retain log backups section.

Select the Until the corresponding image-level backup is deleted option, so that you do not have to
manually check and ensure that your database and log backup retention policies are consistent, providing
all the machine restore points and log backups required for database restore.

9. Click OK to save the settings and close the window.

240 | V eeam Backup Enterprise Manager | User Guide

 10. At the Job Schedule step of the wizard, make sure the schedule is enabled for the job. Otherwise, log
backup will not be activated.

11. Click Finish.

241 | V eeam Backup Enterprise Manager | User Guide

Providing Access Rights
Users responsible for SQL database restore should be assigned an Enterprise Manager role and be able to
restore Microsoft SQL Server databases. To allow for database restore, select the Microsoft SQL Server
d a tabases check box in the Ad d Role / Edit Role window.

If necessary, select the Deny in-place database restores check box.

The Items tab will become available to these users after they log in to Enterprise Manager.

For more information on how to configure user access rights, see Configuring Accounts and Roles.

242 | V eeam Backup Enterprise Manager | User Guide

Restore Procedure
To restore a Microsoft SQL Server item:

1. Sign in to Veeam Backup Enterprise Manager using an account with the sufficient permissions. For more
information, see Providing Access Rights.

2. Go to the Items tab and click SQL Database .

3. Enter a name of SQL Server hosting the database you need to restore; use the server_name\instance_name
format. Alternatively, click the P ick from List link to select from the list of available SQL Server machine
backups.

4. The list of available databases will be displayed. Select the database you need. Consider that user
credentials for carrying out the restore procedure will be picked as follows:

a. Veeam Backup Enterprise Manager will try to use the account of the backup job that contains the SQL
Server machine.

b. If this account does not have sufficient rights to perform the restore procedure (for example, in case
of imported backup), user will be prompted to provide the necessary credentials.

NOTE

For more information on the account roles in Veeam Backup Enterprise Manager that allow the user
to restore SQL databases, see Providing Access Rights.

5. Perform restore following the required scenario. For information on the possible restore scenarios, see 1-
Click Restore to Original Location and Restore with Custom Settings.

243 | V eeam Backup Enterprise Manager | User Guide

Scenario 1: 1-Click Restore to Original Location
This scenario allows you to restore the selected database to the latest available state back in the original
location. For that, make sure the Orig inal location option is selected in the Restore to section and click Restore.

When you restore database items to the original location, Enterprise Manager selects user credentials for the
restore procedure according to the following rules:

1. Veeam Backup Enterprise Manager tries to use the account specified in the backup job that contains the
SQL Server machine.

2. If this account does not have sufficient rights to perform the restore procedure (for example, in case of
imported backup), the Enterprise Manager user will be prompted to provide the necessary credentials.

NOTE

For more information on the account roles in Veeam Backup Enterprise Manager that allow a user to
restore SQL databases, see Providing Access Rights.

When performing database restore to the original location, a temporary iSCSI connection is established between
the target SQL server (it acts as an iSCSI initiator) and mount server associated with the backup repository (it
acts as an iSCSI target). For that, Veeam opens a TCP port from the port range 3260 -3270; it closes this port
after restore session is over.

NOTE

If you restore a database that belongs to an AlwaysOn Availability Group, this database will be restored to
the original server and added to the Availability Group.

244 | V eeam Backup Enterprise Manager | User Guide

Scenario 2: Restore with Custom Settings
Alternatively, you can carry out the restore procedure with custom settings, specifying the restore point and
destination location you need. Do the following:

1. To specify a restore point from which to restore the database, in the Restore p oint field, click the calendar
icon and select the necessary date when backup was performed and a restore point created on that date.

2. For a database backed up with transaction log backup turned on, you can also select the necessary point in
time using the P oint in time slider. The slider displays the following timestamps (relative to the currently
selected SQL server restore point):

o Beginning — refers to the previous restore point of the SQL Server machine that contains the selected
database backup. If the previous restore point (server backup) was not found, or the database backup
does not exist in it, then Beginning will refer to current restore point.

o End — refers to the next restore point which contains the selected database backup. If the next
restore point (server backup) and the associated transaction log backup are not found, or if the
database backup does not exist in the server backup, then End will refer to the current restore point.
If the next restore point (server backup) is not found, but the transaction log backup exists for the
preceding period, then End will refer to the latest log backup time.

NOTE

For more information on the transaction log backup, see Microsoft SQL Server Logs Backup and
Restore section of the Veeam Backup & Replication User Guide.

3. In the Restore to section, select the Alternative location option.

4. Click Restore.

5. At the Ta rget Server step of the wizard, specify settings to connect to the target server and database:

a. In the Ta rget Server section, enter the name of the SQL Server or SQL Server instance in the
SERVER\INSTANCE format, and credentials of the account that will be used to connect to the target
server.

245 | V eeam Backup Enterprise Manager | User Guide

 b. In the Ta rget Database section, enter the name of the target database.

c. To use a separate account for connection to the target database, in the Ta rget Database section,
select the Use the following credentials to access the database check box and specify credentials of
the necessary account.

d. If you want to use SQL Server authentication when connecting to the database, select the Use SQL
Server authentication check box.

246 | V eeam Backup Enterprise Manager | User Guide

 6. If AlwaysOn Availability Groups are present on the target server, at the SQL Server Always On step of the
wizard, you can add the restored database to an Availability Group.

247 | V eeam Backup Enterprise Manager | User Guide

 7. At the Files step of the wizard, you can specify paths to database files on the target server. You can
specify separate target locations for the primary database file and secondary database file with logs.

8. Click Finish. Veeam Backup Enterprise Manager will start the restore operation and display the status of
the restore process on the Items tab.

248 | V eeam Backup Enterprise Manager | User Guide

Backup and Restore of Oracle Databases
Authorized personnel can use Veeam Backup Enterprise Manager to restore the necessary databas es from Oracle
Server machine backups.

NOTE

This functionality is provided in the Enterprise and Enterprise Plus editions of Veeam Backup & Replication.

Restore Requirements and Limitations

• Enterprise Manager supports restore from backups created with Veeam Backup & Replication versions 9.0
and later.

• Enterprise Manager supports restore over a network connection only. Restore using PowerShell Direct,
VIX or Sphere API is not supported.

• Enterprise Manager does not support database restore from storag e snapshots.

249 | V eeam Backup Enterprise Manager | User Guide

Preparing Application-Consistent Backup
To provide for recoverability of Oracle database, make sure you have an application-consistent backup of your
Oracle server machine created successfully. For more information on an application-consistent backup, see
Application-Aware Processing. Also, if you plan to restore the database to its state as of the certain point in time
(not necessarily the restore point, that is, backup or replica), then log processing should be configured, as
described below.

To configure job settings:

1. Go to the Job s tab and select your Oracle server backup job.

2. Click Job on the toolbar and select E d it to start the job wizard.

3. Proceed to the Guest Processing step of the wizard and make sure the E na ble application-aware
p rocessing check box is selected.

4. Click the Customize Application link. In the displayed window, select the Oracle server machine from the
list and click E d it.

5. On the General tab, make sure the Require successful processing option is selected in the Ap p lications
section.

6. To be able to specify transaction log handling options, make sure the P rocess transaction logs with this
job option is selected. Otherwise, if you select the P erform copy only option, Veeam Backup & Replication
will create a copy-only backup, and Oracle archived logs will not be deleted — that is why the Ora cle tab
with log handling settings will be deactivated in this case. For more information, see the Oracle Archived
Log Settings section of the Veeam Backup & Replication User Guide.

IMP ORTANT

If both Microsoft SQL Server and Oracle are installed on one machine, and this machine is processed
by a job with log backup enabled for both applications, Veeam Backup & Replication will back up
only Oracle transaction logs. Microsoft SQL Server transaction logs will not be processed.

250 | V eeam Backup Enterprise Manager | User Guide

 7. Open the Ora cle tab and specify how archived logs will be handled:

a. Specify a user account that will connect to Oracle system and perform Oracle archived logs backup
and\or deletion. You can select Use guest credentials — then Veeam will use the account specified for
guest processing in the job configuration for both guest OS access and for connection to the Oracle
system. You can also specify another account. To do this, select the necessary account from the drop -
down list or click Ad d and add a new account. In any case, make sure the account you specify has
sufficient rights. For details, see the Required Permissions section of the Veeam Explorer for Oracle
guide.

b. Specify whether archived logs should be deleted on the Oracle server machine, and whether Veeam
should back them up them to repository. Veeam Backup & Replication supports the following options:

▪ Do not d elete archived logs — this option instructs Veeam to preserve archived redo logs (if any)
on the original Oracle server. With this option selected, your database administrator will have to
take care of database logs. Applicable restore scenario — database restore to the state as of the
currently selected machine restore point, to the selected point in time and to the selected
transaction.

▪ Delete logs older than <N> hours / Delete logs over < N> GB — with this option selected, Veeam
will wait for the image-level machine backup to complete, and then it will trigger archived log
deletion from guest, using the specified condition (log age or size). If archived logs cannot be
deleted for some reason, these logs will remain untouched in the guest machine until the next
start of the Veeam runtime process.

▪ With any of these options, you can also use the Ba ckup logs every <N> minutes check box. If you
select this check box, Veeam Backup & Replication will periodically ship archived logs to the
backup repository and store them next to the Oracle server machine backup. Make sure that
Oracle ARCHIVELOG mode is turned on (contact your database administrator, if necessary). This
option will support any database restore scenario: to the state as of in currently selected
machine restore point, to any point in time or to the state before particular transaction.

251 | V eeam Backup Enterprise Manager | User Guide

 IMP ORTANT

If you plan to use this option together with archived logs deletion from Oracle machine guest, make
sure that these settings are consistent: logs should be deleted after they are backed up to
repository, not vice versa. Thus, you need to set up backup schedule and log removal conditions
appropriately. Default log backup interval is 15 minutes, maximum interval is 480 minutes.

8. If you selected to back up archived logs, specify how long they should be kept using the Retain log
b a ckups options.

Select the Until the corresponding image-level backup is deleted option, so that you do not have to
manually check and ensure that your database and log backup retention policies are consistent, providing
all the machine restore points and log backups required for database restore.

9. Click OK to save the settings and close the window.

10. At the Job Schedule step of the wizard, make sure the schedule is enabled for the job. Otherwise, log
backup will not be activated.

11. Click Finish.

252 | V eeam Backup Enterprise Manager | User Guide

Providing Access Rights
Users responsible for Oracle database restore must be assigned an Enterprise Manager role and be able to
restore Oracle databases.

To allow users with the Restore Operator or P ortal User role to restore Oracle databases:

1. In the Ad d Role / Edit Role window, select the Da tabases check box.

2. Select the Ora cle databases check box.

3. [Optional] If necessary, select the Deny in-place database restores check box.

4. Click OK.

The Items tab will become available to these users after they log in to Enterprise Manager.

For more details on role assignment, see Configuring Accounts and Roles.

253 | V eeam Backup Enterprise Manager | User Guide

Restore Procedure
To restore a database item:

1. Sign in to Veeam Backup Enterprise Manager using an account with the sufficient permissions. For more
information, see Providing Access Rights.

2. Go to the Items tab and click Ora cle Database.

3. Enter the name of Oracle server hosting the database you need to restore. Alternatively, click the P ick
from List link to select from the list of available Oracle server machine backups.

4. Select Oracle home and the database you need. Consider that user credentials for carrying out the restore
procedure will be picked as follows:

a. Veeam Backup Enterprise Manager will try to use the account of the backup job that contains the
Oracle server machine, or the account which is currently logged in.

b. If this account does not have sufficient rights to perform the restore procedure (for example, in case
of imported backup), you will be prompted to supply the necessary credentials. Make sure the
account has access to the original machine guest OS (Windows or Linux); if restoring an Oracle 12
Database on Windows server, then you may need to enter password for Oracle home.

NOTE

The security role specified for this account in Enterprise Manager must allow the user to restore
Oracle databases. For more information, see Providing Access Rights.

5. Perform restore following the required scenario. For information on the possible restore scenarios, see
Scenario 1: 1-Click Restore to Original Location and Scenario 2: Restore with Custom Settings.

To view restore session log, click History.

254 | V eeam Backup Enterprise Manager | User Guide

Scenario 1: 1-Click Restore to Original Location
This scenario allows you to restore the selected database to the latest available state back in the original
location. For that, make sure the Orig inal location option is selected in the Restore to section and click Restore.

When performing database restore to the original location, a temporary iSCSI connection is established between
the target Oracle server (it acts as an iSCSI initiator) and mount server associated with the backup repository (it
acts as an iSCSI target). For that, Veeam opens a TCP port from the port range 3260 -3270; it closes this port
after restore session is over.

255 | V eeam Backup Enterprise Manager | User Guide

Scenario 2: Restore with Custom Settings
Alternatively, you can carry out the restore procedure with custom settings, specifying the restore point and
destination location you need. Do the following:

1. To specify a restore point from which to restore the database, in the Restore p oint field, click the calendar
icon and select the necessary date when backup was performed and a restore point created on that date.

2. If you have backed up archived redo logs for the database, you can also select the necessary point in time
using the P oint in time slider. The slider displays the following timestamps (relative to the currently
selected Oracle database restore point):

o Beginning — refers to the previous restore point of Oracle server machine that contains selected
database backup. If the previous restore point (server backup) was not found, or the database backup
does not exist in it, then Beginning will refer to current restore point.

o End — refers to the next restore point that contains selected database backup. If the next restore
point (server backup) and associated transaction log backup are not found, or if the database backup
does not exist in the server backup, then End will refer to the current restore point. If the next restore
point (server backup) is not found but transaction log backup exists for the preceding period, then
End will refer to the latest log backup time.

NOTE

For more information on log backup, see Preparing and Application-Consistent Backup.

3. To specify a location where you want to restore the database items, select the necessary option in the
Restore to section:

o If you want to restore items to the original database, select Original location. If you select this option,
consider that Enterprise Manager will select user credentials for the restore procedure according to
the following rules:

i. Veeam Backup Enterprise Manager will try to use the account specified in the backup job that
contains the Oracle server machine or the account which is currently logged in.

256 | V eeam Backup Enterprise Manager | User Guide

 ii. If this account does not have sufficient rights to perform the restore procedure (for example, in
case of imported backup), you will be prompted to supply the necessary credentials. Make sure
the account has access to the original machine guest OS (Windows or Linux); if restoring an
Oracle 12 Database on a Microsoft Windows server, you may need to enter password for the
Oracle home.

NOTE

The security role specified for this account in Enterprise Manager must allow the user to restore
Oracle databases. For more information, see Providing Access Rights.

o If you want to restore items to another database, select Alternative location. If you select this option,
you will need to specify restore settings using the Ora cle Restore wizard. For details, see Using Oracle
Restore Wizard.

4. Click Restore.

o In case of restore to the original location, the restore process will start immediately.

o In case of restore to another location, Enterprise Manager will launch the Ora cle Restore wizard. For
more information, see Using Oracle Restore Wizard.

Using Oracle Restore Wizard

If you restore Oracle database items to another location, specify restore settings using the Ora cle Restore
wizard:

1. At the Ta rget Server step of the wizard, specify settings to connect to the server where the database
should be restored:

o For database restore on a Microsoft Windows server, specify connection settings in the following way:

i. In the DNS name or IP address field, enter a DNS name or IP address of the target Microsoft
Windows server.

257 | V eeam Backup Enterprise Manager | User Guide

 ii. In the Account and P a ssword fields, specify credentials of the account that will be used be used
for connection with the target Windows-based Oracle server. Make sure the account has the
sysdba rights on that server (Windows authentication will be used). To be able to copy archived
logs from backup to the target server for further replay (in case of restore to certain point in
time), the account should be also granted sufficient permissions to access the administrative
share on that machine (for example, \\myserver\C$): Read and Write are minimum required,
Full Control recommended.

o For database restore on a Linux server, specify connection settings in the following way:

i. Server name (or IP address) and SSH port — default port is 22.

ii. Account to be used to access the server. This should be a root account or account elevated to
root and added to the sudoers file. To elevate the account and add it to the sudoers file, click
Settings and select the corresponding options.

You can use authentication by a user name and password or by a private key.

258 | V eeam Backup Enterprise Manager | User Guide

 4. At the Ora cle step of the wizard, select Ora cle Home and specify Global database name and Oracle SID
where to restore the database from backup.

Consider that if database with the specified Oracle SID exists on the target Oracle home, the restore
process by design will delete it and replace with the database from backup. Thus, before starting the
restore process, a message will be displayed, asking you to confirm the operation.

5. At the Da tabase Files step of the wizard, specify paths to database files on the target server.

6. Click Finish. Veeam Backup Enterprise Manager will start the restore operation and display the status of
the restore process on the Items tab.

259 | V eeam Backup Enterprise Manager | User Guide

Managing Encryption Keys
Veeam Backup Enterprise Manager provides you with an alternative way for data encryption. It lets you decrypt
the data in case you have lost or forgotten the password used for data encryption. For more information on the
concept, terms and procedures of data encryption, see the Data Encryption section of the
Veeam Backup & Replication User Guide.

For encryption, Veeam Backup Enterprise Manager uses an Enterprise Manager keyset — a pair of matching keys:

• Public Enterprise Manager key encrypts storage keys on backup servers connected to Veeam Backup
Enterprise Manager.

• Private Enterprise Manager key decrypts storage keys in case a password for encrypted backup or tape is
lost.

To let Veeam Backup & Replication encrypt and decrypt data with Enterprise Manager keys, make sure
Enterprise Manager keys are enabled in Veeam Backup Enterprise Manager.

To enable Enterprise Manager keys, do the following:

1. In Veeam Backup Enterprise Manager, open the Settings section of the Configuration view.

2. On the Key Management tab, select the E nable encryption password loss protection check box.

3. To save the changes, click Sa ve.

During Veeam Backup Enterprise Manager installation, the setup automatically generates an Enterprise Manager
keyset. You can perform the following operations with Enterprise Manager keysets using Enterprise Manager:

• Generate a new Enterprise Manager keyset

• Activate an Enterprise Manager keyset

• Specify retention settings for an Enterprise Manager keyset

• Export and import an Enterprise Manager keyset

• Delete an Enterprise Manager keyset

260 | V eeam Backup Enterprise Manager | User Guide

Generating Enterprise Manager Keyset
For safety’s sake, periodically generate a new pair of Enterprise Manager keys. Regular change of encryption
keys raises the encryption security level.

Enterprise Manager keys are created in the inactive state. To make the keys active and use them for encryption
and decryption, you need to activate the keys.

To generate a new Enterprise Manager keyset:

1. In Veeam Backup Enterprise Manager, open the Settings section of the Configuration view.

2. On the Key Management tab, in the Ma naged keys section, click Generate.

3. In the Hint field, enter a description for the created keyset. The keyset description will help you to
distinguish the created keyset in the list. Click the Generate button when ready.

261 | V eeam Backup Enterprise Manager | User Guide

Activating Enterprise Manager Keyset
Active Enterprise Manager keys are the keys that are currently used in the encryption process. After you create a
new keyset, you need to activate it. As a result of activation, Veeam Backup Enterprise Manager performs the
following actions:

• Public Enterprise Manager key is propagated to all Veeam backup servers connected to Veeam Backup
Enterprise Manager.

• Private Enterprise Manager key remains on Veeam Backup Enterprise Manager and marke d as active.

You can activate a keyset manually. For that, do the following:

1. In Veeam Backup Enterprise Manager, open the Settings section of the Configuration view.

2. On the Key Management tab, in the Ma naged keys section, select an inactive keyset in the list and click
Activate.

Note that manual activation can be performed for any keyset in the list (generated manually or automatically).

If you want your automatically generated keysets to be activated automatically upon creation, then you should
configure the retention policy settings. For more information, see Specifying Retention Settings for Enterprise
Manager Keyset.

NOTE

Consider that manually generated keysets will require manual activation.

262 | V eeam Backup Enterprise Manager | User Guide

Specifying Retention Settings for
Enterprise Manager Keyset
In some cases, government regulations and internal company policies require that you regularly change
encryption keys. The shorter is the lifetime of an encryption key, the smaller amount of data is encrypted with
this key and the higher is the level of encryption security.

Lifetime of Enterprise Manager keys is controlled by a key retention period. The key retention period defines for
how long Enterprise Manager keys must remain in effect and must be used for encryption and decryption.

You can specify a retention period for an Enterprise Manager keyset.

To specify retention policy for Enterprise Manager keys:

1. In Veeam Backup Enterprise Manager, open the Settings section of the Configuration view.

2. On the Key Management tab, in the Ma naged keys section, select the necessary options:

o If you want to set a retention period for Enterprise Manager keysets, select the Key retention period
check box and specify the number of weeks for which Enterprise Manager keys must remain in effect
(default is 4 weeks). After the retention period is over, and with key auto-generation is turned off, a
user will receive a notification email and should then manually create and activate a new keyset. After
a new keyset is ready, old keyset is marked as inactive.

o If you want Veeam Backup Enterprise Manager to automatically generate a new keyset, select the
Auto-generate new keys check box. After the current keyset expires, Veeam Backup Enterprise
Manager will automatically generate a new keyset and mark it as active. During the next data
synchronization session, Veeam Backup Enterprise Manager will propagate the newly created public
Enterprise Manager key to all connected Veeam backup servers. The private Enterprise Manager key
will remain on Veeam Backup Enterprise Manager and will be used for data decryption.

3. Click Sa ve to save the settings.

263 | V eeam Backup Enterprise Manager | User Guide

Exporting and Importing Enterprise
Manager Keyset
It is important to regularly back up your Enterprise Manager keys or save their copies in a safe place. If you lose
a password for an encrypted backup or tape, you can unlock this backup or tape with the private Enterprise
Manager key and the Enterprise Keys Restore wizard.

However, in some situations, a matching private Enterprise Manager key may be not available. This can happen,
for example, if your Veeam Backup Enterprise Manager database has failed or you use a new installation of
Veeam Backup Enterprise Manager and a new database. In this case, Veeam Backup Enterprise Manager will not
find a matching private Enterprise Manager key in the database and will be unable to unlock the backup or tape
encrypted with the public Enterprise Manager key.

You can create a backup copy of an Enterprise Manager keyset with the export operation in Veeam Backup
Enterprise Manager. The exported keyset is saved as a file of the PEM format and contains private and public
Enterprise Manager keys. You can save the exported keyset on the local disk or on a network share. An exported
keyset can be imported back to Veeam Backup Enterprise Manager any time you need.

To export a keyset:

1. In Veeam Backup Enterprise Manager, open the Settings section of the Configuration view.

2. On the Key Management tab, in the Ma naged keys section, select a keyset you want to back up and click
E x port.

3. Save the resulting PEM file on the local disk or in a network shared folder.

To import a previously exported keyset:

1. In Veeam Backup Enterprise Manager, open the Settings section of the Configuration view.

2. On the Key Management tab, in the Ma naged keys section, click Imp ort.

3. Click Browse next to the File field and select a previously exported keyset.

4. In the Hint field, Veeam Backup Enterprise Manager displays a hint that you provided when creating the
imported keyset.

5. Click Imp ort.

When you import a keyset, it is saved to the Veeam Backup Enterprise Manager database and displayed in the
keyset list in Veeam Backup Enterprise Manager.

264 | V eeam Backup Enterprise Manager | User Guide

 NOTE

An imported keyset has the Inactive state. You must activate it to be able to use the keys from the keyset
for backup encryption (for restore procedures, activation is not necessary). For more information, see
Activating Enterprise Manager Keyset.

265 | V eeam Backup Enterprise Manager | User Guide

Deleting Enterprise Manager Keyset
You can delete an Enterprise Manager keyset in case it is no longer needed.

Only keys in the Ina ctive state can be deleted. You cannot delete keys that are currently active.

To delete a keyset:

1. In Veeam Backup Enterprise Manager, open the Settings section of the Configuration view.

2. On the Key Management tab, in the Ma naged keys section, select the necessary keyset in the list and click
Delete Key.

IMP ORTANT

It is strongly recommended that you export a keyset before you delete it. If you delete a keyset and do not
make its backup copy, you will not be able to restore data from a backup or tape encrypted with keys from
this keyset in case a password is lost. For more information, see Exporting and Importing Enterprise
Manager Keyset.

266 | V eeam Backup Enterprise Manager | User Guide

Handling Password Recovery Requests
When an encrypted backup file or tape media is imported to the Veeam backup server, a password is required to
decrypt data. In some cases, however, a password can be lost or forgotten. Veeam Backup & Replication offers a
way to restore data from encrypted backups or tapes even if a password is not available. For that, Veeam
Backup Enterprise Manager administrator runs the P a ssword Recovery wizard within the following context:

1. As a Veeam Backup Enterprise Manager Administrator, you receive a request for password restore, for
example, by email.

2. Then you start the P a ssword Recovery wizard by clicking the P a ssword Recovery button in Configuration >
Key Management, and insert the text of the request to the wizard.

3. Veeam Backup Enterprise Manager finds a matching public backup server key in Veeam Backup Enterprise
Manager database and decrypts the signature with this key.

4. The wizard decrypts storage keys with the private Enterprise Manager key available on Veeam Backup
Enterprise Manager, and generates a response. The response represents a text document and contains
decrypted storage keys. Consider that the response is also encrypted and can be used only on the Veeam
backup server where the request was issued.

5. Then you can send the response back to requester, for example, by email. The requester will input this
response to the Enterprise Keys Restore wizard on the Veeam backup server where the request was
issued; Veeam Backup & Replication will process the response, retrieve the decrypted storage keys and
use them to unlock encrypted backups or tapes and retrieve their content.

267 | V eeam Backup Enterprise Manager | User Guide

 IMP ORTANT

In case your organization encrypts configuration backups of a Veeam backup server, and you want to be
able to serve password restore request for these backups, ensure the original Veeam backup server and its
public key (used for configuration backup encryption) are present on the Enterprise Manager server by the
moment you receive such a request. Consider the following:

• If a Veeam backup server is removed from Enterprise Manager, its public key will be deleted from the
Enterprise Manager database.
• If a new configuration database is created on Veeam backup server, then a new public key will be
automatically generated for that Veeam backup server on Enterprise Manager, replacing its existing
key.

For details on Enterprise Manager keysets, encryption passwords and password res tore, see the Data Encryption
section of the Veeam Backup & Replication User Guide.

268 | V eeam Backup Enterprise Manager | User Guide

Working with Virtual Lab Requests
The Requests tab allows you to create, approve and reject virtual lab requests, as well as prolong the time of
virtual lab running which are part of the U-AIR process. The procedures are described in the following sections:

• Creating Virtual Lab Requests

• Approving Virtual Lab Requests

For more information, see Veeam Universal Application Item-Level Restore User Guide.

269 | V eeam Backup Enterprise Manager | User Guide

Creating Virtual Lab Requests
Users with the Portal Administrator role can create Virtual Lab requests directly from the Enterprise Manager
web UI. For more information on roles, see Configuring Accounts and Roles.

Requests that are created in Enterprise Manager are approved automatically.

You can create a Virtual Lab request for VMs from the following sources:

• VM backups

• VM replicas

• Storage snapshots

To create a Virtual Lab request:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. Go to the Requests tab.

3. To open the New Lab Request wizard, click the Create link in the top left corner.

4. At the La b Request step of the wizard, specify a name or IP address of the VM you need and other request
settings.

By default, lab usage duration is 30 minutes. If necessary, change this value. Optionally, specify a
description for your request.

270 | V eeam Backup Enterprise Manager | User Guide

 5. At the Ba ckup step of the wizard, you can select the backup or replica to restore the VM from (if the VM is
included in more than one job).

6. At the Restore P oint step, select the restore point when the application was in the desired state. By
default, Enterprise Manager will display restore points closest to the latest backup.

If you want to display all restore points that are available for the selected backup, select the Show all
a vailable restore points check box.

271 | V eeam Backup Enterprise Manager | User Guide

 7. At the SureBackup Job step, select one of existing SureBackup jobs that you want to run to create an
isolated sandbox in which the selected machine should be started. The application group and virtual lab
used by this SureBackup job will be displayed in the Selected Job details section.

By default, the list of jobs displays only those jobs that contain the selected machine. If you want to
display all SureBackup jobs that were created, select the Show a ll available SureBackup jobs check box.

8. At the Summary step, review the settings you have configured for the virtual lab and click Finish.
Veeam Backup & Replication will perform verification of the selected restore point.

272 | V eeam Backup Enterprise Manager | User Guide

Approving Virtual Lab Requests
When a user submits a request for a virtual lab through Universal Recovery Wizard or Virtual Lab Manager, the
request is passed to Enterprise Manager and displayed on the Requests tab. Administrators working with Veeam
Backup Enterprise Manager can approve submitted lab requests, reject them or prolong the time for which a
requested virtual lab should be up.

IMP ORTANT

To work with lab requests, the user must have the Portal Administrator role assigned in Veeam Backup
Enterprise Manager. For more information, see Configuring Accounts and Roles.

To approve a lab request, select it in the list and click Ap p rove. Then follow the E d it Lab Request wizard steps:

1. At the La b Request step of the wizard, you can review and, if necessary, edit the virtual lab request (for
example, change the time interval for which the lab should be up). To edit virtual lab request data, click
the E d it request link at the bottom.

2. At the Ba ckup step of the wizard, select a backup from which you want to restore items. Enterprise
Manager scans all Veeam backup servers connected to it, searches for all backups with the machine
specified at the previous step of the wizard, and displays these backups in the list.

3. At the Restore P oint step of the wizard, select the restore point when the application was in the desired
state. The list of restore points is formed depending on the choice the user made when submitting the
virtual lab request. For example, if the user selected the La st Friday night backup option when creating
the request, Enterprise Manager will display restore p oints created on the last Friday night, and a number
of restore points closest to the matching point. If you want to display all restore points that are available
for the selected backup, select the Show all available restore points check box.

4. At the SureBackup Job step of the wizard, select one of existing SureBackup jobs that you want to run to
create an isolated sandbox in which the selected machine should be started. The application group and
virtual lab used by this SureBackup job will be displayed in the Selected Job details section.

By default, the list of jobs displays only those jobs that contain the selected machine. If you want to
display all SureBackup jobs that were created, select the Show a ll available SureBackup jobs check box.

5. At the Summary step of the wizard, review the settings you have configured for the virtual lab and click
Finish. Veeam Backup & Replication will perform verification of the selected restore point.

If the specified SureBackup job is already running, Veeam Backup Enterprise Manager will check the restore
point to which machines from the application groups are started. If the point does not correspond to the point
selected, Enterprise Manager will display a warning. In this case, you may need to start the SureBackup job to an
earlier point in time to make sure the items you need are available there. To do this, open Veeam Backup &
Replication console, and right-click the necessary SureBackup job and select Sta rt job to from the shortcut
menu.

If the SureBackup job is not running, Enterprise Manager will launch the selected SureBackup job, start the
virtual lab and run the machine with the necessary application to the restore point selected.

273 | V eeam Backup Enterprise Manager | User Guide

Working with VMware vCloud Director
Veeam Backup Enterprise Manager allows you to perform the following operations with VMware vCloud
Director (vCD) objects:

• Back up VMs, vApps and other containers

• Restore VMs and vApps

• Restore VM guest OS files

• Replicate vApps and other containers and fail over to their replicas

vCD service providers can allow self-service restore operations to their customers in the web UI based on Veeam
Backup Enterprise Manager.

• Service provider administrators have administrative rights in Veeam Backup Enterprise Manager. Thus,
they have access to the Configuration view of Enterprise Manager where they can configure vCD
organization configurations, including repository quota and backup job template. These administrators
typically have access to Veeam Backup & Replication console that controls vCD as part of backup
infrastructure on the provider side.

• Members of vCD organizations do not need administrative rights for Veeam Backup Enterprise Manager —
instead, they get access to Veeam Self-Service Backup Portal. There they can manage their vCD jobs, as
well as restore VMs, files and application items within their scope.

How It Works
Veeam Backup Enterprise Manager uses native vCD authentication to authorize users that log in to Enterprise
Manager. The authentication process and components interactions are shown in the figure below.

This approach helps to streamline administration and management tasks for service providers, as now they need
to configure a tenant account only once in vCD, and then any change like a new password or a disable operation
will be immediately reflected in Veeam Backup Enterprise Manager.

274 | V eeam Backup Enterprise Manager | User Guide

What Service Provider Administrators Can Do
Service provider administrators can perform the following operations:

• Configure settings for their tenants (vCD organizations), including backup job templates to be used,
backup destination and repository quota.

• Restrict job scheduling for particular tenants, for example, prevent the jobs from running too often.
Administrators can even completely prohibit the tenant's ability to schedule jobs, instead setting the
required schedule themselves (manually or using a script).

Together with Veeam built-in load balancing, these capabilities allow administrators to ensure infrastructure is
protected from excessive resource consumption.

For more information, see Managing Configurations for vCD Organizations.

What Members of vCD Organizations Can Do

Members of vCD organizations can use their vCD credentials to access Veeam Self-Service Backup Portal. Once
they log in, Enterprise Manager identifies the resources included in their scope — the entities the user is allowed
to see and manage — and automatically filters vCD objects when displaying them.

Members of vCD organizations can perform the following operations:

• Create new backup jobs for objects in their scope, based on the predefined templates. Organization
members are allowed to configure essential job settings (such as VMs to backup, retention, schedule,
notifications, and guest OS processing options).

• Modify or delete jobs.

• Enable or disable jobs.

• Start, stop, retry jobs.

• View statistics on vCD backups.

• Restore vCD VMs to the original vApps and vApps to the original vDC.

• Perform application item restore for SQL Server and Oracle databases.

• Restore files from indexed and non-indexed VMs guest file system.

To simplify job management for tenants, advanced job parameters (like backup mode and repository settings)
are automatically populated from the job templates. These templates are assigned by the service provider
administrator to the particular organization.

275 | V eeam Backup Enterprise Manager | User Guide

Managing Configurations for vCD
Organizations
In Veeam Backup Enterprise Manager, users with the Portal Administrator role can manage configurations for
vCloud Director (vCD) organizations. Each configuration defines a backup repository that can be used by the
organization, repository quota and backup job settings. To specify multiple repositories per organization, add a
separate configuration for each repository.

Before you manage vCD organization configurations, check prerequisites.

You can perform the following operations with vCD organizations:

• View the list of organization configurations

• Add a new configuration for a vCD organization

• Edit a vCD organization configuration

• Remove a vCD organization configuration

• Export a configuration report

276 | V eeam Backup Enterprise Manager | User Guide

Before You Begin
You can add configurations for vCD organizations created on multiple vCD servers that are added to the Veeam
Backup Enterprise Manager infrastructure.

Before you manage vCD organization configurations, check the following prerequisites:

1. The version of vCD servers must be 9.5 or later.

For more information on system requirements, see System Requirements.

2. All vCD servers must be added to the backup infrastructure of the same backup server.

For more information, see the Adding VMware vCloud Director section of the Veeam Backup & Replication
User Guide.

NOTE

Multiple vCD servers are supported starting from Veeam Backup Enterprise Manager 11a (build
11.0.1.1261 or later).

3. The backup server that contains the vCD servers in its infrastructure must be connected to Enterprise
Manager. Make sure that the version of Veeam Backup & Replication installed on the backup server
matches the version of Enterprise Manager.
For more information, see Managing Backup Servers.

4. Enterprise Manager must complete data collection from the added backup server.

For more information, see Collecting Data from Backup Servers.

5. The account that you will use to manage vCD organization configurations must be assigned the Portal
Administrator role.

For more information, see Configuring Accounts and Roles.

Managing Multiple vCD Servers

Starting from Veeam Backup Enterprise Manager 11a (build 11.0.1.1261), you can add vCD organization
configurations for multiple vCD servers. In this case, vCD organization members that work with Veeam Self-
Service Backup Portal by the portal URL must specify the host of their vCD server when accessing the portal.
They can also open the portal from the native vCD environment. For more information, see Accessing Veeam
Self-Service Backup Portal.

Members of vCD organizations can access Veeam Self-Service Backup Portal by the following portal URLs:

• Full URL that contains the host address where the necessary vCD server resides:

https://<EnterpriseManagerServer>:9443/vcloud/<vCDServer>/<OrgName>

In this case, Veeam Self-Service Backup Portal will open right after clicking the Sig n in button.

277 | V eeam Backup Enterprise Manager | User Guide

 • Shorter URL that does not contain the host address where the necessary vCD server resides:

https://<EnterpriseManagerServer>:9443/vcloud/<OrgName>

In this case, after clicking the Sig n in button, Veeam Self-Service Backup Portal will prompt to select a vCD
host from the list of available vCD hosts.

If you do not want vCD organization members to see addresses of all vCD hosts added to the Enterprise
Manager infrastructure, add each vCD server to a separate Enterprise Manager infrastructure.

278 | V eeam Backup Enterprise Manager | User Guide

Viewing Organization Configurations
In Veeam Backup Enterprise Manager, users with the Portal Administrator role can view the list of configurations
for vCD organizations.

To view the list of organization configurations:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. Click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

4. In the Self-service section, select the vCloud tab.

Veeam Backup Enterprise Manager offers a default configuration that you can use for vCD organizations. The
configuration is applied to each vCD organization that does not have a specific configuration added for it.

The default configuration contains the following parameters:

• Org anization — Other vCloud organizations

• Rep ository — Disable self-service backup for other organizations

Initially the default configuration is not active. To enable it, select a repository for the configuration.

• Quota — 1 TB

• Job scheduling — Allow: Tenant has full access to all job scheduling

• Job priority — Normal

For more information on configuration parameters, see Adding Organization Configuration.

279 | V eeam Backup Enterprise Manager | User Guide

Adding Organization Configuration
Users with the Portal Administrator role can add a new configuration for a vCD organization. Each configuration
defines a backup repository that can be used by the organization, repository quota and backup job settings. You
can specify multiple repositories per organization. To do this, add a separate configuration for each repository.

Before you add a new configuration, check prerequisites.

To add a new organization configuration:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. Click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

4. In the Self-service section, select the vCloud tab.

5. To add a new configuration, click Ad d .

6. From the vCloud Director server drop-down list, select a vCD server you need.

The field is available if you have multiple vCD servers in the Enterprise Manager infrastructure and if you
have Veeam Backup Enterprise Manager 11a (build 11.0.1.1261) installed.

7. From the Organization drop-down list, select an organization you need. The list contains organizations
from the selected vCD server processed by the backup server that is added to Enterprise Manager.

8. From the Rep ository drop-down list, select a repository that will be used for backups. The list includes
repositories configured on the backup server that has the vCD server added to its infrastructure.

IMP ORTANT

You cannot assign cloud-based repositories, as well as NetApp or Nimble storage systems storing
snapshots created by snapshot-only jobs.

9. In the Friendly name field, specify a repository name that will be displayed to organization members.

280 | V eeam Backup Enterprise Manager | User Guide

 10. In the Quota section, specify a repository storage quota. You can choose GB or TB from the drop -down list
and enter the required quantity.

11. From the Job scheduling drop-down list, select one of the following options:

a. Allow: Tenant has full access to all job scheduling options

b. Allow: Tenant can create daily and monthly jobs only

c. Deny: Creates daily jobs with randomized start time within the b ackup window

For backup jobs of vCD organizations, the backup window settings are specified in Veeam Backup
Enterprise Manager. Backup window settings specified for the job template that you will select from
the advanced job settings do not affect organization jobs. For information on how to specify the
backup window in Veeam Backup Enterprise Manager, see Customizing Chart Appearance.

d. Deny: Creates job with no schedule assigned

For more information on job scheduling, see Edit Job Schedule.

12. To specify what backup job will be used as a job template for the vCD organization:

a. Click the Show Advanced Job Settings link.

b. From the Cop y from drop-down list, select backup job settings:

▪ Default job settings — default vCD backup job settings as they are shown in the Veeam backup
console

▪ <Job Name> — specific vCD backup job configured in Veeam backup console

281 | V eeam Backup Enterprise Manager | User Guide

 c. Click Ap p ly.

IMP ORTANT

The backup repository that is selected from the Rep ository drop-down list for the organization takes
priority over the repository used by the selected job template.

13. If you do not use the Show Advanced Job Settings link, the default job settings will be applied to the
template.

NOTE

To populate the list of job templates, you need at least one vCD backup job to be configured on the
backup server.

14. To save the configuration, click Sa ve.

282 | V eeam Backup Enterprise Manager | User Guide

Editing Organization Configuration
Users with the Portal Administrator role can edit vCloud Director (vCD) organization configurations.

Before you edit a configuration, consider the following recommendations:

• When you change a job template for a vCD organization, the new configuration will be applied only to t he
new jobs, existing jobs will not be affected.

• To make an existing backup job to store backups to another repository instead of the currently configured
for the organization:

a. Move already created backups of vCD objects to the new repository.

b. Modify the backup job that is used as a template, and vCD organization configuration so that the job
points to the new repository.

Otherwise, data will be stored to the old repository, exceeding the quota.

To edit an organization configuration:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. Click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

4. In the Self-service section, select the vCloud tab.

5. On the vCloud tab, select an organization configuration and click E d it.

6. To edit organization settings, follow the same steps as for adding a configuration.

For more information, see Adding Organization Configuration.

283 | V eeam Backup Enterprise Manager | User Guide

Removing Organization Configuration
Users with the Portal Administrator role can remove vCloud Director (vCD) organization configurations. The
removed configuration is still effective for the jobs created with this configuration. New vCD backup jobs
created after this removal will use the default configuration until you add a new configuration for the
organization.

To remove an organization configuration.

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. Click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

4. In the Self-service section, select the vCloud tab.

5. On the vCloud tab, select a configuration and click Remove.

Disabling Default Configuration

The default configuration cannot be removed from the list — instead, you can disable it.

To disable the default configuration:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. Click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

4. In the Self-service section, select the vCloud tab.

5. On the vCloud tab, select the default organization configuration and click E d it.

6. From the Rep ository drop-down list, select Disable self-service backup for other organizations .

284 | V eeam Backup Enterprise Manager | User Guide

Exporting Configuration Report
Users with the Portal Administrator role can export a report with a list of configurations that were created for
vCD organizations. The list does not include the default configuration. When you export the report, it is saved as
an XLSX file.

To export a configuration report:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. Click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

4. In the Self-service section, select the vCloud tab.

5. On the vCloud tab, click E x p ort.

285 | V eeam Backup Enterprise Manager | User Guide

Veeam Self-Service Backup Portal
Veeam Self-Service Backup Portal is a web-based portal that provides members of vCloud Director (vCD)
organizations with self-service operations for vCD VMs protection, including VM and file restore. These
operations do not require to create specific user accounts or assign specific roles to them at the Veeam Backup
Enterprise Manager level. The organization members access Veeam Self-Service Backup Portal with their native
vCD credentials.

286 | V eeam Backup Enterprise Manager | User Guide

Required Permissions
Members of vCD organization can use Veeam Self-Service Backup Portal to backup and restore resources of their
vCD organization. To authenticate users, Veeam Self-Service Backup Portal uses LDAP and local user
authentication. SAML authentication is also supported if you access Veeam Self -Service Backup Portal from the
vCD UI using Veeam Plug-in for VMware vCloud Director. For more information, see Accessing Veeam Self-
Service Backup Portal.

The following organization members have access to Veeam Self-Service Backup Portal:

• vCD organization administrators.

• vCD organization members with the following rights granted in VMware vCloud Director:

o General: Administrator Control

o General: Administrator View

o Group / User: View

• Any vCD organization members whose roles (or associated LDAP user roles) are defined in registry keys
and with the Group / User: View right granted in VMware vCloud Director. For more information, contact
Veeam Customer Support.

NOTE

vCD system administrators cannot access Veeam Self-Service Backup Portal since they are not vCD
organization members.

287 | V eeam Backup Enterprise Manager | User Guide

Accessing Veeam Self-Service Backup Portal
Members of vCloud Director (vCD) organizations can access Veeam Self-Service Backup Portal in the following
ways:

• Access by URL

• Access from vCD

For more information on access rights, see Required Permissions.

Accessing Veeam Self-Service Backup Portal by URL

To access Veeam Self-Service Backup Portal by URL:

1. Open your web browser and enter the following URL in the address bar:

https://<EnterpriseManagerServer>:9443/vcloud/<vCDServer>/<OrgName>

where:

o <EnterpriseManagerServer> is a host name or IP address of the host where the Enterprise

Manager server resides.

o <vCDServer> is a host name or IP address of the host where the vCD server resides.

This URL part is optional. If you do not specify a vCD host here, you may be asked to select the host
when you log in to the portal.

o <OrgName> is a name of the vCD organization.

For example:

https://vbr-em:9443/vcloud/172.17.53.16/TechCompanyOrg

2. From the drop-down list, select a display language.

For more information on display languages, see Managing Languages.

NOTE

You can select a display language for the portal if Veeam Backup Enterprise Manager 11a (build
11.0.1.1261 or later) is installed on the Enterprise Manager server.

3. In the Username and P a ssword fields, specify credentials of a vCD account with proper rights.

4. To save the entered credentials for future access, select the Remember me check box.

5. Click Sig n in.

6. From the list of hosts with vCD servers, select the one where your organization has been created.

The list of hosts is displayed if multiple vCD servers are added to the Enterprise Manager infrastructure.

288 | V eeam Backup Enterprise Manager | User Guide

Accessing Veeam Self-Service Backup Portal from vCD
In the vCD environment, Veeam Self-Service Backup Portal is displayed in English by default. Starting from
Veeam Backup Enterprise Manager 11a (build 11.0.1.1261), when you access the portal by its URL, you can select
a preferred language from the drop-down list on the login page. After you select the language here, you can
work with the portal in the selected language from the vCD environment. For more information, see Accessing
Veeam Self-Service Backup Portal by URL.

Before members of vCD organizations can access Veeam Self-Service Backup Portal from the vCD UI, the vCD
system administrator must upload and configure Veeam Plug -in for VMware vCloud Director. For more
information, see Uploading and Configuring Veeam Plug-in for VMware vCloud Director.

To access Veeam Self-Service Backup Portal from vCD:

1. Log in to vCloud Director Tenant Portal under a vCD account with proper rights.

2. From the More menu, select Da ta Protection with Veeam.

If you have a connection error when accessing Veeam Plug -in for VMware vCloud Director, add the Veeam
Backup Enterprise Manager certificate as trusted to your browser.

Uploading and Configuring Veeam Plug-in for VMware vCloud

Director
Veeam Plug-in for VMware vCloud Director lets members of vCloud Director (vCD) organizations access Veeam
Self-Service Backup Portal in the native vCD environment.

You can upload and configure Veeam Plug-in for VMware vCloud Director on vCloud Director Service Provider
Admin Portal using a vCD system administrator account. When you upload the plug -in, you specify the scope — a
set of vCD organizations that can use the plug-in.

If you need to modify the scope of vCD organizations after you configure the plug -in, update the plug-in
configuration. For more information, see Updating Plug-in Configuration

Before You Begin

Before you start uploading Veeam Plug-in for VMware vCloud Director, check the following prerequisites:

• Veeam Plug-in for VMware vCloud Director requires Veeam Backup & Replication 11 or later to be installed
on the backup server that has the vCD server in its infrastructure.

• Users of the plug-in must have access to the Veeam Backup Enterprise Manager and vCloud Director URLs.

• The Veeam Backup Enterprise Manager server should use a certificate issued by a Certificate Authority
instead of a default self-signed certificate. In case of a self-signed certificate, users of the plug-in have to
add the Enterprise Manager certificate as trusted to their browser before they access the plug -in.
Otherwise, they will get a connection error.

For more information on the Enterprise Manager certificate, see Updating Security Certificate.

Uploading and Configuring Plug-in

To upload and configure Veeam Plug-in for VMware vCloud Director:

1. Log in to vCloud Director Service Provider Admin Portal under a vCD system administrator account.

289 | V eeam Backup Enterprise Manager | User Guide

 2. Upload Veeam Plug-in for VMware vCloud Director to the portal. You can find the plug-in file in the ISO
installation image of Veeam Backup & Replication.

For more information, see the Upload a Plug-in section of VMware vCloud Director documentation.

3. From the More menu, select Da ta Protection with Veeam.

If the Da ta Protection with Veeam option is not available, log out from the vCloud Director Service
Provider Admin Portal and log in again.

4. In the P lug-in Configuration section, specify the URL to the Veeam Backup Enterprise Manager website
and click Sa ve.

NOTE

When you save the plug-in configuration, it is applied to all vCD organizations. For that, a separate
operation is performed for each organization. If you have operation limits that are set through the
vCloud Director API, the operations may fail with HTTP status 400.

In this case, use the vCloud Director API to set the QueuedOperationsPerOrg and
QueuedOperationsPerUser elements to zero until you save the plug-in configuration. For more
information, see the OperationLimitsSettingsType section of VMware vCloud Director API
documentation.

5. On the Enterprise Manager server in IIS Manager, recycle the VeeamBackup application pool.

For more information, see the Recycling Settings for an Application Pool <recycling> section of Microsoft
Docs.

Updating Plug-in Configuration

You can modify the scope of vCD organizations after you configure the plug -in. It may be useful, for example, if
you create a new vCD organization and you want members of this organization to use the plug -in. To include or
exclude vCD organizations, update the plug-in configuration.

To update the plug-in configuration:

1. Log in to vCloud Director Service Provider Admin Portal under a vCD system administrator account.

2. Modify the scope of vCD organizations.

For more information, see the Publish or Unpublish a Plug-in from an Organization section of VMware
vCloud Director documentation.

3. From the More menu, select Da ta Protection with Veeam.

4. In the P lug-in Configuration section, click Sa ve to apply the changes to all vCD organizations.

290 | V eeam Backup Enterprise Manager | User Guide

Working with Veeam Self-Service Backup Portal
In Veeam Self-Service Backup Portal, members of vCD organizations can perform the following operations:

• On the Dashboard tab — view statistics on vCD backups.

• On the Jobs tab — examine and export job sessions data, search for jobs, create new jobs and edit jobs.

• On the VMs tab — search by a VM name, restore VMs and vApps to their original location (preserving or
overwriting the production VM or vApp), and delete VM backups.

• On the Files tab — search for the files on the VM guest file system and restore the necessary files to the
original location or download to the local machine.

• On the Items tab — perform application item-level restore (currently, for Microsoft SQL Server and Oracle
databases).

Viewing Statistics on vCD Backups

The Da shboard tab contains statistics on vCD backup jobs created by members of the vCD organization,
including information on the VMs, job runs and backup repositories.

You can view the chart for one of the time ranges:

• Last 24 hours

• Last 7 days

To switch between the ranges, select a necessary tab in the top left corner.

Veeam Self-Service Backup Portal accessed by URL

291 | V eeam Backup Enterprise Manager | User Guide

Veeam Self-Service Backup Portal accessed from vCD using Veeam Plug -in for VMware vCloud Director

The P rotected widget contains the following information:

• vApps — the number of vApps for which restore points were successfully created during the specified
period

• VMs — the number of VMs for which restore points were successfully created during the specified period

• VMs size — total size of source VMs successfully processed

The Job s widget contains the following information:

• Jobs — the number of jobs created by currently logged in administrator

• Max duration — maximum job duration

• Average speed — average data transfer speed

The Ba ckup Storage / < Repository name> widgets display statistics about backup repositories available to the
organization. Each widget represents a single repository and contains the following information:

• Status — a status of the backup repository assigned to the organization:

o Green — more than 10% of storage space is free

o Yellow — less than 10% of storage space is free

o Red — no free space on backup storage

• Quota — storage quota

• Used — used storage size

The La st 24 hours / La st 7 days widget reports on the job session results for the selected period.

To visualize on-going jobs data, the Da shboard tab also comprises a chart showing date and time when jobs
were performed, and the network throughput rate during the job.

NOTE

The dashboard displays only vCD backup jobs of the current vCD organization.

292 | V eeam Backup Enterprise Manager | User Guide

The highlighted part of the chart represents the configured backup window if this option is specified in the chart
settings. For more information, see Customizing Chart Appearance.

Managing vCD Backup Jobs

On the Job s tab, members of the vCD organization can perform the following operations with vCD backup jobs:

• Create a new vCD backup job

• Start, stop or retry a job

• Disable or enable a job

• Edit a job

Creating vCD Backup Jobs

To create a new vCD backup job:

1. Log in to the portal under a vCD account with proper rights.

For more information on user rights, see Required Permissions.

2. On the Job s tab, click Create.

3. At the Job Settings step, specify a job name, repository, job description and retention policy.

For more information, see Edit Job Name and Retention Settings.

NOTE

You can select a repository only if more than one configuration is added for the organization. For
more information, see Adding Organization Configuration.

293 | V eeam Backup Enterprise Manager | User Guide

 4. At the Virtual Machines step, add VMs, vApps and vDCs of the organization, and define their processing
order.

For more information, see Edit List of Virtual Machines and Change VM Processing Order.

5. At the Guest Processing step, you can configure transactionally consistent backup, transaction log
handling settings, and enable guest file system indexing.

For more information, see Configure Guest Processing Settings.

294 | V eeam Backup Enterprise Manager | User Guide

 NOTE

vCD system administrators can access guest OS credentials available for their organizations. They can
also supply new credentials for guest OS processing.

6. At the Job Schedule step, you can specify job scheduling options.

For more information, see Edit Job Schedule.

295 | V eeam Backup Enterprise Manager | User Guide

 7. At the E ma il Notifications step, configure notifications as required.

For more information, see the Notification Settings section of the Veeam Backup & Replication User Guide.

8. To create a job, click Finish.

Remaining settings are obtained from the job configuration specified for the organization. For more
information, see Adding Organization Configuration.

The jobs you create are shown in Veeam Backup & Replication console under the Job s node and in Veeam
Backup Enterprise Manager on the Job s tab. The jobs have the <vCloud Director_org_name> prefix.

NOTE

Organization members cannot see the jobs with VMs from their vCD organization if the jobs are created
using Veeam Backup & Replication. To view these jobs, tenants can map their organization jobs using a
PowerShell command. For more information, see the Set-VBRvCloudOrganizationJobMapping section of
the Veeam Backup & Replication PowerShell Reference. Tenants can map jobs of their own organization
only.

Managing vCD Backup Jobs

You can perform management actions with vCD backup jobs as described in the procedures for ordinary jobs in
Veeam Backup Enterprise Manager:

• Starting, stopping and retrying jobs

• Enabling and disabling jobs

• Editing job settings

To delete a job, select it on the Job s tab and then on the toolbar click Job > Delete. After deletion, this job will
be removed and no longer appear in the web portal, Veeam Backup & Replication console and in Veeam Backup
Enterprise Manager.

296 | V eeam Backup Enterprise Manager | User Guide

Considerations and Limitations
• Job cloning is not available.

• The following limitations apply to scenario involving VM backup and subsequent restore using Veeam
Self-Service Backup Portal:

a. You create a backup job that will process a VM added explicitly (that is, not as a part of a vApp
container).

b. This job runs creating a number of restore points.

c. Then you restore this VM to the original location by using the portal.

After restore, the VM identifier changes in vCD hierarchy. Due to this reason, the backup job cannot
locate this VM any longer. So, you need to edit job settings, adding this VM anew. To ensure that job
configuration will store this VM with the new metadata (not the old one from vCD hierarchy cache),
you should first click Reload in the Ad d Objects window.

d. At the next job run, a new full backup will be created for this VM. However, if you try to perform file -
level restore with the portal from the restore points created initially for that VM (on step 2), the
restore operation will fail, as that VM identifier does not exist any longer.

Managing vCD VMs and vApps

On the VMs tab, members of the vCD organization can perform the following tasks:

• Browse VMs and vApps

• Restore VMs

• Restore vApps

• Restore VM disks

• Delete VMs and vApps from Backups

297 | V eeam Backup Enterprise Manager | User Guide

Restoring VMs
You can restore vCD VMs to the original (production) vApp.

To restore a VM:

1. On the VMs tab, select the necessary VM backup in the list of VMs. To quickly find the necessary VM, use
the search field at the top of the window.

2. Click Restore VM and select the option you need:

o Select Overwrite to restore the VM from the backup to the original vApp, replacing the production
VM.

In this case, the restored VM hard disks are assigned the storage policies of the original VM hard disks.

o Select Keep to keep both VMs in the original vApp. The VM from the backup will be located next to
the original production VM and will have the same name with the _restored suffix.

In this case, the restored VM hard disks are assigned the storage policy of the VM.

3. Select the restore point that will be used to restore the VM.

4. [Optional] Instead of restoring an entire machine from a backup file, you can instruct Enterprise Manager
to recover only those data blocks that are necessary to revert the machine to the selected restore point.
To do this, select the Quick rollback check box. Quick rollback significantly reduces the recovery time and
has little impact on the production environment.

For more information on quick rollback, see the Quick Rollback section of the Veeam Backup & Replication
User Guide.

5. [Optional] To start a machine immediately after recovery, select the P ower on machine after restoring
check box.

6. Click Finish.

7. Click Y es in the message window to confirm the operation.

298 | V eeam Backup Enterprise Manager | User Guide

To view the VM restore progress, on the Ma chines tab, click History.

IMP ORTANT

Restore of a standalone VM to the original location with the Keep option selected results in an
unpredictable behavior and possible failure of the restore job.

Restoring vApps
You can restore a vApp to the original vDC.

To restore a vApp:

1. On the VMs tab, select a vApp. To quickly find the necessary vApp, use the sea rch field at the top of the
window.

2. Click Restore vApp and select the option you need:

o Select Overwrite if you want to restore the vApp from the backup to the original vDC, replacing the
production vApp.

o Select Keep if you want to keep the original vApp in the original vDC. The vApp from the backup will
be located next to the original production vApp and will have the same name with the _restored
suffix. Names of VMs in the vApp will remain the same.

3. Select the restore point that will be used to restore the vApp.

4. [Optional] To start VMs in the restored vApp immediately after recovery, select P ower on VM after
restoring.

5. Click Finish.

6. Click Y es in the message window to confirm the operation.

To view the VM restore progress, on the Ma chines tab, click History.

299 | V eeam Backup Enterprise Manager | User Guide

 IMP ORTANT

Restore job of a vApp with a standalone VM will return an ordinary and not standalone VM.

Restoring Virtual Disks

You can restore individual virtual disks from backups of vCloud Director VMs.

To restore a virtual disk:

1. On the VMs tab, select a VM with disks you want to restore. To quickly find the necessary VM, use the
search field at the top of the window.

2. Click Virtual Disks.

3. Follow the steps of the Virtual Disk Restore wizard. For details, see Performing Virtual Disk Restore.

Deleting VMs and vApps from Backups

You can delete a VM from the vApp. If the selected VM is the last one in its vApp, the VM will be deleted from
the backup with its vApp. If this vApp is the last one in its backup, the whole backup will be deleted.

If you delete a VM that has GFS backups, they will not be deleted. You can delete them in Veeam Backup
Enterprise Manager. For more information, see Deleting Machine from Backups.

To delete a VM:

1. On the VMs tab, select a VM. To quickly find the necessary VM, use the search field at the top of the
window.

2. Click Delete.

3. Click Y es to confirm the deletion.

When you remove data for deleted VMs from per-VM backup chains, it does not mark the space as available but
deletes backup files since they contain data for one VM only.

When you remove data for deleted VMs from regular backup chains, the space is not freed up on the backup
repository. It is marked as available to be overwritten, and this space is overwritten during subsequent job
sessions or the backup file compact operation.

Restoring Guest OS Files

On the Files tab, members of the vCD organization can browse the guest OS file system in a VM backup, search
for guest OS files and restore necessary files. You can restore files from indexed and non-indexed guest OS file
systems.

To restore guest OS files, follow the steps described in Performing 1-Click File Restore.

NOTE
• When you restore from non-indexed guest OS file system, mount operation is performed using
mount server associated with the backup repository that stores the backup file.
• Before you restore files from a non-Windows VM, make sure that an FLR helper appliance is
configured on the backup server. For more information, see Preparing for File Search and Restore
(non-Windows machines).

300 | V eeam Backup Enterprise Manager | User Guide

Restoring Application Items
On the Items tab, members of the vCD organization can perform item-level recovery of SQL Server databases
and Oracle databases from application-aware backups.

To restore application items, open the Items tab and follow the steps described in the Restore Procedure for
SQL Server databases and Restore Procedure for Oracle databases.

Information on these restore operations will be available in the Delegated Restore Permissions Overview report
from the Veeam Backup Overview report pack available in Veeam ONE.

301 | V eeam Backup Enterprise Manager | User Guide

Controlling Backup Infrastructure with
vSphere Web Client Plug-in
The vSphere Web Client plug-in for Veeam Backup & Replication facilitates vSphere administrators’ daily routine
of managing backup infrastructure in the organization. This plug -in allows authorized personnel to view detailed
information on the status of Veeam Backup & Replication infrastructure and create restore points ad -hoc, using
no other tool but vSphere Web Client.

In particular, vSphere administrators can view success, warning, failure counts for all jobs, as well as cumulative
information on used and available storage space, and statistics on processed VMs. They can easily identify
unprotected VMs and perform capacity planning, as well as create restore points for selected VMs using
VeeamZIP and Quick Backup functions, all directly from vSphere Web Client.

302 | V eeam Backup Enterprise Manager | User Guide

Getting Started
The vSphere Web Client plug-in is installed from the vCenter Servers section of the Configuration view in
Enterprise Manager. To access the Configuration view, log in to Enterprise Manager using an account with the
Portal Administrator role.

Before installing the vSphere Web Client plug-in, make sure the following requirements are met:

• The plug-in supports vSphere Web Client v5.1.0 build 880146 and later. For vSphere Web Client versions
5.1.0 build 880146 – 6.5 (including), the plug-in is available with the flex/flash interface. Starting with
vSphere Web Client version 6.7, the plug-in offers HTML 5 user interface. The older versions of the client
do not support the HTML 5 interface.

• Single Sign-On Service must be running on a server with FQDN (to be accessible from Enterprise Manager
server over HTTPS).

• Account used to install the plug-in must have sufficient access rights for vCenter server (must belong to
the same domain in case of cross-domain access):

o E x tension > Register extension — to install the plug-in

o E x tension > Unregister extension — to uninstall the plug-in

For more information on vSphere Web Client, see this VMware article.

Installing vSphere Web Client Plug-in

To install Veeam plug-in for vSphere Web Client, do the following:

1. In the Enterprise Manager Configuration view, go to the vCenter Servers section.

2. Select the vCenter server you need, and click Check version.

3. In the W eb Client Plug-in window, enter a user name and password to connect to vCenter Server, and
specify connection port (default is 443). Veeam Backup Enterprise Manag er will use these credentials to
access vCenter Server and check if Veeam plug-in has been already installed there. If discovered, plug -in
version will be displayed in the P lug-in Version column.

4. If the connection to vCenter Server is successful, and the plug-in has not been installed yet, then the
Install link will become active. Click it to install the plug-in.

303 | V eeam Backup Enterprise Manager | User Guide

 5. After installation, the plug-in will be displayed in the list of vCenter Servers and plug -ins.

Removing vSphere Web Client Plug-in

To remove Veeam plug-in for vSphere Web Client, do the following:

1. In the Enterprise Manager Configuration view, go to the vCenter Servers section.

2. Select the vCenter server you need, and click Remove.

3. In the displayed window, click Y es to confirm the removal.

Accessing Plug-in from vSphere Web Client

To access the plug-in from VMware vSphere Web Client, launch the vSphere Web Client and select Veeam
Ba ckup & Replication from the menu.

304 | V eeam Backup Enterprise Manager | User Guide

 IMP ORTANT
• To successfully obtain statistics from Veeam Backup Enterprise Manager, the accounts used to
connect to Enterprise Manager (that is, the account currently logged in to the web client, or specific
account configured in the Veeam plug-in settings) should have the Portal Administrator or Portal
User role. For more information, see Configuring Accounts and Roles.
• To open Veeam ONE reports (optional capability), these accounts should be also included in the
Veeam ONE Users or Veeam ONE Administrators group on the machine where Veeam ONE Server
component is installed.

305 | V eeam Backup Enterprise Manager | User Guide

Configuring Plug-in Settings
When using the plug-in, consider that authentication process includes the following stages:

1. A user logs in to vSphere Web Client. To work with a VMware vCenter server where Veeam plug -in runs,
this user account requires the following minimal privileges on vCenter level:
VirtualMachine.Interact.Backup , Task.Create, Task.Update.

2. Veeam plug-in connects to Veeam Backup Enterprise Manager which verifies its account. You can
configure Veeam plug-in to use the account currently logged in, or to use specific account for that
connection. For details, see the procedure description below.

Whatever account is used, to perform the necessary backup operation (VeeamZIP or Quick Backup) it
should have sufficient security permissions. They are granted by assigning a security role — Portal
Administrator or Portal User. For more information, see Configuring Accounts and Roles.

To configure a connection to the Veeam Backup Enterprise Manager server and (optionally) Veeam ONE server:

1. Open Veeam plug-in for vSphere Web Client.

2. On the Settings tab, check the plug-in version and specify the following Veeam Backup Enterprise
Manager connection properties:

o Host name or IP address of the Veeam Backup Enterprise Manager server

o Base URL of Veeam Backup Enterprise Manager REST API

o Thumbprint of the certificate used to connect to Veeam Backup Enterprise Manager REST API

TIP

You can get the connection properties on the Veeam Backup Enterprise Manager website. To do this,
log in to the website with a Portal Administrator account and go to Configuration > Ab out. For more
information, see Viewing Information About Enterprise Manager.

3. If you plan to connect to Enterprise Manager using a specific account, select the P a ssword based
a uthentication option and provide a user name and password. If this option is not selected, connection to
Enterprise Manager will be performed using the account currently logged in.

Make sure the account intended for connection has an appropriate Enterprise Manager role assigned.

306 | V eeam Backup Enterprise Manager | User Guide

 4. If you have Veeam ONE deployed in your environment, you can specify Veeam ONE server name and
connection port. Default is HTTP port 1239.

5. To test the connection, click Test.

6. To apply the specified settings, click Sa ve.

307 | V eeam Backup Enterprise Manager | User Guide

Examining Backup Infrastructure
All components of the Veeam Backup & Replication infrastructure — backup servers, proxy servers, and
repository servers — are listed on top of the Summary page, as well as the count of running and scheduled jobs.

Next to the list, there are three key indicators that inform you how the VMs were protected during the specified
period:

• Successful VM backups

• VMs with Warnings

• Failed VMs

In the dashboard pane under the summary information, you can explore backup infrastructure in more details.

• The VMs overview widget gives you the information on how your VMs are protected: number of protected
VMs (backed up or replicated), number of restore points available, source VM size, full and incremental
backup size, replica restore point size, and successful backup sessions ratio. To maximize the widget, click
the Full screen icon in the widget’s top right corner; to change reporting period, click the gear icon and
select the time period you need:

o Last 24 hours

o Last 7 days

o Last 14 days

Additionally, if Veeam ONE is installed, you can click the link and examine the P rotected VMs report that
provides a list of VMs which are protected by Veeam Backup & Replication, and which are not.

• In the Job s statistics widget, all running jobs are displayed, as well as scheduled jobs and max job
duration. Additionally, if Veeam ONE is installed, you can click the link and examine the La test BU Job
Sta tistics report.

308 | V eeam Backup Enterprise Manager | User Guide

 • In the Rep ositories widget, detailed information for each backup repository is displa yed, including
repository name, overall capacity, free space and backup size. Additionally, if Veeam ONE is installed, you
can click the link and examine the Ca pacity P lanning for Repositories report. It gives you an estimation of
when the repositories may run out of space.

• The P rocessed VMs widget shows a graphical representation of how the jobs ran (1-week, 2-weeks, 1-
month filters can be applied).

309 | V eeam Backup Enterprise Manager | User Guide

Creating Restore Points with VeeamZIP
and Quick Backup
vSphere administrators can quickly create a restore point for a selected VM using VeeamZIP (full backup) or
Quick Backup (incremental backup) right from VMware vSphere web client, with no need to use Veeam backup
management console. To utilize these capabilities, a user account should be able to go through authentication
process, so it must meet the requirements specified in Configuring Plug-in Settings.

Configuring VeeamZIP Settings

To configure the settings for VeeamZIP (VBK file creation), do the following:

1. In vSphere Web Client, open vCenter Inventory.

2. In the inventory tree, select a VM.

3. Click the Configure tab and select VeeamZIP.

4. In the Destination section, select the Veeam backup server to process the VM and the repository where to
store the VeeamZIP file.

NOTE

To be visible in this list, Veeam backup server should be added to Veeam Backup Enterprise Manager.
Connected repositories from Veeam backup infrastructure will be shown automatically.

5. In the Key section, specify the encryption key, if necessary.

6. In the Delete this backup automatically section, specify whether the resulting backup file should be
automatically deleted after a certain time interval.

7. In the Compression level section, select the necessary compression level for the backup.

8. By default, the Disable guest quiescence option is selected, meaning that guest OS quiescence is
deactivated. So, if you want a crash-consistent backup, leave it that way.

If you want, however, an application-consistent backup, then clear the Disable guest quiescence check
box, and Veeam will create a transactionally consistent image of VMs using VMware Tools quiescence for
guest OS.

NOTE

For more information about guest OS quiescence, see the Transaction Consistency section of the Veeam
Backup & Replication User Guide.

310 | V eeam Backup Enterprise Manager | User Guide

 9. Click Sa ve. The specified settings will be stored as default settings for the currently logged on user
account and will be used for VeeamZIP backup.

Creating Full VM Backup with VeeamZIP

You can use Veeam plug-in for vSphere Web Client to create an ad-hoc VeeamZIP backup of a VM. To create a
full VM backup with VeeamZIP:

1. In vSphere Web Client, open vCenter Inventory.

311 | V eeam Backup Enterprise Manager | User Guide

 2. In the inventory tree, right-click the VM that you want to back up and select one of the following options:

o Select Ba ckup > VeeamZIP if you want to create a backup using the default VeeamZIP settings
specified earlier. Alternatively, use the Actions > Ba ckup > VeeamZIP option.

Veeam will start the VeeamZIP backup process using the default VeeamZIP settings.

o Select Ba ckup > VeeamZIP to if you want to create a backup with new VeeamZIP settings.
Alternatively, use the Actions > Ba ckup > VeeamZIP to option.

If you select this option, Veeam plug-in will display the VeeamZIP to window offering to specify
VeeamZIP settings. Specify settings in the same way as described in the Configuring VeeamZIP
Settings section and click VeeamZIP. Veeam will save the specified settings as default settings for
VeeamZIP backup and start the VeeamZIP backup process.

You can view the backup creation progress in the Recent Tasks pane of vSphere Web Client.

312 | V eeam Backup Enterprise Manager | User Guide

Creating Incremental VM Backup with Quick Backup
You can also create an incremental backup for selected VM with a single click, using Quick Backup capability.
Quick Backup can be run for any VM that meets the following requirements:

1. A backup job processing the VM exists on the Veeam backup server which is added to Veeam Backup
Enterprise Manager.

2. There is a full backup file for this VM in the backup repository.

To perform quick backup:

1. In the vCenter Inventory, select the necessary VM.

2. Right-click the VM and select Quick Backup. Alternatively, you can use the Actions menu command.

This will trigger a backup job processing the selected VM to create a new incremental restore point (VIB file) for
the latest full backup found in the repository for this VM. Details of a running quick backup task can be seen in
the Recent Tasks pane on the right.

To learn more about VeeamZIP and Quick Backup, refer to the Veeam Backup & Replication User Guide.

NOTE

A Quick Backup or VeeamZIP job fails to start if the Location property of the VM and backup repository do
not match — for example, if you try to use a repository with location set to Sydney to back up a VM with
location set to Helsinki. To read more about location settings, refer to the Veeam Backup & Replication
User Guide.

313 | V eeam Backup Enterprise Manager | User Guide

vSphere Self-Service Backup Portal
Veeam Backup & Replication allows backup administrators to delegate VM backup and restore operations to
VMware vSphere users. For that, Veeam Backup & Replication offers the vSphere Self-Service Backup Portal — a
web tool based on Veeam Backup Enterprise Manager. With vSphere Self -Service Backup Portal, users can
create and manage backup jobs that process vSphere VMs and restore data from backups created with these
jobs. All operations are performed from the web UI without the need to deploy the Veeam Backup & Replication
console on the user machine.

To define what VMs vSphere users can back up and restore, Veeam Backup Enterprise Manager offers the
concept of delegation mode. The delegation mode specifies conditions that must be met to allow a user to add a
VM to the backup job. The administrator can choose from 3 delegation modes based on vSphere tags, vSphere
roles or VM privileges. For more information, see Configuring Delegation Mode.

In terms of vSphere Self-Service Backup Portal, a vSphere user that works with the portal is considered a tenant.
To access the portal, a tenant uses the tenant account created by the Enterprise Manager administrator. The
administrator can create tenant accounts for a separate vSphere user and a group of users. The tenant account
settings define storage quota available to the tenant on the backup repository and settings for backup jobs
created by the tenant. For more information, see Managing Tenant Accounts.

To simplify backup job management for tenants, advanced job settings (such as backup settings and storage
settings) and schedule settings are automatically populated from job templates. The administrator can assign a
separate template to each tenant account.

When working with vSphere Self-Service Backup Portal, administrators and tenants perform the following tasks:

• Administrator tasks

• Tenant tasks

Administrator Tasks
To let tenants work with vSphere Self-Service Backup Portal, the Veeam Backup Enterprise Manager
administrator performs the following tasks:

1. Configures the delegation mode

The default delegation mode allows tenants to access VMs with the VirtualMachine.Interact.Backup
privilege. The administrator can change the delegation mode, if necessary.

2. Creates and manages tenant accounts

By default, Veeam Backup Enterprise Manager offers a group tenant account for use rs of the domain that
includes the Enterprise Manager server. Each user can access the portal and use a 30 GB quota on the
default backup repository to create VM backups. Users can create backup jobs with default advanced
settings and custom schedule. The administrator can edit settings of the default account and create other
accounts to configure granular access to storage quotas and backup settings.

NOTE

Administrators perform tasks with vSphere Self-Service Backup Portal using the Self-service section in the
Configuration view of the Enterprise Manager UI. If a vCloud Director server is added to your Veeam
backup infrastructure, the working area of the Self-service tab will display two inner tabs: vSphere and
vCloud. To work with vSphere Self-Service Backup Portal, make sure the vSp here tab is opened. The
vCloud tab is used to work with VMware vCloud Director organizations and their configurations. For more
information, see Working with VMware vCloud Director.

314 | V eeam Backup Enterprise Manager | User Guide

Tenant Tasks
Tenants access the vSphere Self-Service Backup portal using the portal URL obtained from the Veeam Backup
Enterprise Manager administrator. Tenants can log in to the portal under a domain user account or single sign-
on account. For more information, see Accessing Portal.

Tenants can use the portal to work with vSphere VMs that are available to them according to the selected
delegation mode. VM backup settings are defined by the properties of the tenant account.

Tenants can use vSphere Self-Service Backup Portal to perform the following operations:

• Create and manage backup jobs that process vSphere VMs.

• View VM backup statistics.

• Restore vSphere VMs to the original location.

• Restore files from indexed and non-indexed guest OS file systems of vSphere VMs.

• Perform item-level restore for Microsoft SQL Server and Oracle databases.

For more information, see Using vSphere Self-Service Backup Portal.

315 | V eeam Backup Enterprise Manager | User Guide

Configuring Delegation Mode
To define what VMs tenants of vSphere Self-Service Backup Portal can back up and restore, the Enterprise
Manager administrator can configure the delegation mode. The delegation mode specifies conditions that must
be met to allow a tenant to add a VM to the backup job.

NOTE

If you have configured a single sign-on service to access vSphere Self-Service Backup Portal, you must use
the delegation mode based on vSphere tags only. For more information on single sign-on, see SAML
Authentication Support.

To configure a delegation mode:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

The Self-service section is available if you have added to Enterprise Manager at least one Veeam backup
server with a vCenter server as part of its infrastructure.

4. If a vCloud Director server is added to your Veeam backup infrastructure, make sure that the vSp here tab
is selected.

5. In the Delegation Mode window, select a delegation mode:

o vSp here tags — to allow tenants to work with VMs to which the specified tags are assigned. If you
select this option, you must specify the necessary tags in the properties of the tenant account. You
can specify tags for each tenant account individually. For more information, see Adding Tenant
Account and Editing Tenant Account.

o vSp here role — to allow tenants to work with VMs that are available to the specified vSphere role.

To specify a vSphere role:

i. Next to the vSp here role option, click Select Role.

Alternatively, if you have already selected a role before, click the name of the currently selected
role.

ii. In the Select Role window, select the required vSphere role.

iii. Click OK.

o VM p rivilege — to allow tenants to work with VMs for which they have the specified vSphere privilege.

To select a vSphere privilege:

i. In the VM p rivilege field, click the name of the currently selected privilege. By default, the
VirtualMachine.Interact.Backup privilege is selected.

ii. In the Select Privilege window, select the required privilege.

iii. Click OK.

6. Click OK.

316 | V eeam Backup Enterprise Manager | User Guide

 NOTE

If you change the delegation mode when tenants already work with vSphere Self-Service Backup Portal,
tenants can lose access to VMs that were available to them according to the original delegation mode.
Make sure that the necessary tags, roles or privileges are configured in VMware vSphere.

317 | V eeam Backup Enterprise Manager | User Guide

Managing Tenant Accounts
Veeam Backup Enterprise Manager offers the following types of vSphere Self -Service Backup Portal tenant
accounts: User, Group, External User and External Group.

Ty p e Description How to Sign In Na me Format

User AD user By specifying a user name and DOMAIN\Username

password
Domain is optional

Group AD group By specifying a user name and DOMAIN\Groupname

password
Domain is optional

E x ternal User IdP user By using single sign-on* Username@Suffix

E x ternal Group IdP group By using single sign-on* Free-form string

* For more information on the single sign-on capability, see SAML Authentication Support.

NOTE

You cannot create a vSphere Self-Service Backup Portal tenant account for a local user account.

Veeam Backup Enterprise Manager administrators can perform the following tasks with the tenant accounts:

• Add a new tenant account

• Edit an already created tenant account

• Export a report on the created tenant accounts

• Remove a tenant account

318 | V eeam Backup Enterprise Manager | User Guide

Adding Tenant Account
Veeam Backup Enterprise Manager offers the default Domain Users account for vSphere Self -Service Backup
Portal tenants. It is a group account that includes all users from the Enterprise Manager server domain. To
configure granular access to storage quotas and backup settings, the Enterprise Manager administrator can add
new tenant accounts.

NOTE

If you plan to provide a user with access to vSphere Self-Service Backup Portal only, and not to the main
Enterprise Manager UI, you do not need to configure an account for this user in the Roles tab of the
Configuration view.

To add a tenant account for vSphere Self-Service Backup Portal:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

The Self-service section is available if you have added to Enterprise Manager at least one Veeam backup
server with a vCenter server as part of its infrastructure.

4. If a vCloud Director server is added to your Veeam backup infrastructure, make sure that the vSp here tab
is selected.

5. Click Ad d .

6. From the Ty p e drop-down list, select a type of the account: User, Group , External User or External Group .
For more information, see Managing Tenant Accounts.

7. In the Account field, specify an account name in the DOMAIN\Username or Username@Suffix format
depending on the account type. For more information, see Managing Tenant Accounts.

319 | V eeam Backup Enterprise Manager | User Guide

 NOTE

You cannot create a vSphere Self-Service Backup Portal tenant account for a local user account.

8. From the Rep ository drop-down list, select a target repository that will contain VM backups created by
the tenant. The list includes repositories configured on Veeam backup servers added to Veeam Backup
Enterprise Manager.

Backup repository settings specified at this step will take priority over backup repository settings
prescribed by the selected job template.

NOTE

You cannot assign to tenants Veeam Cloud Connect repositories, as well as NetApp or Nimble
storage systems storing snapshots created by Veeam snapshot-only jobs.

9. In the Quota field, specify the repository storage quota for the tenant account. Choose GB or TB from the
drop-down list and enter the required quota size.

10. From the Job scheduling drop-down list, select how the job scheduling will be organized. The following
options are available:

o Allow: Tenant has full access to all job scheduling options

o Allow: Tenant can create daily and monthly jobs only

o Deny: Creates daily jobs with randomized start time within the backup window

For tenant backup jobs, the backup window is defined by backup window settings specified in Veeam
Backup Enterprise Manager. Backup window settings specified for the job template that you will
select at the step 12 do not affect tenant jobs. For information on how to specify the backup window
in Enterprise Manager, see Customizing Chart Appearance.

o Deny: Creates job with no schedule assigned

For more information on job scheduling, see Edit Job Schedule.

11. From the Job priority drop-down list, select a normal or high priority for backup jobs of the tenant.

12. If you have multiple vCenter Servers in your infrastructure and want to provide the tenant account with
access to VMs of specific vCenter Servers only, from the vCenter scope drop-down list, select the
necessary vCenter Servers. By default, the All vCenter Servers options is selected.

13. If you have selected the delegation mode that is based on vSphere tags, in the vSp here tags field, specify
tags assigned to VMs that will be available to the tenant.

For more information on delegation modes, see Configuring Delegation Mode.

320 | V eeam Backup Enterprise Manager | User Guide

 14. [Optional] If you add a tenant account of the Group or External Group type, select the Assign a separate
quota to each group member check box to provide each user of the group with individual quota on the
backup repository. Each user will be able to work with backup jobs and VM backups created by this user
only. Backups and jobs of other users will not be displayed.

15. [Optional] Specify advanced settings for backup jobs of the tenant:

a. Click the Show Advanced Job Settings link.

b. In the Ad vanced job settings section, view the currently used backup job settings.

c. From the Cop y from list, select the backup job settings that will be applied to tenant jobs. You can
select from the following options:

▪ Default settings — this option is selected by default. With this option selected, tenant backup
jobs will be configured with the default settings as they are shown in the Veeam backup
console. For more information, see the Creating Backup Jobs section of the
Veeam Backup & Replication User Guide.

▪ <Job name> — an existing backup job for vSphere VMs. With this option selected, the backup job
will be used as a template for tenant backup jobs. The job must be configured in advance on the
Veeam backup server added to Veeam Backup Enterprise Manager. When a tenant creates a
backup job on the vSphere Self-Service Backup Portal, Enterprise Manager will copy job settings
from the template and apply these settings to the job.

d. Click Ap p ly.

NOTE

To populate the list of job templates, you must have at least one vSphere backup job configured in
the Veeam backup console.

321 | V eeam Backup Enterprise Manager | User Guide

 16. Click Sa ve.

322 | V eeam Backup Enterprise Manager | User Guide

Editing Tenant Account
The Veeam Backup Enterprise Manager administrator can edit tenant accounts configured for vSphere Self -
Service Backup Portal. For example, the administrator changes backup scheduling settings or other settings for
tenant backup jobs.

To change settings of a tenant account:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

The Self-service section is available if you have added to Enterprise Manager at least one Veeam backup
server with a vCenter server as part of its infrastructure.

4. If a vCloud Director server is added to your Veeam backup infrastructure, make sure that the vSp here tab
is selected.

5. Select the account you need and click E d it.

6. In the E d it window, edit tenant account settings as required. For more information, see Adding Tenant
Account.

323 | V eeam Backup Enterprise Manager | User Guide

 7. Click Sa ve.

NOTE

Make sure to establish a proper connection between the Veeam backup server and Enterprise Manager
server. Otherwise, changes of the tenant account settings will not be saved to the Veeam configuration
database.

Consider the following recommendations for modifying tenant account settings for vSphere Self -Service Backup
Portal:

• If you plan to modify job template for a tenant account, remember that the new settings will be applied
only to the new jobs created by the tenant; the changes will not affect existing jobs.

• If you want an existing backup job to create backups in another backup repository instead of the
repository that is currently specified in the properties of the tenant account, do the following:

a. In Veeam Backup Enterprise Manager, specify the new backup repository in the properties of the
tenant account.

b. Move vSphere VM backups created by the tenant to the new repository.

324 | V eeam Backup Enterprise Manager | User Guide

 c. In Veeam Backup & Replication, specify the new backup repository in the properties of tenant backup
jobs.

Otherwise, tenant backup jobs will continue creating backups in the former repository.

325 | V eeam Backup Enterprise Manager | User Guide

Exporting List of Tenant Accounts
The Veeam Backup Enterprise Manager administrator can generate a report on tenant accounts configured for
vSphere Self-Service Backup Portal. This report includes information on the account name, backup repository
used by the account, storage quota allocated to the account, and space used by the account.

To generate a report:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

The Self-service section is available if you have added to Enterprise Manager at least one Veeam backup
server with a vCenter server as part of its infrastructure.

4. If a vCloud Director server is added to your Veeam backup infrastructure, make sure that the vSp here tab
is selected.

5. Click the E x port link in the top right corner.

The report is saved to the excelreport.xls file.

326 | V eeam Backup Enterprise Manager | User Guide

Removing Tenant Account
The Veeam Backup Enterprise Manager administrator can remove tenant accounts configured for vSphere Self -
Service Backup Portal.

To remove a tenant account:

1. Log in to Veeam Backup Enterprise Manager using an administrative account.

2. To open the Configuration view, click Configuration in the top right corner.

3. In the Configuration view, select the Self-service section.

The Self-service section is available if you have added to Enterprise Manager at least one Veeam backup
server with a vCenter server as part of its infrastructure.

4. If a vCloud Director server is added to your Veeam backup infrastructure, make sure that the vSp here tab
is selected.

5. Select the account you want to remove.

6. Click Remove.

7. In the Remove configuration window, select necessary options:

o To delete backup jobs created by the tenant, select the Delete jobs check box.

o To delete all backups created by the tenant, select the Delete backup files check box.

8. To confirm the removal, click Y es.

327 | V eeam Backup Enterprise Manager | User Guide

Using vSphere Self-Service Backup Portal
vSphere Self-Service Backup Portal is a tool for VMware vSphere users that facilitates operations with delegated
VM protection, including VM restore and files restore. These operations do not require access to the
Veeam Backup & Replication console. For backup and restore operations, tenants access vSphere Self -Service
Backup Portal.

Accessing Portal
To access vSphere Self-Service Backup Portal:

1. Open your web browser and enter the following address in the address bar:

https://<EnterpriseManagerServer>:9443/backup

For example:

https://vbr-em:9443/backup

2. From the drop-down list, select a language that you want to use as the display language.

For more information, see Managing Languages.

3. Log in using your credentials:

o To log in with Enterprise Manager credentials:

i. In the Username and P a ssword fields, specify credentials of the domain user for which the
Enterprise Manager administrator created a vSphere Self-Service Backup Portal tenant account.
The username must be provided in the DOMAIN\Username format.

ii. To save the entered credentials for future access, select the Rema in signed in option.

iii. Click Sig n in.

o To log in with single sign-on, click Use Single Sign-On ( SSO). You will be redirected to the login
webpage of the single sign-on service. Complete the sign-in procedure on the login page. If the
account is already authenticated in the single sign-on service, you will immediately access the
Enterprise Manager website.

NOTE

The Use Single Sign-On (SSO) option is available if SAML authentication is configured for Veeam
Backup Enterprise Manager. For more information, see Configuring SAML Authentication
Settings.

328 | V eeam Backup Enterprise Manager | User Guide

Working with Portal
You can use vSphere Self-Service Backup Portal to perform the following operations:

• View statistics on backups of vSphere VMs. For more information, see Viewing Self-Service Backup Portal
Statistics.

• Work with backup jobs that process vSphere VMs: create and edit backup jobs; examine and export backup
job session data; start, stop and retry backup jobs. For more information, see Managing Backup Jobs.

• Perform backup and restore operations with vSphere VMs. For more information, see Managing VMs.

• Search for files in guest file systems of backed-up VMs and restore the necessary files to the original
location or download them to a local machine. For more information, see Restoring Guest OS Files.

• Perform item-level restore of Microsoft SQL Server and Oracle databases. For more information, see
Restoring Application Items.

329 | V eeam Backup Enterprise Manager | User Guide

Viewing Self-Service Backup Portal Statistics
The Da shboard tab contains statistics on tenant backup infrastructure, including information about protected
VMs, backup jobs, backup storage and the number of jobs that completed successfully, finished with warnings
and errors. You can view statistics for the last 24 hours or last 7 days. To switch between the views, click La st 24
hours or La st 7 days in the top left corner of the working area.

The P rotected block displays the following information:

• VMs — number of VMs successfully processed during the selected period. At least one restore point was
created for these VMs.

• Temp lates — number of virtual machine templates successfully protected during the specified period.

• Tota l size — total size of successfully protected VMs and templates.

The Job s block displays the following information:

• Job s — number of jobs created by the currently logged-in user.

• Ma x duration — maximum job duration.

• Average speed — average data transfer speed.

The Ba ckup Storage block displays the following information:

• Sta tus — status of the backup storage assigned to the user: Green — more than 10% of storage space is
free; Yellow — less than 10% of storage space is free; Red — no free space on backup storage.

• Quota — storage quota assigned to the user.

• Used — storage quota used by the user.

The La st 24 hours / La st 7 days block reports on job session results for the selected period.

To visualize on-going job data, the Da shboard tab also comprises a graph showing time and date when jobs were
performed, and the network throughput rate during the job.

330 | V eeam Backup Enterprise Manager | User Guide

The highlighted part of the graph represents the configured backup window if this option was specified in the
dashboard settings. For more information, see Customizing Chart Appearance.

331 | V eeam Backup Enterprise Manager | User Guide

Managing Backup Jobs
In the Job s tab of Self-Service Backup Portal, you can perform the following operations with backup jobs:

• Create a new backup job for vSphere VMs

• Start, stop and retry jobs

• Enable and disable jobs

• Edit backup job settings

• Delete backup jobs

Creating Backup Job

To create a new vSphere backup job:

1. Open the Job s tab of vSphere Self-Service Backup Portal and click Create.

2. At the Job Settings step of the wizard, specify the backup job name, description and retention policy
settings. The retention policy defines how many restore points are kept in the backup repository and can
be used for data restore.

For more information, see the Retention Policy section of the Veeam Backup & Replication User Guide.

3. At the Virtual Machines step of the wizard, select which vSphere VMs the job will process. For more
information, see Edit the List of Virtual Machines.

4. At the Guest Processing step of the wizard, select the guest OS processing options and guest OS
credentials. For more information, see Configure Guest Processing Settings.

332 | V eeam Backup Enterprise Manager | User Guide

 5. At the Job Schedule step of the wizard, configure the backup job scheduling options. For more
information, see Schedule the Job.

You can configure backup job scheduling options only if the Enterprise Manager administrator allowed this
in the properties of the tenant account. For more information, see Adding Tenant Account.

6. At the E ma il Notifications step of the wizard, select the E na ble e-mail notifications check box and
configure notification settings:

a. In the Recipients field, enter email addresses of recipients separated by comma.

b. [Optional] In the Sub ject field, specify the subject for notification emails.

c. Select the Notify on success, Notify on error and/or Notify on warning options to receive email
notification if the job completes successfully, fails or completes with a warning.

d. Select the Sup press notifications until the last retry check box to receive a notification about the final
job status. If you do not enable this option, Veeam Backup & Replication will send one notification per
every job retry.

7. Click Finish.

The backup job will create backups in the backup repository that the Enterprise Manager administrator selected
as the target repository in the properties of the tenant account. Advanced job settings such as the backup
settings and storage settings will be obtained from the job template assigned to the tenant by the
administrator. For more information, see Editing Tenant Account.

Editing Backup Job

You can edit a backup at any time you need. For example, you may want to change scheduling settings for the
job or add VMs to the job.

To edit backup job settings, do the following:

1. Open the Job s tab of vSphere Self-Service Backup Portal.

2. In the working area, select the job you want to edit and click E d it.

3. In the E d it window, edit backup job settings as required. You will follow the same steps as you have
followed when creating the job. For more information, see Creating Backup Job.

Removing Backup Job

You can permanently remove a backup job from the configuration database. To remove a job, do the following:

1. Open the Job s tab of vSphere Self-Service Backup Portal.

2. In the working area of the Job s tab, select the job you want to delete.

3. Click Delete.

Information about the deleted job will be removed from the Veeam Backup & Replication configuration
database (and the Enterprise Manager database as well), and the job will no longer appear in the UI. If you
agreed to delete backup files created with the job, they will be removed from backup repository.

IMP ORTANT

For vSphere Self-Service Backup Portal tenants, the job cloning operation is not available.

333 | V eeam Backup Enterprise Manager | User Guide

Managing VMs
You can use vSphere Self-Service Backup Portal to perform the following operations with backed -up VMs:

• Search VMs and view VMs details

• Restore VMs

• Restore VM disks

• Delete VMs

Restoring VMs
You can restore vSphere VMs to the original (production) location using flexible restore options. To restore a
VM, do the following:

1. On the VMs tab, select the necessary VM in the list of VMs. You can also use the search field to search for
the necessary VM by a VM name.

2. Click Restore and select the option you need:

o Select the Overwrite option if you want to replace the VM in the original location with the VM in the
backup. The current state of the VM will be deleted.

o Select the Keep option if you want to save the current state of the VM. The restored VM will be
located next to the original VM and will have the same name with the _restored suffix added to the
VM name.

3. In the Restore window, select the restore point that will be used to restore the VM.

4. You can select additional options for the VM restore:

o Select the Quick rollback check box if you want to restore only the changed data. This option is
available only for VMs that were protected with the Changed Block Tracking (CBT) option.

o Select the P ower on VM after restoring check box if you want to turn on the VM once it is restored.

334 | V eeam Backup Enterprise Manager | User Guide

 o Select the Restore VM tags check box if you want to restore vSphere tags of the VM.

5. Click Finish.

6. Veeam Backup Enterprise Manager will display a message notifying that the VM from the backup will
replace the original VM if this VM is present in the original location. Click P roceed to start the VM restore
operation.

You can view the VM restore progress. To do this, on the VMs tab, click History.

Restoring Virtual Disks

You can restore individual virtual disks from backups of vSphere VMs:

1. On the VMs tab, select the backup of the VM whose disks you want to restore. You can also use the search
field to search for the necessary VM by a VM name.

2. Click Virtual Disks.

335 | V eeam Backup Enterprise Manager | User Guide

 3. Follow the steps of the Virtual Disk Restore wizard. For details, see Performing Virtual Disk Restore.

Deleting VMs
You can delete a VM on vSp here Self-Service Backup Portal. This operation may be useful if you want to d elete
d a ta of the backed-up VM from the backup repository.

W hen you delete a VM, Veeam Backup Enterprise Manager removes records about the VM from the UI and
configuration database. In addition, Enterprise Manager removes data of the deleted VM from the backup .

To delete a VM, on the VMs tab, select the necessary VM and click Delete. Then press Y es in the Delete VM
window.

The deleted VM is not removed from the list of VMs immediately. The VM will be removed from the list after
records about the VM are removed from the configuration datab ase on the Veeam backup server.

336 | V eeam Backup Enterprise Manager | User Guide

Restoring Guest OS Files
The Files tab of vSphere Self-Service Backup Portal allows you to browse the guest OS file system in a VM
backup and restore individual files. You can restore files from indexed and non-indexed guest OS file systems.

To restore guest OS files, follow the steps described in Performing 1-Click File Restore.

NOTE
• When you restore from non-indexed guest OS file system, mount operation is performed using
mount server associated with the backup repository that stores the backup file.
• Before you restore files from a non-Windows VM, make sure that an FLR helper appliance is
configured on the backup server. For more information, see Preparing for File Search and Restore
(non-Windows machines).

337 | V eeam Backup Enterprise Manager | User Guide

Restoring Application Items
The Items tab of vSphere Self-Service Backup Portal allows you to perform item-level recovery from
application-aware backups of Microsoft SQL Server databases and Oracle databases.

To restore application items, follow the steps described in the following sections:

• To restore Microsoft SQL Server databases, see Restore Procedure for SQL Server.

• To restore Oracle databases, see Restore Procedure for Oracle.

338 | V eeam Backup Enterprise Manager | User Guide

Appendix A. License Update Session Data
The table below lists the messages that can appear in the automatic license update session log. Similar
messages are received as pop-ups after you force the immediate update. Recommendations for users (if
applicable) are provided in the Comment field.

Message Rea son Comment

“New license key has been This sequence of messages You can open the License Information dialog in
received” means automatic license key Veeam backup console or the Licensing
“New license key has been update procedure has section in Enterprise Manager to examine the
installed” completed successfully. details.
“License key has been auto-
updated”

“License key type is not License key generation failed Currently, automatic update is supported only
supported at the moment” due to currently for licenses associated with Hosting Rental
unsupported license type. contract type.

“License key is invalid” License signature (identifier) Contact your Veeam sales representative.
is invalid.

“Your existing license key is License expiration date is This message could probably been issued due
up to date” more than 7 days from now. to an accidental attempt to update the license
manually. Select to update the license key
automatically, and the system will notify you
on time.

“Your contract has expired, Your contract has expired Contact your Veeam sales representative for
so the license key cannot be and needs to be renewed. contract renewal.
updated automatically.
Please contact your Veeam
sales representative to
renew your contract.”

“General license key Web licensing server did not Wait for 24 hours (Veeam will re-try to update
generation error has return a new key upon the key). Retries will take place for 1 month
occurred” request due to some other after key expiration date.
reason.

339 | V eeam Backup Enterprise Manager | User Guide

Appendix B. Configuring AD FS for SAML
Authentication
Active Directory Federation Service (AD FS) is a hosted identity provider implemented as a feature in the
Windows Server OS. It provides single sign-on capabilities for Active Directory (AD) users. If AD FS is used as the
identity provider in the organization, to let AD users log in to the Veeam Backup Enterprise Manager website
and vSphere Self-Service Backup Portal using the single sign-on service, an IT administrator must register the
Veeam Backup Enterprise Manager website and vSphere Self-Service Backup Portal as service providers in AD
FS.

To add a service provider in AD FS:

1. Obtain the service provider metadata exported from Veeam Backup Enterprise Manager. For more
information, see Configuring SAML Authentication Settings.

2. In AD FS, add a Relying Party Trust using the service provider metadata.

3. Edit the Claim Issuance Policy for the added Relying Party Trust to add an issuance transform rule with the
following properties:

o Cla im rule template = Transform an Incoming Claim

o Incoming claim type = UPN

o Outg oing claim type = NameID

o Outg oing name ID format = Persistent Identifier

4. [Optional] To provide single sign-on capabilities to AD groups, add to the Claim Issuance Policy an
issuance transform rule with the following properties:

o Cla im rule template = Send Group Membership as a Claim

o User's group = <Name>

where <Name> is a name of the AD group that includes users that will access the service provider.

When a user that belongs to the specified group attempts to access the service provider, the identity
provider will issue an authentication assertion confirming that the user belongs to the group.

o Outg oing claim type = Group

Alternatively, if a different value is specified for the Group claim type option of advanced SAML
settings in Enterprise Manager, the same value must be specified as the outgoing claim type in AD FS.

o Outg oing claim value = <Name>

where <Name> is a name of the group that will be returned to the service provider in authentication
assertions.

This value can be different from the User's group value, for example, if you do not want the service
provider to display AD group names. This value must be the same as the name of the account of the
External Group type added in Enterprise Manager. For more information, see Configuring Accounts
and Roles and Adding Tenant Account.

For example, you want to provide single sign-on capabilities to users that belong to the Backup AD group.
In Enterprise Manager, you have the EnterpriseUsers account of the External Group type, and the default
group claim type is specified in advanced SAML settings.

340 | V eeam Backup Enterprise Manager | User Guide

 To allow these users to log in to Enterprise Manager with the single sign-on service, you must create an
issuance transform rule with the following properties:

o Cla im rule template = Send Group Membership as a Claim

o User's group = Backup

o Outg oing claim type = Group

o Outg oing claim value = EnterpriseUsers

341 | V eeam Backup Enterprise Manager | User Guide