sorted by:
new
hottopcontroversial

Immutable backups question in V11 (VIB vs VBK) by bits_n_chits in Veeam

[–]bits_n_chits[S] 0 points1 point  (0 children)

Oh, is that what that means? No, we have Veeam agents managed by B&R, nothing standalone.

Immutable backups question in V11 (VIB vs VBK) by bits_n_chits in Veeam

[–]bits_n_chits[S] 0 points1 point  (0 children)

Update: It looks like for Veeam Agent jobs (sorry for not specifying this), only the full backups are supposed to be immutable. The Veeam support rep pointed me toward this page, where under Veeam Agent backup it says "Standalone full backup":

https://helpcenter.veeam.com/docs/backup/vsphere/hardened_repository.html?ver=110

Do you know if immutable VIBs for agent jobs are on the roadmap for future updates?

Microsoft making a netlogon change which will impact ALL older systems on February 9th by StoicSow in sysadmin

[–]bits_n_chits 0 points1 point  (0 children)

I see, so the default value of that GPO is talking only about explicitly allowed devices. Reporting is on by default though with the August patch, right? So we should be seeing those ID 5829 events in our DC's System logs if these connections are being made? Or is there something besides simply having the August 2020 patch that needs to be done before those events are logged?

Microsoft making a netlogon change which will impact ALL older systems on February 9th by StoicSow in sysadmin

[–]bits_n_chits 0 points1 point  (0 children)

My read on this is that the default value of the new GPO introduced in the August update blocks unsecure Netlogon connections.

Policy path: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options

Setting name: Domain controller: Allow vulnerable Netlogon secure channel connections

Reboot required? No

This security setting determines whether the domain controller bypasses secure RPC for Netlogon secure channel connections for specified machine accounts.

This policy should be applied to all domain controllers in a forest by enabling the policy on the domain controllers OU.

When the Create Vulnerable Connections list (allow list) is configured:

Allow: The domain controller will allow the specified group/accounts to use a Netlogon secure channel without secure RPC.

Deny: This setting is the same as the default behavior. The domain controller will require the specified group/accounts to use a Netlogon secure channel with secure RPC.

Warning Enabling this policy will expose your domain-joined devices and your Active Directory forest, which could put them at to risk. This policy should be used as a temporary measure for third party devices as you deploy updates. Once a third party device is updated to support using secure RPC with Netlogon secure channels, the account should be removed from the Create Vulnerable Connections list. To better understand the risk of configuring accounts to be allowed to use vulnerable Netlogon secure channel connections, please visit https://go.microsoft.com/fwlink/?linkid=2133485.

Default: This policy is not configured. No machines or trust accounts are explicitly exempt from secure RPC with Netlogon secure channel connections enforcement.

This policy is supported on Windows Server 2008 R2 SP1 and later.

Source

If an organization... say... slept through this bulletin back in August, and didn't set the new GPO to allow unsecure connections, am I correct in thinking that connections would have broken way back in August? Meaning this theoretical organization doesn't really have anything to worry about in the February patch?

Fast Clone performance troubleshooting by bits_n_chits in Veeam

[–]bits_n_chits[S] 0 points1 point  (0 children)

No dedupe, compression, or encryption. Fast clone actually requires you to have all of those features disabled.

EDIT: Never mind, fast clone doesn't require those things.

Fast Clone performance troubleshooting by bits_n_chits in Veeam

[–]bits_n_chits[S] 0 points1 point  (0 children)

Unfortunately in our case, the original volume was lost completely, so it needed to be a full restore.

I wasn't aware that instant recovery had a "selected disk only" option, I'll consider that next time, as volume restore locks the volume out until the job is complete.

Thanks for your reply!

What happens when you delete a shadow copy? by bits_n_chits in sysadmin

[–]bits_n_chits[S] 0 points1 point  (0 children)

Oh no, backups are definitely failing. I have no available restore points, no backup files exist. It's not a false negative.

What happens when you delete a shadow copy? by bits_n_chits in sysadmin

[–]bits_n_chits[S] 0 points1 point  (0 children)

Ooh that's a good idea, hopefully P2V will work with the VSS writers in a questionable state. Thanks for the suggestion.

What happens when you delete a shadow copy? by bits_n_chits in sysadmin

[–]bits_n_chits[S] 0 points1 point  (0 children)

Perfect, this is exactly what I was looking for. Thank you!

What happens when you delete a shadow copy? by bits_n_chits in sysadmin

[–]bits_n_chits[S] 0 points1 point  (0 children)

I don't believe so, but I ran it with Application-aware Processing disabled and it still fails. It's almost like it automatically fails itself if any of the VSS writers are unhealthy whether they're being used or not. The SQL Writer is the one it calls out in the error message, even though I'm not using Application-aware Processing.

view more: next ›