So only install software needed for Veeam and nothing else. The backup server must be a dedicated one with only 1 role!
No other roles (like WSUS, anti-virus management, file-server !!!, domain-controller !!!, …) are being performed by this server. The server where VBR is implemented should have only 1 role, the role of Veeam backup server! You can use then the management-interface (ILO, iDRAC, …) of the server (in case of a physical server) or the console (HyperV, vSphere, …) in case of a virtual machine.ģ – Do not use other roles on the backup server You can go even further : disable the RDP service. Only log on to the VBR server using RDP for upgrading Veeam or installing manually updates or firmware (in case of a physical backup server). Try to use a regular (no local admin permissions) local user on the VBR server connecting to it. From there you can connect to the VBR server using this console. Use instead the Veeam console installed on a management server. The VBR-server is then a member of this management domain and not the production domain.ĭo the same for other Veeam components (proxy-servers, repositories, …)Īvoid using RDP on the VBR server. If the VBR server is member of a workgroup this can be eliminated.įor larger environments, it is recommended to implement a separate management domain. Also if this domain-user is being logged on to his client and has admin-access to the VBR server, ransomware can also being activated on drives of the VBR server. Why? If ransomware is nested in a roaming profile of a domain-user connecting to the domain-joined VBR server, this malware can be activated on the VBR server and impact the backups. There are of course more things possible, but it’s a start.ġ – Do not domain-join the backup server in the production domainĪ best-practice is to put the VBR server in a workgroup and not AD domain-joined for smaller environments. I will give you here 10 tips you can implement.
The first thing that comes in mind, is to harden your Veeam Backup & Replication server as much as possible. Next to this rule, one of the first things to keep in mind is to protect as much as possible your backups because those can save you when you are being attachked and you need them.
It is always important to implement the golden 3-2-1-1-0 rule (in detail explained in a former post of me – 3-2-1-1-0 Golden Backup Rule – Orbid365). More en more companies are being a victim of malware, ransomware or even hackers.
0 kommentar(er)
