Setup Restore Environment in Azure

This is best setup well before a restore is needed so it is ready to be used.

1. Sign into Azure Portal with account you want to restore in to
2. Create a new resource group. Then create the following itmes inside that resource group
3. Create a Virtual Network
   1. Create network with same IP network details as source VM
4. Create a Network Security Group

Setup Veeam restore environment with Azure Credentials

This part can also be set up ahead of time if you have a VBR server. Otherwise this can be setup on CyberSecure’s infrastructure

1. Open Veeam Backup & Replication console
2. Go to Main Menu > Credentials and Passwords > Cloud Credentials
3. Add… > Microsoft Azure Compute Account
4. Select a Name and click Next
5. Select Microsoft Azure, Global and click Next
6. Select Create a new account and click Next
7. Go to https://microsoft.com/devicelogin and paste in the generated code
8. Sign in with Azure account you want to restore in to
9. Click Next > Finish

Restore the VM into Azure

This assumes the backups are already available from the Veeam Backup & Replication Console

1. Right click the agent you wish to restore and select Restore to Microsoft Azure…
2. Select the point in time
3. Details should be auto populated from previous step, click Next
   1. You might see a message about storage accounts. Just click Yes
4. Change VM name if required
5. Change VM details if required
6. Select and existing or create a new resource group
7. Assign network and security groups
8. Next, Next, Finish
9. Wait for restore to complete
10. Power on and control machine from Azure Portal and test

1. Log in to https://compliance.microsoft.com with Global Admin account
2. Go to Policies > Data > Retention
   
3. Under Retention Policies, either Edit an existing policy or select  New retention policy
4. Go through the edit/creation wizard until you get to this page
   
5. Click Edit under the Excluded heading for the item type you would like to add an exclusion for
6. Type in the full email address, site address etc and click Done
7. Continue through the wizard until complete

Please see video guide here

Problem

You see this error when a Veeam backup runs:

Error: Failed to enable DC SafeBoot mode
Cannot execute [SetIntegerElement] method of [\\[HOSTNAME]\root\wmi:BcdObject.Id="{UUID}",StoreFilePath=""].
COM error: Code: 0xd0000022

Common cause

Most commonly seen with Sentinel One anti malware, but could be caused by other anti malware products as well. The Veeam Agent is modifies the boot record prior performing backup to make sure that restore point is created in Directory Services Restore Mode. Sentinel One is blocking this process.

Solution

Check if the server has Sentinel One Agent installed. If it does, you can disable Safe Boot Protect by running the following command

sentinelctl config -k [passphrase] -p agent.safeBootProtection -v false