Veeam Backup Setup and Managed Backup Services

What does a Veeam Backup & Replication setup cover?

Veeam Backup & Replication is made up of a backup server, proxies that move the data, and repositories where backups are written. During setup we decide where each of these three parts lives, which network they talk over and which accounts manage them. The mistake we see most often is a backup server joined to the domain and managed with the same admin account as everything else: an attacker who takes over the production network walks into the backups with the same key.

We split backup jobs by workload. Domain controllers, file servers, databases and application servers need different retention periods and different consistency settings. For applications such as SQL Server and Exchange, application-aware processing is enabled so that transaction logs are handled correctly.

What is the 3-2-1-1-0 backup rule?

3-2-1-1-0 means keeping at least three copies of your data, on two different types of media, with one copy offsite, one copy immutable or offline, and zero errors on restore. Veeam’s article on the 3-2-1 rule extends the classic 3-2-1 in exactly this way, adding the immutable copy and verified recovery.

Simple on paper, but in practice every number has to map to something real. The second medium is a separate disk enclosure or tape, the offsite copy is a branch or the cloud, the immutable copy is a hardened repository, and zero errors means regular SureBackup testing. Veeam’s backup copy jobs automate copying the primary backup, in the same format, to another location.

• 3: production data plus at least two backups
• 2: two different storage media
• 1: at least one copy at another site
• 1: at least one copy immutable or offline
• 0: tested restores with no errors

How do you set up a Veeam hardened repository for immutable backups?

Veeam’s hardened repository feature ensures that backup files written to a Linux-based repository cannot be moved, modified or deleted for a period you set. When the Linux server is added to the backup infrastructure, single-use credentials are used and are not stored on the Veeam server, so even if the Veeam server is compromised, an attacker cannot use them to connect to the repository.

We put the repository on its own physical server, disable SSH or lock it down tightly, and assign no roles beyond what Veeam requires. For security reasons, Veeam itself does not allow any role on this repository other than the VMware proxy role in network mode. The server’s out-of-band management card (iDRAC, iLO) gets a strong password and a separate network, because an attacker who cannot reach the repository may try to wipe the disks through the hardware management card instead. For the Linux side of the build, see our Ubuntu Server setup page.

The immutability period has to match your retention policy. Set it too short and it is useless against an attacker who waits quietly; set it too long and the disks fill up faster than expected. We work out the balance from your data change rate.

How do you test restores with SureBackup?

SureBackup is the Veeam job that automatically verifies that backups really do start. In full recoverability mode it boots VMs directly from backup in a virtual lab isolated from the production network and runs tests against the applications on them. Dependencies such as a domain controller start first, as an application group.

In small environments where a lab is not practical, you can use the SureBackup mode that runs only a backup integrity check and content scan, looking for traces of malware in the backup. Whichever mode is used, we arrange for the results to reach you by email every week and for a failed test to raise an alert in your monitoring system.

Take a 40-person architecture practice: one Hyper-V host, five VMs and a file server full of large CAD files. Each night the backup is written to a local hardened repository, a backup copy job sends it to a second site in the early hours, and every Sunday SureBackup boots the domain controller and file server in the lab and tests access to the share. The report that arrives on Monday morning is your proof that the backups work.

How should offsite and cloud backup copies be set up?

There are three typical options for the offsite copy: a second repository in another of your buildings, object storage that Veeam supports (S3-compatible or Azure Blob), or a service provider’s Veeam Cloud Connect infrastructure. The deciding factors are link capacity, which country the data is held in and how quickly you could pull the data back down when you need it. We open the cloud storage in your own account on your behalf; we do not run a hosting service of our own.

For a cloud copy, immutability through object lock and encryption should both be switched on, and the encryption password must be kept somewhere safe away from the Veeam server. Lose the password and you have effectively lost the backup.

Should Microsoft 365 data be backed up too?

Exchange Online, OneDrive, SharePoint and Teams data is held on Microsoft’s infrastructure with high availability, but that is not a backup against your own mistakes, such as deletions, bad syncs or a compromised account. For this, Veeam offers a separate product, Veeam Backup for Microsoft 365.

Where Microsoft 365 backups are written (an on-premises repository or object storage), how long they are kept and who is allowed to restore should be planned with the same discipline as server backups. We handle this together with your disaster recovery plan.

What do managed backup services include after the Veeam setup?

Managed backup services mean someone checks every day that the backups you rely on actually ran, and acts when they did not. After the setup we can take that on remotely: reviewing job results and warnings, following up failed or skipped jobs, and reading the weekly SureBackup report so a broken restore is caught long before you need it.

The checks go beyond green ticks. We watch repository capacity against the immutability period, confirm the offsite copy is keeping up, apply Veeam updates in planned windows, and run a manual restore test of a file, a VM and an application at agreed intervals. Each month you get a short report on what was protected, what failed and what was fixed.

Everything stays in your own infrastructure and accounts. We do not store your data on our servers or resell storage; the repositories, cloud storage and licences remain yours, so you can bring the work in-house at any point without moving a single backup.

What you receive

• Veeam Backup & Replication server, proxy and repository setup
• Backup jobs split by workload, with a retention policy
• Hardened Linux repository with immutability configured
• Backup copy job to a second site or the cloud, with encryption
• SureBackup tests and a weekly results report
• Restore procedure document and administrator training

How we work

1. 1

   Free review

   We look at your current backup arrangements, data size, change rate and recovery expectations.

2. 2

   Design

   We set the repository size, retention periods, immutability period and offsite copy target.

3. 3

   Build

   The Veeam server, hardened repository, backup jobs and backup copy jobs are configured.

4. 4

   Testing

   File-, VM- and application-level restores are tried out, and SureBackup jobs are put into service.

5. 5

   Handover and follow-up

   You receive the procedure document; report monitoring and periodic testing support can continue if you want.

Frequently asked questions