Veeam Backup and Replication: PowerShell must be Remote Signed

Veeam Backup & Replication includes a built-in PowerShell extension called the Veeam Backup PowerShell module. This module exposes a full set of cmdlets that allow administrators to automate, configure, and manage most tasks available in the Veeam Backup & Replication graphical user interface. In this guide, we shall discuss “Veeam Backup and Replication: PowerShell must be Remote Signed”. Please see Leverage Azure Blob Storage as an Object Storage Repo in Veeam, and PXE Boot Failure: “Access Denied or Aborted” with Secure Boot on [Part 4].

Note: By using PowerShell, administrators can perform advanced operations such as job creation, modification, reporting, and deletion with the same level of control as the UI. For some other operation such as changing the IP/DNS or FQDN of a managed server can be done via PowerShell only at the time of writing this article. Because of this tight integration, any action executed through PowerShell directly affects the Veeam configuration database in real time.

This also introduces operational responsibility: destructive commands behave exactly like their GUI equivalents. For example, when you remove a backup job using PowerShell, Veeam immediately deletes it from the configuration database. And you cannot undo the operation unless you have a backup of the configuration database.

To execute Veeam PowerShell commands, you must first start a PowerShell session and load the Veeam module. Once loaded, you can interact with Veeam Backup & Replication using cmdlets designed for automation and orchestration.

Veeam supports running the Veeam Backup PowerShell module both on the backup server (console) and on supported Linux-based management environments. This enables flexible automation across platforms.

Please see Prevent Automatic Driver Updates in Windows and Xen-Orchestra, how to remove a Repository from Veeam Backup and Replication, and Fix broken Repository Path in Veeam Scale-Out Backup Repository.

PowerShell Module Must be set to Remote Signed

In thie following article, we installed PowerShell 7 as discussed here “Switch from IP Addresses to DNS for Backup Infrastructure in VBR“. For some reasons I had this warning message (prompt), and since I have not had this in a while with VBR. I had to verify if PowerShell is indeed still installed.

Before proceeding to configure the various execution policies as discussed in these articles “how to set the PowerShell Execution Policy via Windows Registry, and how to determine the execution policy configured on Windows PC”.

In PowerShell, the execution policy controls whether PowerShell can run scripts and under what conditions. It is a safety feature designed to help prevent the accidental execution of malicious scripts.

With the RemoteSigned execution policy, PowerShell allows local scripts created on your computer to run without a digital signature. Also, PowerShell allows downloaded scripts only if they are digitally signed by a trusted publisher. But, unsigned scripts downloaded from the internet are blocked. This can be achived by running the comamnd below.

Set-ExecutionPolicy RemoteSigned

This distinction is very important to note as compared to other exection policies.This helps reduce the risk of running potentially unsafe scripts downloaded from external sources. As you can see below, we are prompted to change it. Even when you click on Yes, this will fail. Bceuae PowerShell 7 is not installed as it disapperead and I do not even need to bother to find out why this happened as I can easily re-install it.

Please see how to Check PowerShell Version and Verify WinRM Using Test-WSMan, and Running PowerShell remotely on Azure VMs.

Determin PowerShell Installed

Interestingly, I discovered PowerShell 7 was not installed but Windows PowerShell only was present as shown below. SInce PowerShell is not installed, the below errors as shown in the image is dispayed “‘pwsh’ is not recognized …”. You can use any of the commands below to determine is PowerShell 7 is installed.

pwsh -v

pswsh --version

Please see how to get a list of installed programs locally or remotely in Window, Advanced Tape Troubleshooting: Diagnosing Veeam LTO Drive Issues with ITDT, and Azure Resource Locks: Protecting Critical Cloud Resources from Accidental and Malicious Deletion.

Install PowerShell 7 on VBR Server

To run PowerShell 7, launch the command Prompt or PowerShell (as Admin) and run the below command to install PowerShell.

winget install --id Microsoft.PowerShell --source winget

Just to check if the executable is available, you can optionally run the command below as shown in the image above.

Get-Command pwsh

As you can see below, the installation is in progress.

Please see Fix Operating System Loader failed signature verification” on Dell Safe BIOS Systems via PXE [Part 3], and how to protect Microsoft 365 beyond native limits with VDC [Part 1].

Verify Installation

Now run the command once again to determine if the executable is available. As you can see, we have successfully installaed PowerShell 7 onto the VBR Server.

Now on the VBR server, we have both the Windows PowerShell and PowerShell 7 running.

Please see Update WinPE Boot Images with Windows UEFI CA Certificates [Part 2], and how to perform Tape Drive Cleaning in Practice.

Launch PowerShell Console via VBR

Note: MFA is not supported for PowerShell (either interactive logon or non-interactive connections). To use PowerShell cmdlets with Veeam Backup PowerShell Module or Microsoft Windows PowerShell, run the Veeam Backup & Replication console or Microsoft Windows PowerShell under the service account with disabled MFA. To learn more about running Veeam BAckup and Replication PowerShell Session, please see this link.

To launch Veeam PowerShell from the VBR Console. Open Veeam Backup & Replication from the top-left corner, click the Main Menu (hamburger icon). Then navigate to Console and then on PowerShell.

PowerShell launched correctly now without any exection plociy warnings.

To check the currently policy, you can run the cmdlet below.

Get-ExecutionPolicy

Install via Microsoft Store

Note that you can also install PowerShell via the Microsoft Store. All you have to do is launch Microsoft Store and search for: PowerShell. Then, select PowerShell (Microsoft), and click Install.

Alternatively, you can perform a mManual MSI install. To do this, navigate to the official release page. Download the latest: PowerShell-7.x.x-win-x64.msi, run the installer, and follow the wizard to install PowerShell 7 unto your server.

I hope you found this guide on Veeam Backup and Replication: PowerShell must be Remote Signed” very helpful. Please feel free to leave a comment below.