Veeam VSA Configuration Backup and Security Officer

Don’t forget to store the S.O. password and MFA.

My Veeam V13 VSA in my home lab wasn’t running configuration backups… and I recently figured out why.

While trying to get SSH access, I headed into the Host Management Interface (https://VSA_IP:10443) to enable it. That requires approval from the Security Officer user. I tried logging in as that account, but the password I had saved didn’t work 😪 — no big deal, except that when I checked my now-overcrowded Google Authenticator, the corresponding MFA entry was nowhere to be found. I can no longer log in even with the correct password.

My best guess: when I reinstalled the appliance, I forgot to perform the initial Security Officer login — see: Veeam Help Center — Security Officer

That’s when I discovered that, for the VSA only, configuration backup requires the Security Officer to set an additional passphrase for double encryption — see:

Veeam Help Center — Encrypted Configuration Backup

Once that’s in place, the passphrase can be changed and other S.O. tasks performed from here:

Veeam Help Center — Performing S.O. Tasks

This whole incident got me thinking: is there a time limit for completing the first Security Officer login after installation? Because apparently I never did it after the reinstall of my VSA — which had crashed, probably due to poor hardware. Which is exactly why config backups silently failed the whole time 😥

Lesson learned: pay close attention to this S.O. account. If you lose access to it, you’re in serious trouble — even reimporting a saved configuration after a fresh reinstall won’t work.

(There appear to be password recovery options, and if you’re under a support contract, opening a case is probably your best bet if you find yourself in this mess.)

P.S.: Since I couldn’t SSH in to check the logs directly, I generated a support bundle from the Host Management Interface (takes a while), extracted it on my PC, and fed it to Claude Code. Quick analysis, and it nailed the root cause.