Veeam Backup & Replication: The Complete Setup Guide that Actually Keeps You Safe
Why this guide exists
Most Veeam guides show you buttons. This one gives you safety. Follow it end to end and you will have a working Veeam deployment, immutability on a Linux hardened repo, WAN-efficient offsite copies, and a sane job design that restores fast on the bad day.
If you would rather have us set this up for you, with immutable, snapshot-replicated backups hosted in the UK, see Rismor Cloud Backup. You can still use Veeam locally. We handle the resilient offsite bit that attackers cannot erase.
What you will get by the end
• A clean Veeam v12 install on Windows
• A Linux Hardened (immutable) repository for local protection
• Proxies sized for speed instead of pain
• WAN Accelerators that reduce offsite bandwidth
• VMware, Hyper-V and Proxmox added correctly, with Proxmox limitations called out
• Backup Jobs vs Backup Copy Jobs designed the right way
• Clear answers to the questions people usually ask later
Prefer a done-for-you build with immutable offsite storage and monthly restore drills? See how our Cloud Backup works.
1) Choose your deployment model
All-in-one (quick start)
What: Backup Server, Console, Proxy and Repository on one box.
When: Labs and very small sites.
Upside: Fast to deploy.
Gotcha: Single point of failure. If the box goes down, so do backups and restores.
Distributed (production friendly)
What: Backup Server as control plane, plus separate Proxies, Repositories, and optional WAN Accelerators.
When: Anything you care about.
Upside: Scales, restores faster, isolates roles.
Tip: Run the Backup Server as a VM for HA, keep proxies close to hosts, and use Linux hardened for any repo you physically control.
2) Prerequisites that save rework
OS: Windows Server for Veeam. Keep it patched.
SQL: Let the installer use Express for labs. Use full SQL for production.
Resources: Start around 4 vCPU and 8–16 GB RAM for the Backup Server. Proxies scale by concurrent tasks, roughly one to two per core.
Ports: Allow Veeam ports between Backup Server, Proxies, Repositories, Hosts, and WAN Accelerators.
Accounts: Domain account with local admin on Windows targets. SSH user for Linux (single-use during deployment).
Question you would ask later: Can I put Veeam on vCenter or a Hyper-V host? Technically yes, but its better not to. Keep Veeam separate to avoid contention and simplify upgrades.
3) Install Veeam Backup & Replication v12
1) Mount the ISO, run Setup.exe, click Install.
2) Accept licence and provide your licence file.
3) Components: Choose Backup & Replication. Add Enterprise Manager only if you need the web UI.
4) Prerequisites: Let the wizard add .NET and VC++.
5) Database: SQL Express for small, full SQL for production.
6) Service account: LocalSystem is fine initially. A domain service account is cleaner in production.
7) Install, Finish, Launch Console.
Tip: After install, open the Console and confirm services are running. Back up the Veeam configuration database routinely.
4) Add a Linux Hardened (Immutable) Repository
Why it matters
It is your last line. If ransomware hits, immutability stops the wipe.
Prepare Linux
Use Ubuntu 20.04+ or RHEL 8+. Minimal install and updated. XFS is recommended for fast cloning. Create a mount like /mnt/backup.
Add Linux as a Managed Server
Veeam Console > Backup Infrastructure > Managed Servers > Add > Linux.
Enter host or IP and a non-root SSH user. Veeam uses single-use credentials to deploy its data mover. They are not stored.
Create the Hardened Repository
Backup Infrastructure > Backup Repositories > Add > Direct attached > Linux (Hardened Repository).
Name it, pick your Linux host, set path /mnt/backup and click Populate.
Tick Make recent backups immutable and set days, commonly 14–30.
Tick Use fast cloning if XFS is used.
Set concurrent tasks conservatively at first. Finish.
[Screenshot: New Hardened Repository with immutability and fast cloning selected]
Question you would ask later: What if I need to delete a backup early? You cannot. That is the point. Adjust your immutability window sensibly.
5) Add Backup Proxies for speed
What they do: Move data from your hosts to your repositories. More proxies means more streams.
Add Proxy: Backup Infrastructure > Backup Proxies > Add. Choose General-purpose proxy.
Select a Windows server. Set Max concurrent tasks. One to two tasks per CPU core is a sensible start. Finish and repeat per cluster or site.
Tip: Use VM proxies in VMware clusters for Hot-Add. If you have SAN, explore Direct SAN. Both options are faster than NBD.
6) Add WAN Accelerators for efficient offsite
They dedupe and cache traffic for Backup Copy and Replication.
Add a source accelerator at your site and a target accelerator at the remote site or cloud.
Configure port 6165 by default, set parallel streams, and a cache folder. Allocate at least 10–20 GB, more is better.
Common slip: Forgetting cache. Even with High-bandwidth mode, keep cache allocated in case you change modes later.
7) Add your hypervisors
VMware vSphere
Managed Servers > Add > VMware vSphere > vSphere. Enter vCenter and admin credentials. Finish. Inventory appears under Virtual Infrastructure.
Why vCenter, not standalone ESXi: Jobs follow VMs across hosts. No rework when vMotion happens.
Microsoft Hyper-V
Managed Servers > Add > Microsoft Hyper-V (or Windows server with Hyper-V role).
Add standalone host, cluster, or SCVMM. Provide admin credentials. Veeam deploys components automatically.
Tip: If you have a cluster, add the cluster, not just a single node. Veeam then tracks VM mobility inside the cluster.
Proxmox VE
Veeam v12.2+ supports a Proxmox plugin for KVM VMs. Managed Servers > Add > Proxmox VE and add each node in a cluster.
Limitations: No LXC backups, no instant recovery, no passthrough or iSCSI disks, BTRFS caveats.
Workaround: For edge cases, use Veeam Agents inside VMs or on the host and back them up as physical servers.
Question you would ask later: Can I back up Proxmox containers? Not via the plugin yet. Use agents or rethink workload placement.
8) Create Backup Jobs as your primary protection
Home > Backup Job > VMware or Hyper-V or the workload type you need.
Select objects such as VMs, folders, tags, or hosts.
Destination: choose your repository such as hardened, local, or NAS.
Retention: set restore points and add GFS if you need weekly, monthly, or annual fulls.
Enable application-aware processing for SQL, Exchange, and Active Directory where required.
Schedule the job. Nightly is common.
Tip: Use tags or folders in VMware to group critical workloads. Jobs follow your structure, not UUIDs.
9) Create Backup Copy Jobs for offsite resilience
What they do: Copy restore points from one repository to another. Not from live VMs. From backups. Two modes are available.
Immediate Copy mirrors each new restore point as soon as it appears.
Periodic Copy runs on a schedule, for example every 4 hours or nightly.
Home or Jobs > Backup Copy. Select the source, which can be backup jobs or a source repository. Select the target repository, often remote or cloud. Set retention and GFS independent of the source job. If both ends have WAN accelerators, they are used automatically.
Backup vs Backup Copy in one line: Backups talk to VMs. Copy Jobs talk to backups.
10) Recovery mindset so you actually sleep
Test mounts monthly. Use Instant VM Recovery to a fenced network or a port group with no routing.
Test file-level restores. Verify critical shares can be browsed and restored.
Keep a one-page DR runbook with where, who, and how to reach off-site repositories.
Want us to take this on? Our service includes monthly restore drills and timestamped evidence. See Rismor Cloud Backup.
Frequently solved problems
How many proxy tasks should I set? Start at one to two tasks per CPU core on the proxy, then watch throughput, repository I/O, and production latency. Increase gradually.
How long for immutability? Common is 14–30 days. Enough to catch silent attacks and human mistakes. Pair with longer GFS if you need quarterly or yearly compliance.
Why are my backups slow in VMware? Check transport mode. Use Hot-Add on VM proxies or Direct SAN if available. Avoid NBD if you can. Add more proxies if you have cores to spare.
What is the simplest off-site? Local backups to a hardened repo plus a Backup Copy to a UK cloud repo. Turn on WAN acceleration.
Can I mix Veeam with your cloud backup? Yes. Keep Veeam locally for fast onsite restores. Use our platform for immutable offsite snapshots that attackers cannot delete.
Start at one to two tasks per CPU core on the proxy, then watch throughput, repository I/O, and production latency. Increase gradually.
Common is 14–30 days. Enough to catch silent attacks and human mistakes. Pair with longer GFS if you need quarterly or yearly compliance.
Want the bad-day-proof version without the faff?
Rismor Cloud Backup adds the two things attackers hate.
• Immutable offsite snapshots of your Veeam data, stored outside your quota.
• Nightly replication to an isolated system, so even if backups are wiped, we put them back.
We set it up, monitor it, and drill restores. Clear pricing. UK data residency.
Sizing snapshot
Backup Server: 4–8 vCPU, 16–32 GB RAM, SQL on SSD.
Proxies: one to two tasks per core, Hot-Add if VMware.
Repository: XFS on Linux for fast clones. NTFS or ReFS on Windows if needed.
WAN Accelerator: Cache 20 GB or more. One per site.
Job design
One job per logical group by RTO and RPO.
Application-aware processing for databases.
GFS for compliance.
Copy jobs to offsite.
Security
Immutable repository on-prem.
Offsite immutable copies.
Separate Veeam credentials and password rotation.
Least privilege service accounts.