Veeam Restore Procedure

ℹ️ June 2026: The Veeam server was rebuilt via Terraform on 2026-06-09 (license expiry → full VM rebuild; vault data preserved). Restore paths below re-verified against Terraform — unchanged.

When to Use This Document

This covers how to actually recover data from backup. For the backup architecture (what is backed up, RPO/RTO, schedules), see Backup Architecture.

Two restore paths exist depending on what you are recovering:

Scenario	Tool	Doc section
Single file, folder, or VM within Azure	Azure Recovery Services Vault	§1
Full environment failover to AWS	Veeam → EC2	§2
Database-level recovery	Azure SQL backup	§3

---

§1 — Azure Recovery Services Vault Restore

Use this for: restoring a single file, a disk, or a full VM within Azure. Fastest path — no cross-cloud involved, RTO 1–4 hours.

1a. Full VM Restore

1. Azure Portal → Recovery Services Vaults → select the vault for the target subscription (e.g. rsv-prod-backup for Production subscription)
2. Backup Items → Azure Virtual Machine → find the target VM
3. Click the VM → Restore VM
4. Select a recovery point — the most recent daily snapshot is usually what you want. If the VM was compromised, pick a point before the compromise — check the incident timeline first.
5. Restore type: "Create new virtual machine" (replaces in-place) or "Replace existing" (overwrites the current VM disks — use carefully if the current VM is still running)
6. Target resource group and VNet — restore to the same RG/VNet unless you are staging for forensics
7. Click Restore — monitor progress under Backup Jobs
8. Estimated time: 1–4 hours depending on VM disk size
9. After restore, verify the VM boots, domain joins correctly, and Cortex XDR agent is active

If restoring because of ransomware: isolate the VM from the network before restoring. Do not let the restored VM reconnect until you are confident the attack vector is closed.

1b. File and Folder Restore (Item-Level Recovery)

1. Portal → Recovery Services Vault → Backup Items → Azure Virtual Machine → target VM
2. File Recovery (not Restore VM)
3. Select a recovery point → Download Script — this downloads a PowerShell script and a password
4. Run the script on any Windows machine with network access to the vault — it mounts the backup disk as a local drive letter (e.g. F:\)
5. Copy the files you need from the mounted drive to your destination
6. When done, click Unmount Disks in the portal to release the mount
7. The mount expires automatically after 12 hours if not manually unmounted

1c. Azure SQL Database Restore

1. Portal → SQL Server → Databases → target database → Restore
2. Restore point: select a point-in-time or a long-term retention backup
3. Restore to a new database name first (e.g. proddb-restored-YYYYMMDD) — verify data integrity before swapping the connection string
4. After verification, rename or update app config to point to the restored DB

Recovery Services Vault — Quick Reference

Subscription	Vault	What it covers
Production	rsv-prod-backup	Production VMs, SQL databases, file shares
Identity	rsv-identity-backup	Domain controller VMs
Firewall	rsv-firewall-backup	Palo Alto VM
Dev	rsv-dev-backup	Dev VMs (14-day retention)
DDE Firewall	rsv-dde-firewall-backup	DC01, DC02, Entra Connect, Palo Alto, Panorama, syslog VM, VLC VM
DDE Billings	rsv-dde-billings-backup	7 AVD session hosts

---

§2 — Veeam DR Restore to AWS

Use this for: full environment failover when Azure is unavailable or a complete Azure rebuild is needed. Longer RTO (4–8 hours). This is the disaster recovery path.

For the full step-by-step failover procedure including network configuration, DNS cutover, and Arctic Wolf reconnect, see DR Failover Procedure.

The Veeam-specific steps are summarized here for reference:

What Veeam Backed Up

Veeam replicates nightly from Azure Production to the AWS Backup account (863609217450) into an S3 bucket with:

• KMS encryption (customer-managed key)
• Object Lock enabled (ransomware protection — backups cannot be deleted)
• Versioning enabled
• S3 lifecycle: Standard-IA at 90 days → Glacier at 365 days

Last validated: March 4, 2026 — 2 hosts, 106.4 GB processed, 0 errors, 2.7× compression.

Hosts covered: CGIRDPAZP01, BIZARCAZP01

Restore Steps (Abbreviated)

1. Log in to the AWS Backup account (863609217450) with your IAM credentials
2. Navigate to the Veeam backup target S3 bucket
3. The Veeam backup template files are the most recent nightly snapshot that succeeded (check the Veeam email report for the last successful date)
4. In the AWS Prod account (807267566999), create an EC2 instance using the Veeam backup template as the root volume
5. Attach to the DR VPC using the network configuration in DR Failover Procedure
6. Boot the instance — it should come up as the same Windows Server with the same data state as of the backup point
7. Verify: domain join status, application connectivity, data integrity

Data loss warning: Data submitted since the last successful nightly backup is lost. Customers must re-submit any transactions from that window. This is the documented and accepted RPO ~24 hours.

Glacier Recovery (If Backup is in Glacier)

If the backup you need has transitioned to Glacier (> 365 days old):

1. S3 Console → Backup bucket → find the file
2. Initiate restore — select "Expedited" retrieval (available in 1–5 minutes, higher cost) or "Standard" (3–5 hours)
3. Specify restore period (e.g. 7 days — how long the object is available before returning to Glacier)
4. Wait for the restore to complete before proceeding with the EC2 restore above
5. Expedited retrieval is the right call during an active incident — cost is irrelevant compared to recovery time

---

§3 — Validating a Backup Before You Need It

Do not discover a backup is broken during an incident. Run these checks periodically or before a planned DR test:

Check RSV backup job status:

az backup job list --resource-group rg-prod-backup --vault-name rsv-prod-backup \
  --output table --query "[?properties.status!='Completed']"

Any job not in Completed status is a gap. Cross-check against the weekly HIPAA audit email which includes backup job summary.

Check Veeam last successful run: Veeam sends email completion reports. If you have not received a Veeam email in more than 25 hours, replication failed. Check the Veeam management console on the Veeam server (Production subscription).

Test file restore quarterly (October DR test): Per the DR test schedule, a full Azure VM restore from Recovery Services Vault is scheduled for October 2026.

---

§4 — Restore Decision Tree

Something is lost or corrupted — what do I restore?
        │
        ├─ Single file/folder?
        │       └─ RSV File Recovery (§1b) — fastest, ~30 min
        │
        ├─ Full VM crashed or corrupted?
        │       └─ RSV Restore VM (§1a) — 1–4 hours
        │
        ├─ Database corrupted?
        │       └─ Azure SQL point-in-time restore (§1c) — 1–2 hours
        │
        ├─ Azure subscription/region unavailable?
        │       └─ Veeam DR failover to AWS (§2 + DR Failover Procedure)
        │
        └─ Need data older than RSV retention?
                └─ RSV long-term retention OR Veeam S3 (may be in Glacier)
                   Check retention table in Backup Architecture doc

---

During an Active Incident

If you are restoring because of a security incident (ransomware, data corruption):

1. Do not restore to the same VM while the attack vector is open — you will re-infect the restored VM
2. Restore to a fresh VM in an isolated subnet first
3. Verify the restored state is clean (Arctic Wolf will be watching; coordinate with them)
4. Close the attack vector (patch, credential reset, firewall rule, etc.)
5. Only then cut traffic over to the restored VM

Coordinate with Arctic Wolf throughout — they have act-first authority and will be working the incident in parallel.

---

Escalation Contacts

Need	Who
RSV restore authorization	Rory
DR failover decision	Rory + Kevin (Domain Admin)
Arctic Wolf coordination during incident	Arctic Wolf 24/7 line (in Keeper)
AWS access for Veeam restore	Rory (has IAM access to Backup account)

---

Related Documents

• Backup Architecture — what is backed up, schedules, RPO/RTO
• DR Failover Procedure — full Azure → AWS failover
• Incident Response — what to do when restore is needed due to an incident
• Q2 2026 DR Test Plan — upcoming full failover test

---

Document History

Date	Change	Author
May 2026	Initial draft — covers RSV restore (file, VM, SQL), Veeam DR restore to AWS, Glacier recovery, restore decision tree. Based on backup-architecture.md and DR failover procedure	Rory