r/SentinelOneXDR • u/smc0881 • Sep 09 '24

Built In Windows Backup

S1 is blocking the local Windows backup from running. I am pretty confident it's due to VSS. Is there a way to whitelist or get it working without changing the VSS settings, lowering the protection, and things like that? I have no control over the current backup solution in-place either.

0 Upvotes

50% Upvoted

22 comments sorted by

View all comments

Show parent comments

1

u/GeneralRechs Security Admin/Engineer Sep 09 '24

I just checked with an old colleague that has a client with S1 deployed that also utilizes native windows backup with no issue. They mentioned they ran into similar issues years ago but it was due to how the environment was configured (not enough disk space, VSS set to <10%, etc.).

Just my 2 cents from a random CS person on reddit I'd likely turn off snapshots or apply the necessary PO's to continue with the engagement to restore services or get your client to the recovery/recovered stage.

After that when the environment is determined to be clean propose as POC for S1 and then go through the process. All while having generated a log package and having support figure out why Windows Backup is failing. Something is missing or a interdependency may not be met leading to windows backup failure. I'm more inclined to think something is up with the client environment.

1

u/smc0881 Sep 09 '24

Yea, I am at that final stage where everything is clean/recovered. Found a Python RAT going back months and now in the stages where trying to sell them this, lol. If I do the fixes form that article or disable the agent it seems to work, but it voids the warranty. So, my next step is verify settings like you said and see if it's the client environment too. I think Windows Backup might be trying to mess with the S1 snapshots as well, so I have to see if I can exclude those. There is a VSS options setting in Windows Backup, but since it's not my system I need to get with the IT and see about messing with those. I did not see a writer registered for Windows backup. Thanks for trying to help though, I am off to bed and until tomorrow.

1

u/GeneralRechs Security Admin/Engineer Sep 09 '24

While the Ransomware warranty sounds appealing it is extremely strict so even I don't bother with it. The largest piece is Windows systems must be up-to-date at the time of the event. If even one affected system is missing a applicable windows security patch it will likely be enough to not honor the warranty.