How to Update NATS and PostgreSQL Passwords Used by Veeam Backup for Microsoft 365

The administrator provides the username and password during installation for generating the Configuration Database. During the installation, the username and password for the read-only role are created, and that account information is secured in the configuration files in an encrypted format.

When the password for the user utilized by Veeam Backup for Microsoft 365 to connect to the Configuration Database is changed, it must be updated in the configuration files.

Password Restrictions

The following characters should not be used as part of the PostgreSQL user's password:

• @
• <
• >
• '
• "

Update PostgreSQL Configuration Database Connection Details

1. On the Veeam Backup for Microsoft 365 server, open the configuration file in a text editor:
   C:\ProgramData\Veeam\Backup365\Config.xml
2. Within the <Archiver> section, identify the line with the following pattern:
       <ControllerPostgres ControllerConnectionString="host=<hostname>;port=5432;database=<config_db_name>;username=postgres;password=<encrypted_password>;passwordencrypted=True;MaxPoolSize=100;ConnectionIdleLifetime=10" />
3. Update the ControllerConnectionString as follows:
   1. Replace the encrypted password value with the plaintext password that will be used to connect to the Configuration Database.
   2. Remove ;passwordencrypted=True parameter.
      • Example (Before):

        <ControllerPostgres ControllerConnectionString="host=vb365srv;port=5432;database=VeeamBackup365;username=postgres;password=AQAAANCMnd8BFdERjHoAwE%2FCl%2BsBAAAARy%2Fvgmvm50WcOwqjnpZO1AQAAAACAAAAAAAQZgAAAAEAACAAAADQngLZF6xhXmUoY2ntShya0r4MmMZC8qhn4oeTs7eRXQAAAAAOgAAAAAIAACAAAAADc0FIuyQyE45qlTITlQru0UG0pnTWhHRDmfAMWH64YxAAAACkHVqiKuTRXGbVA5WJR8c8QAAAAD5nomp8vuxg2DpCJIFIFhaPRZlbMCwJts%2FVq1rUP8HHCOmaJFTUWDn1kaLoAVb9B1CWXAsHR5LHaSbWx3isMzo%3D;maxpoolsize=100;connectionidlelifetime=10;PasswordEncrypted=True" />
        

      • Example (After):

        <ControllerPostgres ControllerConnectionString="host=vb365srv;port=5432;database=VeeamBackup365;username=postgres;password=53kr37pa55vv0rd;maxpoolsize=100;connectionidlelifetime=10; />
        

4. Restart the Veeam Backup for Microsoft 365 Service service; the password in the file will be automatically encrypted, and the software will regain database access.

Update Read Only User Account Used by Proxies

When the password for the proxy_dbuser_<config_db_name> user has been changed, the new password must be updated in multiple locations. The methodology is the same as updating the configuration database password: replace the encrypted password value with the new password in plaintext, remove the 'PasswordEncrypted=True' parameter, and restart the services.

Update Password Distributed by Veeam Backup for Microsoft 365 to New Proxies

The Config.xmlC:\ProgramData\Veeam\Backup365\Config.xml file on the Veeam Backup for Microsoft 365 server stores the connection string used when deploying new proxies and must be updated to ensure those future proxies have the correct credentials to access the database.

1. On the Veeam Backup for Microsoft 365 server, open: C:\ProgramData\Veeam\Backup365\Config.xml
   
2. Within the config.xml file, find the line that starts with: <RemoteProxyDeploymentSettings
3. Update the ControllerConnectionStringForProxy settings as follows:
   1. For each password= parameter on that line, replace the encrypted password value with the new password in plaintext.
   2. Find each instance of ;PasswordEncrypted=True on that line, and remove them.
4. Restart the Veeam Backup for Microsoft 365 Service.
   ^{During the next startup of the service, the plaintext passwords in the Config.xml will be encrypted and replaced with that encrypted value.}

Update the Password Used by the Existing Proxies

The Proxy.xmlC:\ProgramData\Veeam\Backup365\Proxy.xml on each proxy stores the connection information to access the configuration database. This value is only pushed out to the proxy during initial deployment. As such, after a password change for the proxy_dbuser_<config_db_name> user, the credentials within the Proxy.xml file must be manually updated on each existing proxy.

On each Proxy server, do the following:

1. Open: C:\ProgramData\Veeam\Backup365\Proxy.xml
   
2. Within the Proxy.xml file, find the two lines that start with:
   • <ProxyPostgres
   • <PersistentCachePostgres
3. Within those lines, update the Connection Strings as follows:
   1. Find the password= parameter and replace the encrypted password value with the new password in plaintext.
   2. Remove the ;PasswordEncrypted=True parameter.
4. Restart the Veeam Backup for Microsoft 365 Proxy Service.
   ^{During the next startup of the service, the plaintext passwords in the Proxy.xml will be encrypted and replaced with that encrypted value.}