1-800-691-1991 | 9am - 8pm ET

General Security Guidelines for Veeam Self-Service Backup Portal


Self-Service Backup Portal is usually publicly available, this leads to increased risks associated with security. While it is generally safe to use this site, in order to reach maximum security it's recommended to apply certain Microsoft IIS and Windows settings.

More information:

The desired security settings can be divided in three categories:
  • Allowed protocols for secure communications
  • Allowed ciphers
  • Recommended Microsoft IIS settings
All of these settings should be applied on the Veeam Enterprise Manager server.



Step 1. Disable old security protocols in Windows registry

When IIS server receives HTTPS connection, a client and a server negotiate a common protocol to secure the channel. By default, Windows has a set of enabled protocols and if the client negotiates some old weak protocol (PCT 1.0, for example), it will be used for communication. In modern networks it?s recommended to use one of the latest protocols ( either TLS 1.1 or 1.2).
Windows Server stores information about channel protocols in the Windows registry key below:


This key may contain the following subkeys:

  • PCT 1.0
  • SSL 2.0
  • SSL 3.0
  • TLS 1.0

Each key holds information about the protocol and any of these protocols can be disabled on the server. The following registry values (and subkeys, if necessary) should be created to disable the old protocols:

  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0]
    "Enabled" = DWORD:0x00000000
  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0]
    "Enabled" = DWORD:0x00000000
  • ​[HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0]
    "Enabled" = DWORD:0x00000000
  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]
    "Enabled" = DWORD:0x00000000

​Step 2: Disable weak ciphers

By default, list of ciphers negotiated for given security protocol includes RC4 and 3DES. These ciphers are considered vulnerable, and it?s recommended to disable them completely.

Note: If you use any Windows version except Windows Server 2012R2, Server 2016 and Windows 10, the KB2868725 security update must be installed before applying the settings below.

In order to disable RC4 and 3DES, the following registry values should be created:

  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128]
    "Enabled" = DWORD:0x00000000

  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128]
    "Enabled" = DWORD:0x00000000

  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128]
    "Enabled" = DWORD:0x00000000

  • [HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168]
    "Enabled" = DWORD:0x00000000

Step 3: Tweak website settings

The settings for Self-Service Backup Portal site are stored in the special Web.config file. The default Web.config file created after installation does not contain recommended security settings. In order to change this file according to recommendations, please follow the steps below:
  1. Browse to the web app installation folder (default is at C:\Program Files\Veeam\Backup and Replication\Enterprise Manager\WebApp)
  2. Copy original Web.config file someplace else to revert the changes if something goes wrong.
  3. Open Web.config file
  4. Find <system.web> section and add the following option to the httpRuntime settings: enableVersionHeader = "false". The httpRuntime settings should look like that afterwards:
  <httpRuntime requestValidationMode="2.0" targetFramework="4.5" executionTimeout="300" enableVersionHeader="false"/>
  1. Find <system.webServer> ---> <httpProtocol> ---> <customHeaders> section and add the following options:
<add name="Strict-Transport-Security" value="max-age=31536000"/>
<add name="X-XSS-Protection" value="1; mode=block"/>
<add name="X-Content-Type-Options" value="nosniff"/>
<remove name="X-Powered-By" />

The httpProtocol section should look like that afterwards:
<add name="Strict-Transport-Security" value="max-age=31536000"/>
<add name="X-XSS-Protection" value="1; mode=block"/>
<add name="X-Content-Type-Options" value="nosniff"/>
<remove name="X-Powered-By" />
  1. Open the Error.aspx file in the same folder.
  2. In the same folder there is an Error.aspx file. Copy it to someplace else as well, then open it and delete its contents.
Please restart the server after all of the changes listed above. If any issues appear after this configuration, please feel free to contact Veeam support.
Veeam Backup & Replication
Last Modified:
Please rate how helpful this article was to you:
5 out of 5 based on 1 ratings
Thank you for helping us improve!
An error occurred during voting. Please try again later.

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.
Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Spelling error in text

Knowledge base content request
By submitting, you agree that your personal data will be managed by Veeam in accordance with the Privacy Policy.

ty icon

Thank you!

We have received your request and our team will reach out to you shortly.


error icon

Oops! Something went wrong.

Please go back try again later.