How Orchestrator Selects Restore Points During On-Demand Malware Scan

[This applies to Microsoft Azure, VMware (including Original VM Location) and Hyper-V (including Original VM Location) recovery locations only]

Generally, when performing on-demand malware scan, Orchestrator looks through the list of restore points created for a machine to detect the most recent clean restore point. The backup file that contains the restore point can be located in a regular or scale-out backup repository, and can be produced by a backup or backup copy job.

However, when you use backup copy capabilities offered by Veeam Backup & Replication, you have multiple instances of the same backup data existing in different locations. This situation may influence the way Orchestrator chooses backup files to recover machines.

When configuring a Microsoft Azure, VMware or Hyper-V recovery location, you can choose either of the following options:

  • Automatic — the solution will scan restore points points produced by either a primary or backup copy job. In case there are multiple primary and backup copy jobs, the solution will look through restore points produced by the job that contains the most recent restore point regardless of whether this restore point is stored in a regular or scale-out backup repository.
  • Primary — the solution will scan restore points produced by a primary backup job only. In case there are multiple primary and backup copy jobs, the solution will always look through restore points produced by the primary job that contains the most recent restore point regardless of whether this restore point is stored in a regular or scale-out backup repository.
  • Backup Copy — the solution will scan restore points produced by a backup copy job. In case there are multiple primary and backup copy jobs, the solution will always look through restore points produced by the backup copy job that contains the most recent restore point regardless of whether this restore point is stored in a regular or scale-out backup repository.

Note that if you do not have any restore points produced by a backup copy job, the malware scan will complete with an error.

  • SOBR Capacity Tier — the solution will scan restore points stored in a capacity tier of a scale-out backup repository (SOBR) only. The solution will always look through restore points produced by any backup job (either primary or backup copy) that contains the most recent restore point.

Note that if you do have any backup jobs with restore points stored in a scale-out backup repository, the malware scan will complete with an error.

Important

In case there are several restore points with the same timestamp, the point to scan is selected at random basis.

Page updated 1/2/2026

Page content applies to build 13.0.0.1167