Veeam Recovery Orchestrator 13 Release Notes

This document provides last-minute information about Veeam Recovery Orchestrator (Orchestrator), including system requirements and relevant information on technical support, documentation, online resources and so on.

The current version of Veeam Recovery Orchestrator is available for download at https://www.veeam.com/downloads.html from November [TBD], 2025.

NOTE

The release build of Veeam Recovery Orchestrator is 13.0.0.[TBD] while the embedded Veeam Backup & Replication build is 13.0.1.[TBD] and the embedded Veeam ONE build is 13.0.1.[TBD].
The name of the .ISO is VeeamDataPlatformPremium_v13.0.1_[TBD]].iso

System Requirements

Unless otherwise stated, all 3rd party software must be at the latest update or patch level.

Hardware

Hardware requirements depend on the size of the managed infrastructure.

Number of Protected Systems*1-15001500-50005000-1000010000-20000+

CPU

4-8 vCPUs for the Orchestrator server

4-8 vCPUs for the Microsoft SQL Server

10 vCPUs for the Orchestrator server

10 vCPUs for the Microsoft SQL Server

12 vCPUs for the Orchestrator server

12 vCPUs for the Microsoft SQL Server

>20 vCPUs for the Orchestrator server

>20 vCPUs for the Microsoft SQL Server

Memory

12 GB for the Orchestrator server

8 GB for the Microsoft SQL Server

40 GB for the Orchestrator server

40 GB for the Microsoft SQL Server

70 GB for the Orchestrator server

70 GB for the Microsoft SQL Server

>70 GB for the Orchestrator server

>70 GB for the Microsoft SQL Server

SQL Server

N/A

N/A

Disk IOPS 1000 (minimum)

Disk IOPS 2000 (minimum)

Hard Disk Space

30 GB for product installation and sufficient disk space for the Veeam ONE database (if installed locally). Use the Veeam ONE Database Calculator to size application data.

20 GB for the Microsoft SQL Server. By default, the Microsoft SQL Server database grows as follows:

  • ~1Mb per one Readiness Check Report or Plan Execution Report for a plan that includes 10 machines.
  • ~10Mb per one Readiness Check Report or Plan Execution Report for a plan that includes 100 machines.
  • ~100Mb per one Readiness Check Report or Plan Execution Report for a plan that includes 1000 machines.

Note: It is recommended to use SSD disks for the Microsoft SQL Server.

*The total number of systems protected by replicas and backups (including Veeam agent and VMware vSphere VM backups). Assumes one restore point per system per day.

OS

Only 64-bit versions of the following server operating systems are supported:

  • Microsoft Windows Server 2025
  • Microsoft Windows Server 2022
  • Microsoft Windows Server 2019
  • Microsoft Windows Server 2016

Installation on a machine running Microsoft Windows Server Core or on a Domain Controller is not supported.

Microsoft SQL Server

Local and remote installations of the following versions of Microsoft SQL Server are supported:

  • Microsoft SQL Server 2022
  • Microsoft SQL Server 2019
  • Microsoft SQL Server 2017 (2017 SP2 Express Edition is included in the setup)
  • Microsoft SQL Server 2016

It is not recommended to use the Express Edition in a production Orchestrator deployment — it should only be used for product evaluation and testing.

Veeam Orchestrator agent

The Veeam Orchestrator Agent is required to trigger orchestration actions on remote Veeam Backup & Replication servers. The remote Veeam Backup & Replication server can be:

  • Running on a Windows Server OS
  • Running on a Veeam Software Appliance (VSA) either standalone or clustered
  • Running version 12.3.x (Windows) or 13.0.x (Windows or VSA)

Some new functionality in Orchestrator version 13 will not be available until connected Veeam Backup servers are upgraded to 13.x

Additional software

For inline editing of report templates, Microsoft Word from Microsoft Office 2010 SP2 or later is required.

VMware

  • VMware vSphere 7.0, 8.0, 9.0

    The Orchestrator server must be connected to VMware vCenter Servers only. Direct connections to vSphere hosts are not supported.

  • VMware Cloud Director

    Previous versions of Orchestrator did not support orchestration of vCenter Servers that were managed by VMware vCloud Director. In version 7.0, this has been addressed. Although vCloud Director itself cannot be used as a target recovery location, Orchestrator will fully support recovery to the connected vCenter Servers. The version of Veeam Backup & Replication must be 12.1 or later.

Hyper-V

  • System Center Virtual Machine Manager (SCVMM) 2022 and 2025
  • Hyper-V Windows Server 2022 and 2025
  • Azure Local (formerly Azure Stack HCI) 23H2 or later

    The Orchestrator server can connect to Hyper-V and Azure Local clusters either directly, or via SCVMM

Microsoft Azure connected through Veeam Backup & Replication

To orchestrate recovery of Veeam agent or vSphere VM backups to Microsoft Azure, the connected Veeam Backup & Replication servers must have a Microsoft Azure compute account configured on the Veeam Backup server. To allow additional VRO features such as PowerShell script injection to recovered VMs, the secret or certificate for this account must be added to the VRO Infrastructure - Azure section of the administration UI.

Storage system

  • HPE 3PAR 3.3.1, 3.3.2 MU1
  • HPE Primera 4.3, 4.4, 4.5
  • HPE Alletra 9000 9.3 or later
  • HPE Alletra MP (B10000) 10.5 or later
  • NetApp ONTAP 9.10, 9.11, 9.12, 9.13, 9.14, 9.15, 9.16
  • Lenovo DM/DG Series 9.10, 9.11, 9.13, 9.14, 9.15, 9.16

Required Permissions

The accounts used for installing and using Veeam Recovery Orchestrator must have the following permissions.

AccountRequired Permission

Setup Account

The account used for product installation must be a domain or local account that has the local Administrator permissions on the target machine.

Orchestrator Service Accounts

The accounts used to run Orchestrator services, Veeam Backup & Replication services and Veeam ONE services must have local Administrator permissions on the Orchestrator server. The accounts must also be granted the Log on as a service right. For more information on Windows security policy settings, see Microsoft Docs.

Orchestrator Agent Account

The account used to install and run the Orchestrator agent on a Veeam Backup & Replication server must have the local Administrator, the Veeam Backup Administrator and the database Administrator permissions on the server.

Orchestrator User Accounts

The accounts used to log in to the Orchestrator UI must be granted the Allow log on locally right. For more information on Windows security policy settings, see Microsoft Docs.

vCenter Server Permissions

The account used to connect the vCenter Server to Orchestrator must have administrative permissions. You can either grant the Administrator role to the account or configure more granular permissions. For more information, see Veeam Backup & Replication Required Permissions and Veeam ONE Required Permissions.

To be able to open sessions on the vCenter Server system, the account must also have the Sessions.Validate session privilege on the root vCenter Server. For more information on session privileges, see VMware Docs.

NetApp Storage Permissions

The account used to connect the storage system to Orchestrator must be granted permissions described in section NetApp Data ONTAP Permissions.

Note: Multiple connections to a storage system using different credentials are not supported.

HPE Storage System Permissions

The account used to connect the storage system to Orchestrator must be assigned the Orchestrator must be assigned the Super or Edit role. If the account is assigned the Edit role, both the account and the storage resources that you plan to access must belong to the same domain.

Note: Multiple connections to a storage system using different credentials are not supported.

Microsoft SQL Server

Different sets of Microsoft SQL permissions are required in the following cases:

  • Installation (remote or local): the current account needs the CREATE ANY DATABASE permission on the SQL Server level. After the database is created, this account automatically gets a db_owner role and can perform all operations with the database.
  • Operation: the account used to run Orchestrator, Veeam Backup & Replication and Veeam ONE services requires the following permissions:

    • The db_owner permission and permissions to execute stored procedures for the configuration databases on the Microsoft SQL Server.
    • The db_datareader permissions to read data from the SQL server master database.
    • The public, db_datareader and SQLAgentUserRole permissions to be able to access the data and objects in the MSDB database.

For more information, see Veeam Backup & Replication Required Permissions and Veeam ONE Required Permissions.

Orchestrator Credentials for Application Verification

The account used to run the Verify SharePoint URL step, must be assigned the SharePoint_Shell_Access role and must be a member of the WSS_ADMIN_WPG group on the processed VM. The account used to run the Verify Exchange Mailbox step, must be assigned the ApplicationImpersonation role on the processed VM.

What’s New in Veeam Recovery Orchestrator 13

Orchestration of the Veeam Software Appliance (VSA)

VRO 13 supports the Linux-based Veeam Software Appliance, including the HA cluster configuration. VSA HA clusters must be added to VRO using the cluster name or IP. The VRO agent will be automatically deployed to each VSA cluster node. After adding the cluster it will be seamlessly orchestrated as a single Veeam Backup server, and VRO will automatically use the current active node for all operations.

New Web UI

VRO 13 features a 100%-new web UI, with improvements to UX and workflow through out the product.

Audit report

A new report which runs monthly for all recovery plans, and lists all activity over that month - readiness checks, tests, executions, malware scans and also includes a full change log.

Offline malware scanning

Recovery plans can now be scanned in offline mode. Malware scanning supports antivirus (Veeam Threat Hunter by default), YARA, and a check of the malware flag on every restore point.

HPE Alletra MP (Greenlake B10000) storage system support

Alletra MP is now supported as replicating storage backing vSphere datastores for use in VRO Storage plans

Azure Compute Account management in VRO UI

In previous versions VRO would use Azure compute accounts configured on Veeam Backup for recovery without any further configuration required. To improve security, the Secret/Certificate for Azure authentication will no longer be collected by VRO. To enable the additional functionality of VRO Azure recovery such as script injection, the compute account secret/certificate must be entered in the VRO UI, in the Administration section, Infrastructure page, Azure tab.

Known Issues

Web UI

Some minor issues may be found with the new web UI. There will be addressed in an upcoming patch.

  • The ‘In-use’ counter of the Plan Verification widget does not populate. However plans which are in use can still be seen on the other three widgets (for execution, test, and malware scan)
  • Datalab Admin Lab Groups can be de-selected by non-admin users when configuring a datalab test. In the next update such groups will be locked again so that only Administrators can manage them.

VRO Agent for VSA (Veeam Software Appliance)

When adding a VSA HA cluster to VRO, it is essential to deploy the VRO agent to the cluster name or IP address - do not use the name of one of the nodes. If using a node name, the agent may deploy to both nodes however it will not register the correct cluster name/IP address. Use Uninstall to remove any such agent and redeploy using the cluster address.

If executing a VRO custom script on a VSA server: - Parameters marked as Boolean will not be passed correctly to the script execution engine. The workaround is to use numeric or string parameter to perform the same function. - Access to network resources via API may be restricted. This is due to security features of the VSA sandbox environment.

When running a datalab test on a VSA server for Linux VM backups or replicas, you may receive error ‘Cannot find default Windows MountServer’. The workaround is to add a Windows mount server to the VSA, which will allow the test to continue.

##Re-IP

When multiple re-IP rules are configured, the rule of ‘Strictest rule will be applied’ is not always followed. Re-IP will be applied but it may use a less-strict rule. This will be addressed in a future VBR update.

Hyper-V recovery

Considerations when connecting Orchestrator to SCVMM

When a connection is created to SCVMM in the Orchestrator UI, this connection is automatically pushed to the embedded Veeam ONE server and the emdedded Veeam Backup server. The Veeam Backup server will deploy connectivity components to the Hyper-V hosts as part of the usual process of registering this connection. If there is already a Veeam Backup server of an older version which has a connection to this SCVMM and these hosts, it will lose connection and backups and restores will fail, due to the mismatch of installed component versions.

It is essential to upgrade any existing Veeam Backup servers to the same version as the embedded Veeam Backup server on Orchestrator before creating the SCVMM connection in Orchestrator. In this way on-host components will already be the correct version.

Cluster networks

If a specific host or hosts are not responding when the cluster is added to VRO infrastructure; or if a host is excluded from monitoring in the Veeam ONE console, then VRO may fail to collect all the cluster networks for use in mapping rules.

CSV storage

Orchestrator cannot retrieve the online/offline status of CSV disks in Hyper-V recovery locations. Disks chosen in the location configuration will be assumed online and used for restore. An active check of CSV status will be introduced in a future update.

Plan Steps compatibility

As in-guest scripting is not yet supported when recovering Hyper-V VMs, some plan steps that can be used when restoring vSphere backups will not be compatible when restoring Hyper-V backups. The full list impacted steps can be found in the [User Guide][link] In-guest scripting will be added in a future update.

Heartbeat check post-restore

Heartbeat check of a restored VM is included for Hyper-V, however if the cluster resource optimization is set very aggressively the restored VM maybe migrated from the host it was restored to before Orchestrator can complete the heartbeat check. Additionally, heartbeat check may be unreliable when there are a laerge number of host servers in the cluster. For this reason, the Check Heartbeat step is not automatically added when creating a Hyper-V restore plan; however the step can be added afterwards, and tuned according to the environment.

Scalability

It is not recommended to exceed the default setting of 10 VMs processed in parallel when the recovery location is a Hyper-V cluster. This is due to queuing and contention in the Veeam PowerShell cmdlets which can cause commands to eventually time out. Optimization is in progress for a future update.

Setup and Upgrade

  • The VRO ISO, also known as the Veeam Data Platform - Premium ISO, is designed to deploy or upgrade an ‘all-in-one’ VRO server with all three products installed (Veeam Backup, Veeam ONE and Veeam Recovery Orchestrator). The setup wizard on the v13 ISO can no longer deploy or upgrade individual products. To deploy or upgrade individual products or components download the specific ISO for that product.
  • Customers on older versions should upgrade to the last 7.2.1.290 build, and then upgrade to VRO 13. The ISO for 7.2.1.290 is VeeamDataPlatformPremium_v12.3.2_20250716.iso and is available on the Previous versions tab of the product download page.
  • The option ‘Proactive Support’ in the setup wizard only functions for Veeam Backup, and does not enable the setting for VRO. To enable this feature for Orchestrator, it is required to edit the file found at C:Files.json and set ProactiveSupport to True as follows - Set “License”: { “ProactiveSupport”: true }
  • After upgrading VRO 7.2 to v13, and then upgrading connected Veeam Backup servers to v13, the VRO agent for the backup server may remain in a Warning state. Clicking on the warning shows a dialog message about a version mismatch. The workaround is to Repair the VRO agent.
  • Customers who have applied a private fix or patch to the embedded Veeam Backup server installed on the Orchestrator server will find that upgrade using the setup wizard will fail. Perform upgrade by launching the VRO .msi installer directly. For assistance contact Veeam Support.
  • The following configuration checks have been added to the upgrade wizard:

    • Each VRO plan should require only a single Veeam Backup server to execute. Although Orchestrator does (and will continue to) support orchestration of multiple Veeam Backup servers, historically it was possible to create plans where more than one Veeam Backup server was needed for recovery of a single plan (for example one group of VMs in the plan is protected by server A, another group is protected by server B).

      This configuration is not recommended, as such plans would be impossible to test - as testing requires a Virtual Lab, which can only be managed by a single Veeam Backup server. Due to this and other similar configuration and execution issues, it is now mandatory that all plans should require a single backup server to execute.

    • Each VRO Restore plan should restore only a single type of backup, where type is vSphere VM backup, Hyper-V VM backup, or Veeam Agent backup. This is required to support additional cross-platform functionality and ensure stable plan performance. If existing plans contain VM Groups based on different backup types, the plan can be cloned and then both copies edited to support the new requirement.

      Note that the resultant two plans can then be run simultaneously; there is no restriction on restoring different types of backup at the same time. The restriction is only that they should not be in the same plan.

  • During the upgrade, some warning dialogs with text including “Improved background retention” and “Active CDP Policy” may be displayed. These are warnings related to the embedded Veeam Backup & Replication server and may appear if that server has been used for general backup and replication tasks. For full details of the actions to take upon any warning messages, see the Veeam Backup & Replication User Guide, section Upgrading to Veeam Backup & Replication 12.
  • The Veeam Threat Center dashboard has been removed from VRO in this release and will not be in the VRO UI after upgrade. It is still available in Veeam ONE.

Infrastructure

  • SQL authentication credentials provided during Orchestrator server installation cannot be changed. If the password for the SQL account is changed, Orchestrator will be unable to connect to the database. To work around the issue, it is recommended to use Windows Authentication to connect to the Microsoft SQL Server. Alternatively, Veeam Customer Support can help you resolve the issue.

Recovery plans

  • The maximum value cap of 50 for parallel processing of VM recoveries in a recovery plan has been removed. The maximum is now 999; however note that the platform used, storage and network performance, and other environmental factors will still determine the maximum feasible limit.
  • If a plan includes in-guest scripts and the source machine is still online, you may see the following error when executing the script step: “RPC error: There are no more endpoints available from the endpoint mapper”. This is caused by the Veeam Backup & Replication server attempting to deliver the script to the source machine. The expectation during a recovery plan execution is that the source machine is not available. Note if this error occurs during plan testing, it is a sign that the DataLab configuration is not correct.

Storage failover

  • Under certain circumstances, a plan may be halted after one or more Register VM steps have started but not completed, causing orphaned VMs to be created in the recovery location. These VMs should be removed manually. The issue will be addressed in a future update.

Technical Documentation References

If you have any questions about Veeam Recovery Orchestrator, you may use the following resources:

Technical Support

Veeam offers email and phone technical support for customers on maintenance and during the official evaluation period. For a better experience, please provide the following when contacting Veeam Customer Support:

  • Version information for the product and its components
  • Error message and/or accurate description of the problem you are having
  • Log files

TIP

The required log files can be easily downloaded from the Orchestrator Web UI. For more information, see the Veeam Recovery Orchestrator User Guide Appendix B.

To submit your support ticket or obtain additional information, please visit the Veeam Customer Support Portal. Before contacting Veeam Customer Support, consider searching for a resolution on Veeam R&D Forums.

Contacting Veeam Software

At Veeam Software, we pay close attention to comments from our customers — we make it our mission to listen to your input, and to build our products with your suggestions in mind. We encourage all customers to join Veeam R&D Forums and share their feedback directly with the R&D team.

Should you have a technical or licensing issue or question, please feel free to contact our Customer Support organization directly. We have qualified technical and customer support staff available 24/7 who will help you with any inquiry that you may have.

Customer Support

For the most up-to-date information about our support practices, business hours and contact details, please visit the Veeam Customer Support Portal.

Company Contacts

For the most up-to-date information about company contacts and office locations, please visit the Veeam Contacts Webpage.

Document updated 11/24/2025

Document content applies to build 13.0.0.1005