I've been using SentinelOne for a couple of years now, and while it's an excellent EDR solution, I'm experiencing significant issues when trying to back up data. Our Veeam and Cove backups keep failing because SentinelOne is monopolizing all the available VSS storage. This is affecting numerous critical servers. When I reached out to SentinelOne support, they advised that there's no way to adjust VSS usage on an organization-wide level—only on a per-device basis. They also mentioned that changing the VSS timing could void any support guarantees.
I'm wondering if the only fix is to create a complex API-driven script to disable the S1 agent, delete VSS snapshots, reset the VSS limits, and then re-enable the agent, which sounds like a fragile solution. So, I'm looking for any advice:
* Is there a better solution to this problem?
* Are there any backup vendors that truly work well with SentinelOne?
* Should I consider dropping SentinelOne for an EDR that doesn't rely so heavily on VSS?
Thanks in advance for your help!
3 Answers
It sounds like you might be able to resolve this by adjusting your SentinelOne policies. A few users reported that adding specific configurations helped alleviate Veeam issues. For instance, using the following policy might make a difference for you:
{
"antiTamperingConfig": {
"allowSignedKnownAndVerifiedToSafeBoot": true
},
"vssConfig": {
"excludedVssWriters": "",
"vssProtection": true
}
}
Also, what version of SentinelOne are you running? Sometimes issues can be fixed by simply updating the software.
I’m not entirely sure what those settings change; they look default. Can you clarify how adding those helps? We are currently on version 24.1 and have overall faced backups issues ever since switching from Veeam to Cove.
In my experience, SentinelOne can integrate well with Veeam if the configurations are right. You could try excluding problematic VSS writers from protection individually or enlarging the VSS snapshot size globally. The commands for adjusting those settings aren't too tricky once you get the hang of them!
I actually use SentinelOne with Rubrik and have had no issues with backups at all. It might be worth looking into how these two work together. If you’re having persistent troubles, you could also consider adjusting the specific VSS writers that SentinelOne protects or even disabling snapshotting entirely for specific servers that are causing problems.
I think the main problem isn’t really about interoperability but rather VSS settings and how SentinelOne is configured to handle space. It seems like there's no straightforward way to manage these settings organization-wide.