Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ for VMware Administrator's Guide
  3. VMware agentless restore
  4. About restricted restore mode
NetBackup™ for VMware Administrator's Guide

About restricted restore mode

The restricted restore mode option is a form of VMware agentless restore for restricted environments such as Windows User Account Control (UAC). The user-selected files are first staged to the recovery host and then restored to the virtual machine. The recovery host must have sufficient space for staging.

The default staging location on the recovery host is install_path\VERITAS\NetBackup\var\temp\staging. NetBackup creates this directory with the correct permissions the first time it is accessed. You can change the staging location with the AGENTLESS_RHOST_STAGING_PATH registry setting on the recovery host. This REG_SZ registry key does not exist by default. It must be created in HKEY_LOCAL_MACHINE\SOFTWARE\VERITAS\NetBackup\CurrentVersion\Config.

If you change the staging location, Cohesity recommends that you let NetBackup create the staging directory. When you let NetBackup create the directory, the permissions are set correctly. For NetBackup to create the new staging directory, the immediate parent directory must exist. If you want the restore to use E:\recovery\staging, then E:\recovery must exist. If the E:\recovery directory does not exist, the restore fails.

If you create the directory yourself, the SYSTEM, the domain administrator, and the local administrator accounts must have Full Control permissions. Additionally, Access Control Lists inherited from the parent directory are not secure and must be disabled.

Restricted restore mode supports alternate location restores. You can configure the alternate location in the NetBackup web UI.

Limitations of restricted restore mode:

  • Restricted restore mode is currently only supported on Windows. The recovery host must also be Windows.

  • The file ownership of the restored files is set to the account that was used for the NetBackup backup operation.

  • Restore of ACLs is not supported.

  • Restricted restore mode does not support renaming of targets for soft links.

  • Restricted restore mode creates new files where hard links had previously been used.

  • Irregular files such as sparse files, device files, special files, and junction points are not supported.

  • A supported version of VMware Tools must be running for the restore to succeed.

  • File path length with the directory cannot exceed 260 characters.

Performance considerations

File transport through the required infrastructure for this restore method is significantly slower than VMware agentless restores. As a result of performance concerns, Cohesity recommends limiting the restore to fewer than 100 files and less than 1 GB of data.

Feedback

Was this page helpful?
Previous

Recover files and folders with VMware agentless restore

Next

Restoring Individual files and folders from VMware backups

Feedback

Was this page helpful?