Proxmox Backup to NAS: NFS vs SMB Setup and Restore Checklist

Preparation date: September 17, 2026. Scope: This is a documentation-based implementation and verification guide, not a claim about a completed customer incident. It covers ordinary Proxmox VE VZDump backups written to NAS storage. A Proxmox Backup Server datastore is a different architecture and is called out separately. The short answer is: choose NFS when Proxmox is the main consumer and your NAS can restrict the export to the Proxmox node addresses. Choose SMB/CIFS when the same share must also fit a Windows-oriented operating model or your NAS administration is already built around named users and SMB permissions. The protocol choice matters, but the restore test matters more. A green backup task proves that an archive was written; it does not prove that you can recover a VM on replacement storage. Proxmox backup to NAS verification flow A Proxmox node writes a VZDump backup over NFS or SMB to a NAS, then a separate restore test validates recovery. ...
Post a Comment

Horizon Watermark and Capture Blocking: Version-Aware GPO Verification

Watermarking and screen-capture blocking are different controls with version-specific limits. Before editing a GPO, identify the exact Client, Agent, operating system, and session type. This guide covers selecting and verifying the settings; the companion article covers a rollout acceptance test.

Correction, September 12, 2026: Earlier policy paths, placeholder variables, registry values, and universal support claims were not adequately verified. They have been removed. Do not copy those earlier values into a production baseline.

Select the correct feature

RequirementControl to investigateDo not assume
Visible session attributionDigital watermark configurationEvery recording or redirected surface includes it.
Restrict endpoint screenshots/recordingScreen-capture BlockingEvery endpoint or capture path is covered.
Restrict copying files or clipboard contentSeparate redirection policiesCapture blocking configures these automatically.

The Horizon 2309 watermark documentation describes supported surfaces and exceptions, including RDP and some redirection/recording paths. Use the documentation corresponding to the installed release; an older feature page is not a current compatibility guarantee.

Resolve the policy from the matching template

  1. Record the deployed Agent and Client releases and retrieve the corresponding official administrative templates.
  2. Back up the existing template store and GPO through the normal change process. Keep language resources consistent with the template version.
  3. Locate the documented watermark setting and supported content fields in that template. Do not substitute plausible variables from another product or a blog example.
  4. For capture restrictions, consult the Horizon 2406 Agent template reference, including its Screen-capture Blocking section and platform requirements. Confirm the equivalent in your release before applying it.
  5. Check whether the applicable policy is user-level, machine-level, or both, and its documented precedence. Do not assume a single Computer Configuration path is universal.

Verify policy delivery separately from behavior

Generate a policy-result report in the intended user/computer context, using Microsoft's gpresult tool. For example, gpresult /h horizon-policy-report.html writes a local HTML report; choose a permitted folder and protect the report because it contains internal policy details.

If the policy is absent, investigate link scope, filtering, inheritance, and the targeted identity. If it is present but behavior differs, check platform support and the actual capture surface before changing registry values. Refresh or establish a new session according to the feature documentation; a policy report alone is not proof that the restriction is enforced.

Limitations and rollback

A physical camera cannot be stopped by a screenshot policy. Visible attribution is a deterrent, not a promise of complete leak prevention. Capture behavior can differ between endpoint tools, tools inside the remote desktop, and redirected applications. Evaluate those differences explicitly with non-sensitive test content.

Pilot the change, retain the original GPO settings, and confirm permitted support and accessibility workflows. If business-critical functionality regresses, restore the approved prior configuration and recheck effective policy and session behavior. Do not promise regulatory compliance from a watermark alone.

Related troubleshooting guides

Comments

Post a Comment

Popular posts from this blog

Horizon vdpConnect_Failure: Connection-Stage Triage Before Reinstalling

vdpConnect_Failure is a starting symptom, not a root-cause diagnosis. Before reinstalling Horizon Agent or opening firewall ports, establish whether the failure occurs during authentication, desktop launch, or an established session. This documentation-based triage guide does not report a reproduced incident or a universal fix. Corrected September 12, 2026: The earlier guide suggested restarting the Windows RPC service and treated a local netstat listing as a test for blocked ports. Those instructions have been removed. A socket listing does not demonstrate end-to-end reachability. Classify the failure before making changes Observation First evidence to collect Avoid assuming Authentication never completes Exact login error, identity provider or broker event, timestamp That the display protocol is the failing component. Desktop selection succeeds, launch fails Assigned desktop, chosen protocol, Client/Agent and gateway logs That a successful HTTPS login proves the session path ...
Read more

Horizon Agent Unreachable: Registration and Desktop-Health Triage

Start an “Agent Unreachable” investigation by separating desktop health, Agent registration, and session traffic. Do not begin with a pool rebuild. This documentation-based triage guide helps decide which team should act and what evidence to preserve. Correction, September 12, 2026: The earlier guide mixed display ports with Agent communication, tested Blast against the Connection Server, and offered generic service restarts and image rebuilds. Those instructions have been replaced with path-specific investigation. First-response decision table Check Evidence Investigation owner Is the guest responsive? Approved console access, OS health, resource and disk observations Desktop/virtualization team if the OS is unavailable. Is this one desktop or a whole image family? Affected pool, image revision, Agent version, start time Image owner if failures align with a deployment. Does registration fail? Agent and Connection Server events for the same desktop and time Horizon team, then netw...
Read more

Horizon Protocol Error: Trace the Display-Session Handoff

A desktop can authenticate successfully and still fail to establish its display session. This guide investigates that handoff. Use it after identifying the actual console/client error, not as a claim that every “Protocol Error” means a firewall failure. Correction, September 12, 2026: The previous version combined a general checklist with an unverified incident narrative, conflated gateway and desktop port directions, and recommended blanket endpoint-security exclusions. Those instructions have been removed. This is a documentation-based diagnostic plan. Draw the attempted connection Record the selected protocol, assigned desktop, Client and Agent versions, gateway route, and attempt time. Distinguish a direct internal connection from an external UAG connection or a Connection Server tunnel. Use Omnissa's connection guide to identify where the failed handoff occurs. Stage Question Useful comparison Authentication Did the user receive desktop entitlement? Failed login versus ...
Read more