Overview

Webyne Backup

Backup and recovery for your computers, servers and VMware virtual machines. Every backup is encrypted before it leaves the machine, kept for as long as your policy says, and can be restored as a few files, a whole machine, or a new virtual machine. This guide explains each screen and every step, in plain language.

How it fits together

The big picture

Everything happens in three steps: protect a machine, let it back up on schedule, and restore from a recovery point when you need to.

Words you will see

Start here

Signing in

Go to backupengine.webyne.com/login and enter your Work email and Password, then Sign in. Tick Keep me signed in on a computer only you use.

New to Webyne Backup?

1. Choose Create an account on the sign-in page and fill in your organisation, name, work email and a password of at least 12 characters with a letter and a number.
2. New organisations are reviewed before they are switched on — usually the same business day. You will see a “being reviewed” page meanwhile.
3. Want to start straight away? On that page choose a plan and pay; the account is active the moment the payment goes through.

A new account starts on the free trial: 100 GB of backup storage, 5 servers & PCs and 2 virtual machines.

Invited by a colleague?

Your administrator creates your user and sends you a link. Open it, choose a password under Set your password, and you are in. The link works once and expires after 7 days — ask for a new one if it has run out.

Start here

Two-factor authentication

Signing in needs only your password. But the actions that could destroy or expose data ask for a 6-digit code from an authenticator app as well: approving a restore, deleting recovery points, containing a ransomware attack, and creating a recovery token. Set it up on your first day, so it is ready when you need it in a hurry.

1. Click your name at the bottom of the left-hand menu. The Two-factor authentication page opens.
2. Choose Set up two-factor authentication.
3. Scan the QR code with Google Authenticator, Microsoft Authenticator, Authy, 1Password or any other authenticator app (or type the Setup key by hand).
4. Type the 6-digit Code from your app and choose Confirm and turn on.
5. Save the recovery codes it shows you — they are shown once. Each works once if you lose your phone.

Start here

Around the screen

The menu on the left is grouped by what you are doing. What you see depends on your role.

The bell at the top shows unread alerts; the icon at the far right signs you out.

Protect

Protection policies

A policy is the set of rules a machine is backed up by; you choose one as you add each machine. Your account comes with three ready to use — Files and folders – daily, Whole machine – daily and Virtual machines – daily, each running at 22:00 with the retention below. Use them as they are, change them with Edit, or make your own under Policies with the New policy form on the right.

The form walks through four steps — 1 What, 2 When, 3 Keep, 4 Advanced — with Next and Back, or click a step to jump to it.

Choose Create policy on the last step. To change one later, press Edit on its row and Save changes from any step.

Running a script before and after each backup

For example, dump a database before the backup, or stop a service and start it again afterwards. Needs agent 1.0.36 or later on the machine; VMware VMs backed up without an agent do not run scripts.

1. On the machine, as an administrator, put the script in C:\ProgramData\WebyneBackup\scripts (Windows) or /etc/webyne-backup/scripts (Linux). .ps1, .cmd, .bat, .exe and .sh are supported.
2. In the policy, step 4 Advanced, type its file name under Before or After — just the name, e.g. dump-database.ps1.
3. Choose what happens if the before-script fails: Skip the backup (then backups wait an hour and try again) or Back up anyway.

The after-script runs after every backup, failed or not, and is told the result in WEBYNE_BACKUP_RESULT (success or failed). The device page shows the last script run, and a failure raises an alert.

Protect

Add a Windows machine

Works on Windows 10 and later and Windows Server 2016 and later. It takes about five minutes per machine.

1. Create an enrollment token

1. Go to Devices and choose Add device.
2. In New enrollment token, give it a Label (e.g. Accounts PCs – October) and pick the policy under Assign policy on enrollment.
3. Set Device type (Desktop or Server). To add several machines with the same token, raise Max uses. Valid for (hours) is how long it can be used (72 hours by default).
4. Choose Create token. Copy the code that starts with wbe_ — it is shown only once.

2. Install the agent

1. On the same page, under Install the agent, download the Windows installer (x64 MSI) and copy it to the machine.
2. Run it as an administrator. Windows SmartScreen may warn that the publisher is unknown — choose More info, then Run anyway.
3. On the last page, keep Set up backup for this machine now ticked.
4. Paste the wbe_ code when it asks. For a Files and folders policy, choose whole drives or the folders to protect; for a Whole machine policy there is nothing to choose.

Within a few minutes the machine appears under Devices as Awaiting first backup. Its first backup runs at the policy’s next scheduled time — or start it now, see Your first backup.

Installing on many machines at once

The Add a device page also shows a silent install command, ready filled with your token, for Intune, SCCM or Group Policy. Run it from an elevated prompt. It looks like this:

msiexec /i WebyneBackupAgent-<version>.msi /qn ^
  SERVER=https://backupengine.webyne.com ^
  ENROLL_TOKEN=wbe_… ^
  PROTECTED_PATHS="C:\Users;D:\Data"

Separate folders with a semicolon. Leave out the PROTECTED_PATHS line for a whole-machine policy.

Protect

Linux and macOS

The agent backs up files and folders on Linux (Red Hat, Rocky and Alma 8+, Debian 11+, Ubuntu 20.04+) and macOS 11+. Whole-machine images are Windows only.

When an installer for your system is available, Devices › Add device shows a ready-to-paste install command for it under Install the agent, with your token already filled in — for Linux, a package install followed by:

sudo webyne-agent enroll \
  --server https://backupengine.webyne.com \
  --token wbe_… \
  --path /home --path /srv
sudo systemctl enable --now webyne-backup-agent

Protect

VMware virtual machines

Virtual machines on VMware vCenter or ESXi are backed up through the hypervisor: nothing is installed inside them, and each backup is a complete image of the VM.

1. Connect your vCenter or ESXi host

1. Go to Virtualization. In Register connection, choose VMware as the platform.
2. Fill in a Display name, the Endpoint (e.g. vcenter.example.com), a User name (e.g. administrator@vsphere.local, or root on a standalone host) and its Password.
3. Choose Register and discover. Your VMs appear under VM Inventory a moment later.

The account needs these vSphere permissions: Virtual machine › Snapshot management, Virtual machine › Provisioning › Allow read-only disk access and Allow virtual machine download, and Datastore › Browse datastore and Low level file operations.

2. Put VMs under a policy

1. Make a policy with Workload type set to Virtual machines (see Protection policies).
2. Open VM Inventory. In the Policy column of each VM, choose the policy — it saves at once.
3. The VM shows at risk until its first backup finishes, then protected. Use Back up now on its row to start straight away.

Machines that are switched on

ESXi will not hand over the disk of a VM that is running. Two ways round it — pick one per machine:

• A backup proxy (recommended for many VMs): a small Linux VM on the same host that reads a frozen copy of each disk. Set it up once per host under Virtualization › your connection › Backup proxies; the page walks you through it in about ten minutes (1 vCPU, 1 GB RAM, 8 GB disk, VMware Tools and nbdkit, a VMXNET3 network adapter, and TCP ports 10809–10899 open to it).
• The agent inside the VM, exactly as for a physical Windows machine. The VM then shows an Agent badge in the inventory — do not give it a VM policy as well, or it is backed up twice.

VMs that are switched off are backed up directly, with neither.

Back up

Your first backup

Once a machine has a policy, backups run by themselves at the policy’s time — you do not have to do anything. To take one now, for example straight after adding a machine:

A computer or server with the agent

1. Go to Devices and press Back Up Now on its row — or open the device and press Request Backup.
2. For a full disk image of a Windows machine, open the device and press Request Image instead. A first image reads every used byte on every disk, so it can take hours.
3. The agent picks the request up at its next check-in, within five minutes. Until then Backup Jobs shows it as Requested — waiting to check in.

A VMware virtual machine

1. In VM Inventory, press Back up now on its row — or open the VM and press Run full backup.
2. You are taken straight to the job, which shows its progress live.

Back up

Watching backup jobs

Backup Jobs lists every backup that is running or has run, with how much was read and sent, and how fast. The boxes at the top count what is running now and what succeeded or failed in the last 24 hours. Click a job to see each step.

A finished job’s Recovery point card shows its size, whether it was read back successfully, its lock, and a Restore from this point button. Cancel job stops a running backup; any snapshot is still cleaned up.

Back up

Am I protected?

Each machine shows a state. This is what each one means and what to do.

The Dashboard sums this up, and Reports lists every machine past its target under RPO risk.

Restore

Which restore do I need?

Start from what you have lost. Every route begins on the Restore page: choose the machine, then the recovery point.

Picking the recovery point

1. Go to Restore. Under Available Restore Points, choose the Workload type (Endpoints or Virtual machines) and the Device.
2. Pick a point from the list — usually the newest one taken before the problem started. What is in it shows its date, type and size.
3. Avoid points marked Suspect: they were taken after a possible ransomware attack. Points marked Locked are safe from deletion.
4. The How to recover this point panel then shows exactly the routes that work for that point, with the downloads you need.

Restore

Recovery tokens

The restore tool and the recovery media do not use your password. They use a recovery token: a key you create when you need it, which expires by itself. Make one before you start a restore.

1. Set up two-factor authentication first — tokens are only issued to accounts that have it.
2. Click your name at the bottom of the menu, then the API tokens tab.
3. Under Issue a token, describe it in What is it for (e.g. Rebuild the file server), choose Expires after (7 days is the default), and under What it may do choose Recovery.
4. Enter the Code from your authenticator and choose Issue token.
5. Copy it now — it is shown once. Paste it into the restore tool or the recovery media when they ask.

Restore

Restore files and folders

For machines backed up with a Files and folders policy.

1. Choose the device and recovery point on the Restore page (see above).
2. In How to recover this point, under The machine still starts Windows, download Webyne Backup Restore and install it on the PC you want the files on. It installs no service and backs nothing up — it only recovers.
3. Open it and paste your recovery token.
4. Pick the recovery point by its number (shown as # and a number on the Restore page), then choose where the files go.

From a command line

The same restore, for scripting or a server without a desktop. Run it from an elevated prompt; the Restore page fills in the point number for you under Or recover from a command line.

webyne-restore restore --restore-point 1234 --destination D:\Recovered --token <your-recovery-token>

On a machine that has the agent installed, the same command works as webyne-agent restore … — including on Linux, with a Linux path as the destination.

Restore

Files from a disk image

A whole machine backup holds every file too. You can take single files or folders out of it in your browser, without rebuilding anything. Works for Windows (NTFS) disks.

1. On the Restore page, choose the device and an image recovery point. The Files inside this image card appears below.
2. Pick the Volume (the drive) and press Read the file table. This takes a few seconds and is only needed once per point.
3. Browse the folders, or type a name in Find a file and press Search.
4. Press Download next to a file, or Download this folder as .zip.

Any file that could not be included is listed in _not-included.txt inside the zip.

Putting them straight back on the machine

For many files, the Or put these files back on the machine fold-out gives a command to run on the machine itself (agent 1.0.26 or later, elevated prompt). Choose Into a folder to start with — nothing already on the machine is touched. Back where they came from leaves any file that already exists alone and lists it at the end, unless you add --overwrite.

Restore

Rebuild a whole machine

When a Windows machine will not start, its disk has died or been wiped, or you are moving to new hardware. You need a whole machine (disk image) recovery point, a USB stick of at least 2 GB (or iDRAC/iLO virtual media for a server), and a network connection on that machine that can reach backupengine.webyne.com.

Before you start, on any working computer

1. Create a recovery token.
2. On the Restore page, choose the device and point. Under The machine will not start, download the Recovery media (an .iso file). It contains no backup data, so it is safe to keep on hand.
3. Write the .iso to the USB stick with a tool such as Rufus or balenaEtcher — or attach it as virtual media through iDRAC or iLO.

On the machine you are rebuilding

1. Start the machine from the USB stick or virtual media (use the boot menu key, usually F11, F12 or Esc). It starts on both UEFI and older BIOS machines.
2. Paste your recovery token, pick the recovery point by its number, and choose the disk to write to.
3. Wait for the restore to finish — its progress also shows on the Restore page. Then remove the media and restart.

Prefer a virtual disk you can inspect first? With the Restore tool you can also write the image to a .vhd file on a working PC (--target D:\recovered.vhd --repair-boot under Or recover from a command line).

Restore

Restore a virtual machine

Brings a VMware VM back as a new virtual machine on your host. The original is never overwritten.

1. Open the VM from VM Inventory and press Restore — or choose it on the Restore page with Workload type set to Virtual machines.
2. Pick the recovery point, then press Set up the VM restore →.
3. Choose the Host and Datastore. The datastore needs room for the full size of every disk.
4. Keep or change the Name for the rebuilt machine (it gets today’s date added). Tick Power it on when the disks are written only if the original is gone — two copies running at once can clash on the network.
5. Press Request this restore, then approve it with your two-factor code (Authorize and run). The new VM is built straight away.

Restore

Approvals and progress

The Restore page’s Request recovery → button records a restore request, which someone with the right role then approves with their two-factor code (Authorize and run). It keeps an audited record of who restored what.

• For a virtual machine, the approval is what starts the rebuild.
• For files and whole machines, the recovery itself runs on the target machine with the Restore tool or recovery media, as described above. The request is the approval record — your organisation may ask you to make one first.

Every restore in progress appears under Recent restores on the Restore page with a LIVE badge, a progress bar, the amount restored and the speed. It refreshes by itself.

Stay safe

Ransomware protection

Ransomware usually goes after backups first. Webyne Backup defends them in three ways: every recovery point is encrypted, it is retention-locked so it cannot simply be deleted, and the agent compares each backup with the one before to spot mass encryption or deletion.

When something suspicious is found

It appears under Ransomware as a threat event, with the signals that raised it and a score out of 100. At 70 or more it is contained automatically. You also get an alert.

1. Open the event from Ransomware › Threat events.
2. If it is real, press Contain (needs your two-factor code). The last clean recovery point is pinned and kept for 90 days, and points taken after it are marked Suspect.
3. Clean the machine, then restore from the pinned point with Recover from here under Clean recovery points.
4. If it was a false alarm — a big planned clean-up, say — press Mark false positive.

Stay safe

Alerts

Alerts collects everything that needs a person: failed backups, storage running out, payments and threats. The red number in the menu and the dot on the bell show how many are unread.

• Read the Critical ones first — filter by severity at the top.
• Each alert names the job, machine or event it is about; open that to see the detail.
• Press Mark read once dealt with, or Mark all read.

Stay safe

Retention lock and deleting

Old recovery points are removed automatically according to the policy’s retention — you never need to clean up by hand. A point shows Locked while its retention lock lasts.

• Deleting a recovery point is deliberately hard: open the device, press Delete on the point, type its number, give a reason and your two-factor code. Only an administrator can, and every deletion is recorded in the audit trail.
• The clean point pinned by an open ransomware event cannot be deleted at all until the event is resolved.
• Removing a machine (on its page, Remove this machine) keeps its recovery points unless you tick the box to delete them too — so you can still restore a machine you have retired.

Your account

Users and roles

Give each colleague their own user, with the smallest role that lets them do their job. Go to Users & Roles.

Adding a user

1. Under Add a user, enter their Full name, Work email and Role, and choose Create user.
2. Copy the invitation link it shows you and send it to them. It works once, for 7 days.
3. They open it, set their password, and sign in.

Administrators and restore operators must use two-factor authentication. To stop someone signing in, click their status to disable them; their past actions stay in the audit trail.

Your account

Storage and plan limits

Your plan sets three limits: backup storage, servers & PCs and virtual machines. Storage is what your backups actually take up after duplicates are removed and the data is compressed — usually far less than the size of the machines. Storage shows how much you use.

To carry on: upgrade the plan under Billing, or delete recovery points you no longer need. Backups resume within a minute or so of making room, and you get a “Backups have resumed” alert.

Storage locations

Backups normally go to your account's own storage. If you want some of them kept somewhere else — your own S3-compatible bucket, or an NFS export or SMB/Windows share our server can reach — ask us to add it as a storage location. It then appears under Storage → Storage locations with its status, and in each protection plan under Where to back up.

• Machines still back up to us as before; our server writes each plan's backups to its location. Restoring, browsing files inside images and verification work the same wherever a backup is kept.
• Moving a plan to another location makes the next backup of each machine a full one there. Earlier backups stay where they were and can still be restored.
• Storage you own usually does not count toward your plan's storage, so a full plan does not stop backups going there.
• We test every location each hour. If one stops answering you get a critical alert, and backups for plans using it fail until it is back.

Your account

Billing and invoices

Administrators see Billing in the menu. It shows your plan, how much of each limit you use, and every invoice.

Choosing a plan

1. Pick a plan. Prices are per month, plus GST.
2. Choose how to pay: Auto-pay monthly charges your card or UPI mandate every month until you cancel; or Pay in advance for 1, 3 or 12 months and renew when it ends.
3. Fill in Invoice to — add your GSTIN to claim input tax credit (its state must match the one you choose).
4. Choose Review and pay, check the amount including GST, and pay with Razorpay. Your plan applies the moment the payment is confirmed.

• Invoices: a GST invoice for every payment appears under Invoices; open it to print or save as PDF.
• Auto-pay: Cancel auto-pay stops future charges; the month already paid for runs to its end. To change plan while on auto-pay, choose the new plan — it takes over when the paid month ends, so you are never charged twice.
• Paying in advance: you are reminded a week before the end and again the day before.
• If a plan ends unpaid, the account goes back to trial limits after a short grace period. Nothing is deleted.

Help

Troubleshooting

A device shows Offline

The agent checks in every five minutes; after three hours of silence the device shows Offline. Check the machine is switched on and online. On Windows, open Services and make sure Webyne Backup Agent is running (it restarts itself after a crash). Backups and requests resume at its next check-in.

“Awaiting first backup” for a long time

The first backup waits for the policy’s scheduled time — for a daily 22:00 policy, that is tonight. Press Back Up Now to start it sooner.

“Enrollment token is not valid”

The token has expired, has been used up (Max uses), was revoked, or does not allow this operating system. Create a new one under Add device.

Windows warns that the installer is from an unknown publisher

The installer is not yet code-signed. Choose More info and Run anyway. To be sure the file is genuine, compare it with SHA256SUMS, linked on the Add device page.

“Imaging needs agent 1.0.11+”, or no Request Image button

That machine has an older agent, or is not Windows. Download the latest installer from Add device and run it on the machine; it upgrades in place.

Backups have stopped and a red banner says storage is full

Your plan’s storage is used up, so new backups are paused. See Storage and plan limits.

A running VMware VM is not being backed up

ESXi will not release the disk of a running VM. Set up a backup proxy for its host, or install the agent inside it — see VMware virtual machines.

A VM shows Unprotected although the agent is installed in it

VMs are matched to agents by their hardware ID (the SMBIOS UUID), not by name. It updates after the agent’s next check-in; if it does not, the agent may have been enrolled from a copy of another machine.

I cannot create a recovery token, or cannot approve a restore

Both need two-factor authentication set up on your account, and a role that allows it (see Users and roles).

A restored BIOS machine shows only a blinking cursor

Its boot code is missing — media older than 1.0.35 did not write it. Start the machine from the latest recovery media, press Alt+F2, sign in as root (no password) and run webyne-fix-mbr /dev/sda, then restart without the media. In vSphere, also check the VM’s firmware is set to BIOS, not EFI, if the original machine used BIOS. See Rebuild a whole machine.

Help

Getting help

Stuck, or in the middle of a recovery that is not going to plan? Ask your account administrator first — they can see your machines, jobs and alerts. Otherwise, contact us through the form on our website, telling us your organisation, the machine, and what you see on screen (a job or restore number helps).