A virtual machine may be discovered through a directory service or via an agent that is installed on the host operating system that is running the virtual machine. If the agent is installed on the virtual machine, the agent monitors changes to a set of protected volumes on the virtual machine. If the agent is installed on the host, the agent monitors changes to the protected volumes, which may contain one or more virtual servers on the host. Periodically, these changes from the host or the virtual server are sent to a data protection server. The data protection server updates its replicas of protected volumes with the sent changes. Versions of files on a data protection server corresponding to a volume of a virtual server may be restored to the virtual machine, to another machine, or may be viewed from the data protection server.