Backup without local admin permissions

Question

Good day.Good afternoon.We tested the backup of domain servers using an agent for Windows and encountered a problem. An account that belongs to the local administrators group on the corresponding servers is required for backup. Backup Exec checks not only the rights of the account, but also its belonging to the group. That is, if we grant all the possible rights (using Group Policy) to the account we are using, but do not include it to local administrators group, the tasks will not work.The question is: is it possible to bypass the verification of the account belonging to the group of local administrators, and check only the presence of the required rights?Backup Exec 20.2, Windows Server 2016Error in log is:Tuesday, September 18, 2018 7:48:30 PM - V-79-57344-39795 - The logon account that was provided is not a member of the Administrators group. Verify that the data that you selected was backed up. Additional privileges may be required to access the data on the Windows computer

pkh · Answer

You need to a domain admin id to to your backup.&nbsp; So why do you want to exclude the domain admin from the local admin group?

kshmakov · Answer

We conducted tests for the customer with a very strict information security policy. Accordingly, it is not possible to use credentials from groups such as backup operators, local administrators, domain administrators and enterprise administrators for backup, and it is also impossible to store such credentials outside domain controllers.

pkh · Answer

So what credentials/rights can you assign to the BESA?

kshmakov · Answer

Ideally, we should use an account with minimal rights, like a domain user or a local user. We can use rights such as Backup files and directories and Restore files and directories. But the including this account to the local administrators group is not allowed. Because the Windows agent can work from the local system credentials, the need to use the administrative account looks unreasonable.

colin_weaver · Answer

If you search our (english) admin guide for "Local Admin" you will find a few references that state that accounts should have have local admin permissions, and, for things like domain controllers this gets increased to domain admin rights.
The problem with groups, like Backup Operators is that Microsoft created the concept of that security group well before lots of the newer technologies now present in the Windows Operating System existed in their current form (things such as VSS, DFSR, etc). Unfortunately for whatever reason development of how those security groups could be used did not keep up with the new technologies hence they no longer provide suitable functionality for a number of backup scenarios. ( Oddly enough Vmware have a similar issue where there sample backup role of ' VMware Consolidated Backup user (sample) ' role, also does not have enough permissions for all backup and restore processes. Maybe that is why they called the role a Sample&nbsp; ;)&nbsp;&nbsp; )
Whilst theoretically possible to create a custom group with enough permissions and suitable group policies configured, the documentation and ongoing adminstration of such a group and policies (covering future OS + Application changes as well)&nbsp; would be costly, in man-hours (for both server admins AND backup software developers) and would also introduce much bigger chances of human error causing problems, which then may only be identified when you are trying to restore after a disaster (not a good scenario at all). Which I suspect is part of the reason why we have a warning message stating you should be local admins.
&nbsp;Of course the message does not state the backup has not completed, it just puts the onus on you to check that it has worked, in effect defining what you are doing as an Alternative Configuration (see our compatibility documents for the definition of this term) meaning we would only be providing reasonable efforts support if you then have problems. As an aside we typically do not allow warning messages like this to be disabled even if you do your own backup and (more importantly) restore testing and decide that your backups are working with reduced security. We obviously only officially test with what we have documented as being required.
&nbsp;
&nbsp;
&nbsp;

Forum Discussion

Backup without local admin permissions

Related Content

modify security permission

5230 unable to elevate permissions

Permission denied with NDMP Backup and NETAPP 9.1

Re: 7.6.0.3 Aix client exclude not working

Re: Full backup failed

Recent Discussions

Hyper-V VMs get hosed after backup

Cannot mount the windows PE image (SDR creation)

Updating BE to ver 24-Firewall white list

Duplicate existing backup set to tape automation.

Backup exec 15