We've gone through a process of removing all our site reps from the Domain Administrators group. The main issue for this was a security requirement to not allow them to have too much power. No sense in having them break anything on our servers to test our DR recovery capabilities.
The big question then was what to do in order to get the site reps to check their site server backups without having them log onto the server. Enter Backup Exec's Remote Console.
This allowed us to have the site rep log onto their Backup Exec server instance without logging onto the server directly. They were then able to do what they needed to do in order to check backups, respond to any issues, and as a result, log calls based on that. That would mean they would also have rely on logging onto their instance, instead of waiting for job logs, meaning faster responses.
The Backup Exec Remote Console was set up to run off their laptop/desktop using a universal service account. Doing this meant management of 1 account that would be granted the necessary rights to the server and each instance of BEWS, instead of multiple accounts.
First off, a service account was created in Active Directory which had the necessary rights. Once done, this service account was added as a user on each Backup Exec server.
From there, the site reps were directed to install the Remote Console on their respective workstations as follows:
1. Browse to the installation directory, and launch Browser.exe from the installation location for the site (already pre-populated and shared for them) and click Next.
2. Choose "Start the Backup Exec Installation", and click Next.
3. Click Next, accept the License Agreement, and click Next again.
4. At the Symantec Backup Exec for Windows Servers Install Menu, make sure Local Install is selected, and Install Remote Administration Console Only will be the only option available under that. Click Next.
5. Leave the Destination Folder as is for the installation path, and click Next.
6. Choose Install.
7. Click Finish after deselecting the other options when the installation completes.
Not many people either know about this functionality, or use it. It has the major security advantage of not having direct logons onto your server which could open up all sorts of issues if someone pushes the incorrect button for example.
The interface is exactly the same as Backup Exec's, so there is no extra learning curve needed, and it has the same functionality as if you logged directly onto the server first.
It is a really great part of Backup Exec, which makes life a lot easier when managing your server. Furthermore, if you don't have the license for CASO, you can use this Remote Console to log onto any Backup Exec servers in your environment.
Administration just got easier...
