BE 10d - Must all users of BE have admin rights?

[GavinWhitehead]

I've been asked to do some work on an existing BE 10d system (10.1 Rev 5629 on Windows 2003 SP2). The offsite backup routine includes using the GUI to 'drag' the 'next' tape into 'Scratch Media' (and ejecting the current tape). Currently the only way to run the GUI (Symantec Backup Exec for Windows Servers) is with an account that has admin privileges. I would like to be able to carry out these simple tasks as a non-administrator, this makes many more people eligible to perform the offsite backup routine. I have created a Windows account ‘Backup Operator’ and made it a member of Domain Users. As administrator I have run the GUI and created a new BE account also called ‘Backup Operator’. I have given then two ‘Backup Operator’ accounts the same password. If I log in to the Windows server as ‘Backup Operator’ and run the GUI the ‘Connect to Media Server’ dialog appears. If I select ‘Backup Operator’ in the (BE) user name drop down and supply the password I get the error ‘Access is denied’. If I log on to the server as Administrator, run the GUI and from the menus select ‘Network -> Connect to Media Server’ then I can select ‘Backup Operator’ in the (BE) user name drop down, supply the password and log in successfully. So I believe that the BE account is set up correctly (and I’ve got the password right!). If I add admin privileges to the Windows account ‘Backup Operator’ then when I run the GUI the Logon Account Wizard appears. Now I can select the existing BE account ‘Backup Operator’ or create a new account and everything works (no access denied error). Is it really the case that my Windows account MUST have admin privileges before I can move a tape to Scratch Media? Gavin

[sksujeet]

The BE services are running under the account that has admin rights that is the reason.
The best way in your case is to install a administrator console on the remote server and you can access it without the admin rights and can put the tape in scratch media

[Colin_Weaver]

Kind of one issue hiding behind another here - typically the Servcie Account users and the selection list resource credentials should have admin rights - however it is possible for the consoel user to have less.

However your real problem is that your media overwrite Prortection settings are probably wrong as you should not have to move media to scratch to get jobs to be able to overwrite them.

If you get your media overwrite settings correct then the media will become overwriteable sometime in the day prior to the job starting and then the job will use it from the media set it is in, instead of you having to manually move it to scratch. Sort this out and one reason for needing someone to use the console is removed.

[GavinWhitehead]

Okay.  I think we are suffering from a naming problem here; my fault I'm new to BE. 

In my OP I used the term GUI and defined it as "(Symantec Backup Exec for Windows Servers)".  In both your replies you refer to "administrator console" and "console".

I've just dipped in to the "Symantec Backup Exec for Windows Servers - Administrator's Guide" and in Chapter 3 is a section called "Using the Administration Console".  There are pictures and they definatley show the tool I am using (previously refered to as the GUI; henceforth refered to as the admin colsole).
Okay.  I think we are suffering from a naming problem here; my fault I'm new to BE. 

In my OP I used the term GUI and defined it as "(Symantec Backup Exec for Windows Servers)".  In both your replies you refer to "administrator console" and "console".

I've just dipped in to the "Symantec Backup Exec for Windows Servers - Administrator's Guide" and in Chapter 3 is a section called "Using the Administration Console".  There are pictures and they definitely show the tool I am using (previously referred to as the GUI; henceforth referred to as the admin console).

So, all the actions described in the OP were done with the admin console on the Windows Server where the BE services are installed.  Therefore I have to disagree with sazz. My experience is that I must have admin privileges to access the system. 

Colin let me try and explain how the jobs are configured (this is all legacy stuff I have inherited).
We have a Media Set with 5 tapes (no robots).  The Media Set is configured with

• Overwrite protection - 20 days
• Append - forever

All our jobs are configured with "Append to media, overwrite if no appendable media".  This is because e have multiple jobs running each day.  By the end of the week there will be a tape in the drive that can be removed and taken offsite.

By the time Tape A is cycled back in to the tape drive more than twenty days have passed so the tape is overwritable.  Unfortunately the tape is also appendable.  If we put Tape A back in the drive without moving it to scratch first the jobs will just append to the tape (because the tape is appendable and the rule is "Append to media, overwrite if no appendable media").  If we continue like this the tapes become full and data is lost.
So instead we use the admin console to move the 'next' tape to Scratch Media which marks it as overwritable and ‘no appendable’.  Now the new job will overwrite the tape and subsequent jobs will append.
That’s why we need to use the admin console each week.  And the issue about admin rights is one of security and convenience.
 
Gavin

[Ken_Putnam · Accepted solution]

By the time Tape A is cycled back in to the tape drive more than twenty days have passed so the tape is overwritable.  Unfortunately the tape is also appendable.  If we put Tape A back in the drive without moving it to scratch first the jobs will just append to the tape (because the tape is appendable and the rule is "Append to media, overwrite if no appendable media").  If we continue like this the tapes become full and data is lost.

What you need to do is set the APPEND to 7 days, so all jobs in one week can append to the tape, but when it comes back from off-site 20 days later, the tape can only be overwritten

You job must also specify "Append, else Overwrite" rather than just "Append" in your job description

Together these two changes will let you overwrite on Mondays, and append Tues-Fri, with no intervention from you

[GavinWhitehead]

Ken,

Thanks for that.  We've just put this new configuration in place and it seems to do the job.  We will watch it carefully over the next feww weeks.

Thanks,

Gavin

[Ken_Putnam]

Forgot to add that the OPP should be 14 days, not 20 days.  This is because the OPP is reset each time that a backup set is closed.  So when it closes on Fri night/Sat morning with a 14 day OPP, it will be protected for the next two weeks, but available on the 3rd Monday