Console Connection

[Cliffyb]

Hi,

I have manage to install the management console for BE 2010 on an XP machine, but when I try and connect to the server using a normal user account I get the message that "Access is denied". If I give that user admin rights on the server, or domain admin rights, it works fine. Now, with earlier versions of Backup Exec, the users didn't need to have admin rights to check on backup jobs etc, and to be honest I am VERY reluctant to give them that level of access. Is there any way around this?

Thanks.

[AmolB]

Refer to http://www.symantec.com/docs/TECH48455

[Cliffyb]

Hi,

This refers to "The logon account for the Backup Exec Remote Admin Console fails to access the resources across domains", whereas this is in the same domain. I think that artical refers to an older version of BE as well as the screen shots and info within them are different.  

Any other thoughts?

[AmolB]

Sorry for the above article, My bad 

Try adding the non admin account in the "Backup Operators" group

[Cliffyb]

Hi,

The user is already in the Backup Operators group. I have found an article which gives me a list of rights the user needs to have (almost Admin by the look of it) to run the console. I will give it a go tomorrow.

Thanks for your replies.

[AmolB]

Hope the list you found includes the below policies.

• Act as a part of Operating System ( Only for windows server 2000 )
• Create a token object
• Log on as a service
• Logon as a batch job
• Manage auditing and security log
• Backup files and directories
• Restore files and directories

[ArulPrasad]

Create logon account for the user who tries to login to the console and check

[CraigV]

Hi Cliffy,

You might want to read the article I wrote below on how to use the BE Remote Console. I've implemtned this to allow site reps to check their backup servers without needing admin rights...

https://www-secure.symantec.com/connect/articles/how-leverage-backup-execs-remote-console

THanks!

[Cliffyb]

Hi,

I created a new backup account and by using the "local security policy" editor, assigned it the following rights -

Create a token object

Log on as a service

Logon as a batch job

Manage auditing and security log

Backup files and directories

Restore files and directories 

 

I had already installed the console on a client PC, and used the backup account to try and log on. UnfortunatelyI got the same "Access is denied" message.

 

Anything else I can try?

 

Thanks for your help so far!

 

 

 

 

[Cliffyb]

Just a checking, is it OK to run the BE services on the server with the Administrator account, and connect from the console on a remote machine using a different account, with the rights listed in the TECH70860 article? 

Thanks.

[CraigV]

Yes, that's quite possible!

[Cliffyb]

Mmm?? Then I really don't understand why it's not working?? Have just tried to connect agani and I stil get the "Access is denied" box coming up. What would be the next thing to try?? Are there any logs I can run through? Reinstall the console? I guess I could just give them an admin account if there aren't any other options.

Thanks.

[CraigV]

...try adding the user to the local server's Power Users group...

[Cliffyb]

Hi,

OK, I checked the Backup Operators group (the domain group) and the account was in it. I looked on in the local Backup Operators group on the BE Server and the account wasn't in it??? Mmm, I thought if a user was put in the builtin domain group they would be a member of the builtin local group... Don't know if this is a quirk due to a Win2k Domain Controller and a 2008 Member Server? Anyway, I put the backup account in the local Backup Operators group and it started working.

Thanks for all your help and suggestions, wouldn't have got to a solution without it!! 

[CraigV · Accepted solution]

Nope, a domain group is not necessarily made an automatic member of a local group...its got nothing to do with what OS your DC is running.

Glad you got it working, which means you can close this off now =)