Login permissions to backup domain controller

[Rob_Nicholson]

We've created a Domain\BackupExec account which doesn't have any special domain permissions. We've then been adding this account to the local Administrators group on servers we want to backup. This means that BackupExec doesn't need domain admin rights so is much more secure.

However, we want to now backup a domain controller where there is no local administrators group. How do you do this? We're loathe to grant BackupExec domain admin rights just for this requirement.

Thanks, Rob.

[Hywel_Mallett · Accepted solution]

---

@Rob Nicholson wrote:

We're loathe to grant BackupExec domain admin rights just for this requirement.

---

Me too, but as far as I'm aware, that's the way it's got to be done.

Theoretically it should be possible to apply a local policy to assign all the rights needed to a normal user account, but I don't think I've ever seen those required rights documented anywhere.

[Rob_Nicholson]

I guess this one of the things to go on that "big list" of "When I get around to re-inventing operating systems" :) Implementing a mechanism of allowing backups to run without compromising the security by having to use domain admin rights all over the place.

Cheers, Rob.