Restricting User Access to Restore/Backup Files

[David_Jennings]

Is there a way to restrict a user who has access to a server from running BE and backing up and/or restoring data? The server the software runs on must be accessible to everyone, however who has access to BE needs to be restricted. Other than changing the permissions on the .exe file is there anything that can be done? I've changed the System Logon Account to be restricted, just not sure that is enough as in the past veritas has allowed new users to create their own logons.

[Ken_Putnam]

Limit access to the Executable (or to the entire BackupExec install directory) to Admins/Domain Admins

(if you can't trust your Admin group, you've got some real problems ;) )

[Keith_Langmead]

Agree with Ken about being able to trust your admin groups. :)

One other possibility depending on the amount of access you want to give may be to make use of the Backup Operators group. I haven't used it myself so can't be certain about it, but I seem to remember reading ages ago that the permissions of the group are such that while members can perform backups of data, they cannot restore the data afterwards. If your concern is unauthorised users being able to gain access to secure data by running a restore job then that should do the trick for you while still allowing them to perform any required backups.

[David_Jennings]

Agreed about trusting Domain Admins. Will make changes as appropriate tonight.

[David_Jennings]

I'll look into the backup operators group as suggested and test as appropriate.

I trust everyone in our Domain Admins group to perform jobs as appropriate and follow up w/ them if a problem ensues. I also know I can count on the fact that the appropriate documentation will be made if/when a restore is requested and carried through. It's more of a too many hands in the cookie jar thing I suppose since some people have attempted to run restores during the day which never complete and cause the nightly backup to not run that night. I'm just trying to avoid that from happening again.

[Ken_Putnam]

one other thought,

use ExecView.

Depending in what groups a specific user is in and what access the groups have to the BackupExec install folder, they can can have either just monitor jobs, or release/monitor jobs and respond to alerts. You cannot create jobs or media set, label tapes or do any of the other BackupAdmin tasks like Remote Admin will