Service Account BE 2010 R3 for SBS2011 (Literally -> DOMAIN\Administrator only?)

[Arian_van_der_P]

Hello,

I'm posting a question regarding the advised serviceaccount when installing Backup Exec 2010 R3 on a SBS 2011 server

http://www.symantec.com/business/support/index?page=content&id=HOWTO22515
Due to security implementations in Microsoft Small Business Server, the service account must be Administrator.

http://www.symantec.com/business/support/index?page=content&id=TECH23689
Note:  Due to security implementations in Microsoft Small Business Server, the service account must be Administrator.

http://www.symantec.com/business/support/index?page=content&id=TECH36718
Due to security implementations in Microsoft Small Business Server, the service account must be Domain\Administrator account. (-> why here Domain included? Typo Symantec?)

and an earlier discussion:
https://www-secure.symantec.com/connect/forums/services-account-sbs

Main question is:
-Do you really need the (disabled by default) DOMAIN\Administrator account when using Backup Exec 2010 R2 on a SBS 2011 server?
Or is it just the interpretation for the word Administrator (to be an administrator or THE Administrator itself).
Only TECH36718 mentions something like DOMAIN\Administrator.... the others including the manual do not.

And what are the issues if you do happen to use a dedicated serviceaccount for BE 2010R3 on SBS2011? Not supported?

Regards,

Arian van der Pijl
 

/edit
This requirement is 'left out' of this comprehensive serviceaccountrights document:
http://www.symantec.com/docs/TECH130255

[Colin_Weaver]

On a Domain Controller (which an SBS server is) if you do not have Full Domain Admin permissions then VSS cannot correctly access the System State so you will NOT be able to backup your Active Directory.

This is only one of a number of operating system components that Backup Operator or Domain User accounts can not backup - hence yes you do need admin - and yes it does apply to 2011 as well.

[Arian_van_der_P]

Colin, thanks for the fast answer but I might not be specific enough:

The install guide and KB articles states that you need the Administrator account. Literally.
At least, that's how I interpreted those articles.

Therefore my question remains:
Do you really need the Administrator account or does an Administrator equivalent account suffice?. Thats the main question :)
So Full Domain Admin permissions can also be obtained with another ServiceAccount but again, the documentation states otherwise (SBS must use the Administrator account).

Thanks!



 

[Colin_Weaver]

Hmm if it wasn't an SBS server than definietly it could be any account that is a member of Domain Admins.

SBS would certainly mean any Account that is a member of Domain Admins, plus Exchange Organization Admins, Plus Sharepoint Security role admins (sorry not sure of exact name of this) and because SBS sometime has default AD Policies that are more restrictive than a standard server, it might be that the easiest security to define is the original Admin account. Unfortanately I am not sure of the specific answer to this query.

[Arian_van_der_P]

Colin,

Thanks again. I was hoping on a final answer but it leaves an open door to not using the administrator account itself :).
regards,

Arian!