Some Backup Exec 2010 R2 Questions

[LFCGeorge]

Hi people

I would just like to ask some questions mainly regarding security and hopefully someone can shed some light on these questions

1 - If I backup a folder and restore it to a different location on my Server do the NTFS/Share Permissions stay or do I have to redo them?

(Basically does Backup Exec backup NTFS/Share permissions?)

2 - If someone steals my backup tape can they plug it into another Server and restore the data using another copy of Backup Exec?

3 - If a standard domain user logs on my Server can they launch Backup Exec and restore the data or does it prompt them for login details?

4 - If I have a folder which denies the Administrator NTFS/Share permissions and the Owner tab is not Administrator can Backup Exec still back this folder up or will it give a denied error? Right now the account I use with Backup Exec to do it's jobs is the Administrator account

Thanks a lot guys!

[AmolB]

1) By default Permissions remain intact. No need redo permissions.

2) Unfortunately YES, to avaoid this you may encrypt backups.

3) Any admin account can access the console.

4) Not sure

[LFCGeorge]

Thanks for the prompt reply!!

I'm glad the NTFS Permissions stay and hopefully with question 4 I shall find out the answer tonight if my backup fails or not

[SuperBrain]

1 - If I backup a folder and restore it to a different location on my Server do the NTFS/Share Permissions stay or do I have to redo them?

(Basically does Backup Exec backup NTFS/Share permissions?)

This should answer your question --> http://www.symantec.com/docs/TECH74934.

2 - If someone steals my backup tape can they plug it into another Server and restore the data using another copy of Backup Exec?

They can if the backup did not have Encryption (hardware/software) enabled AND if they manage to successfully Catalog the tape.

3 - If a standard domain user logs on my Server can they launch Backup Exec and restore the data or does it prompt them for login details?

This is a restricted logon account (option in Logon Accounts manager)

Enables the Backup Exec logon account to be used only by the owner of the logon account and those who know the password. If this is not selected, the Backup Exec logon account will be a common account. Common accounts are shared accounts that can be accessed by all users. See About Backup Exec restricted logon accounts.

4 - If I have a folder which denies the Administrator NTFS/Share permissions and the Owner tab is not Administrator can Backup Exec still back this folder up or will it give a denied error?

Right now the account I use with Backup Exec to do it's jobs is the Administrator account.

It should return with Access Denied if you're using Admin account for backing up a folder which has Admin = deny.

[Kiran_Bandi]

If someone steals my backup tape can they plug it into another Server and restore the data using another copy of Backup Exec?

Now with BE 2012, restoring data from JUST tape is not possible. The Backup Exec installation must have the server from where the data was backedup added to it, to initiate the restore. So, this can be considered as an added advantage in the latest version.

[pkh]

This is not true.  When you catalog the tape, the server which the backups was taken from will be added to the list of servers and you can restore the backup data.

If what you said it true.  How can you restore data which is backed up from a defunct server?  See my article

https://www-secure.symantec.com/connect/articles/be-2012-restoring-data-defunct-server

Although the article uses disk backup sets, it is still applicable to tape backup sets.

[pkh]

It should return with Access Denied if you're using Admin account for backing up a folder which has Admin = deny.

I am not sure if this is true.  One of the attributes of the BESA account is that it is part of the backup operator group and this group has read access to everything.  That is why BE can backup everything even though it is not given explicit permission.

[Kiran_Bandi]

So, client will be automatically added once backup sets of that client are added to BE media server. Hence no problems in restoring.  

Thanks PKH....

[LFCGeorge]

My backup completed last night so the Administrator has Deny access to an NTFS Folder but it still backed up :) So pkh I like your explanation clears it up :)