cancel
Showing results for 
Search instead for 
Did you mean: 

User permissions for remote console

F2Andy
Level 3

We have Backup Exec running on a Windows 2011 SBS server. Another employee usually swaps the drives, and I want him to be able to do limited trouble-shooting. To that end I have set up the console on his PC, so he can connect to the backup agent on the server and see what the job status is. However, to connect, the console requires a username and password (as well as the server name).

I can connect successfully using the admin account, but I do not want to give him the admin password, so I want to modify his user account so he can connect with that (or create a new account for this purpose).

So here is my question: What permissions does this user account need to be able to connect to the backup agent?

1 ACCEPTED SOLUTION

Accepted Solutions

F2Andy
Level 3

I eventually found this out.

The user needs to be a member of the Backup Operators group, which has to be done through Active Directory, not the SBS console.

View solution in original post

17 REPLIES 17

CraigV
Moderator
Moderator
Partner    VIP    Accredited

Hi Andy,

 

read my article on this...might assist you...







https://www-secure.symantec.com/connect/articles/backing-databases-and-files-same-tape-separate-jobs-using-backup-exec

Thanks!

F2Andy
Level 3

As far as I can see that is about the permissions the backup agent itself needs to do backups. I am talking about something different - connecting to the agent from a remote console.

VJware
Level 6
Employee Accredited Certified

I guess Craig inserted the incorrect link. Have a look @ this link authored by him as well - http://www.symantec.com/connect/articles/how-leverage-backup-execs-remote-console

F2Andy
Level 3

Ah, yes, that derscribes what I want. Unfortunately it just glosses over the detail I am looking for with "First off, a service account was created in Active Directory which had the necessary rights." What are the necessary rights?!?

pkh
Moderator
Moderator
   VIP    Certified
It might be easier to use the notification section of the job to send him the job status via email

CraigV
Moderator
Moderator
Partner    VIP    Accredited

...standard user account with NO AD admin rights.

Thanks!

CraigV
Moderator
Moderator
Partner    VIP    Accredited

Thanks very much for clearing up VJware...that was the link I was supposed to have posted!

Thanks!

F2Andy
Level 3

Just tried that and it does not work, the credentials are refused.

F2Andy
Level 3

I had already done that, but I want him to have some control, eg to be able to cancel a backup if necessary.

pkh
Moderator
Moderator
   VIP    Certified
In that case, he will need more authority than a ordinary user. However, since BE is never designed for role-based authorization. You will probably need to give him a lot more authority than you would like

F2Andy
Level 3

But no one knows what authority exactly?

If the console remembered the credentials, that would be fine.

I am really the first user to come across this problem? Surely there must be other companies that have a guy responsible for backups who is not also an admin on the server?

pkh
Moderator
Moderator
   VIP    Certified
Nope. You cannot run backups with BE unless you are a domain admin

F2Andy
Level 3

CraigV: ...standard user account with NO AD admin rights.

pkh: You cannot run backups with BE unless you are a domain admin

Great... Anyone else got an opinion?

CraigV
Moderator
Moderator
Partner    VIP    Accredited

...Backup Exec itself needs Domain Admin rights. The Remote Console does not. If a normal domain user account doesn't work (it did in my implementation for 20 sites), then look at placing that account in the Power Users group.

Thanks!

F2Andy
Level 3

I had hoped we were all clear we were not talking about Backup Exec itself.

This is a remote console on another computer. Remote console is ryunning on Windows 7, which has a power users group. It is connecting to a server running Windows Server 2011 SBS, as I said in the OP. Windows Server 2011 SBS does not have a power user group.

Are you suggesting I should make the user a member of the power user group on his own PC? I cannot see how that will help.

I am sorry if I am sounding a little testy, but we seem to be going round in circles here. I would have thought that those knowledgeable in the remote console would know this as it is vital to using it, and yet after several exchanges I am no closer to resolving this issue, and I am starting to lose confidence that I ever will.

CraigV
Moderator
Moderator
Partner    VIP    Accredited

...I think we pretty much know you were talking about setting up the BE Remote Console.

I set it up, I know it works, but I did so 6 years ago, so will have to revisit the environment I left.

Thanks!

F2Andy
Level 3

I eventually found this out.

The user needs to be a member of the Backup Operators group, which has to be done through Active Directory, not the SBS console.