Is it necessary to give NB Client Service as admin rights on SQL Agent?

[inn_kam]

i was reading  this

STATUS CODE 2: Microsoft SQL backups fail with a NetBackup Status Code 2 "none of the requested files were backed up"

Article:TECH31961

|

Created: 2004-01-05

|

Updated: 2013-10-23

|

Article URL http://www.symantec.com/docs/TECH31961

and this error most commonly occured 

My question 

1.is it necessary to give netbackup Client service as admin rights on SQL Agent?

2.If Yes,Do we have to give same user id and password as we give in NetBackup MS SQL GUI and SQL Server ,

(for eg. sa password .........  )

3.Do SQL backups from Netbackup will run on Local Account of Netbackup Client Service?

[Marianne · Accepted solution]

It all depends on SQL rights on a database.

See About SQL Server privileges and About setting the SQL Server logon for scheduled operations in NBU for SQL Admin guide:  http://www.symantec.com/docs/DOC5173

[Mark_Solutions · Accepted solution]

With later SQL versions you need to set both the NetBackup Client Service account and the NetBackup Legacy Network Service account to run as a user that has full SQL admin rights for it to work

Hope this helps

[inn_kam]

Thanks both, i have all my answers 

About SQL Server privileges

When you install SQL Server, you can elect to use either integrated security or

standard security. Integrated security refers to the usage of Windows

authentication in lieu of standard SQL Server-based logons.

Note: Microsoft recommends using integrated security. Windows logons, unlike

SQL Server-based logons, can be traced with standard Windows security tools.

NetBackup for SQL Server supports both integrated security and standard security

for any level of SQL Server.

If you select integrated security, then SQL Server ignores the user ID and password

that you provided in the SQL Server connection properties dialog box of the

NetBackup Database Extension GUI. Instead, use security validation to perform

backup and restore operations. Also use security validation for querying the

master database are based upon the SQL Server privileges that are granted to the

Windows account. The batch file user ID and password keywords are also ignored.

When integrated security is used SQL Server operations generated by NetBackup

for SQL Server are always validated against the Windows user ID.

If you select standard security, then you must supply NetBackup for SQL Server

with a SQL Server-based user ID and password. This user ID and encrypted

password are stored in the registry under the following key:

HKEY_CURRENT_USER\SOFTWARE\VERITAS\NETBACKUP\NetBackup for

Microsoft SQL Server\

To perform an operation with standard SQL Server security, NetBackup for SQL

Server looks up the SQL Server user ID and password from the registry.

Note: Since NetBackup for SQL Server does back up and restore commands and

issues select statements against the master database, review the SQL Server user

documentation to determine exactly what privileges are required by the user

accounts that you establish for NetBackup for SQL Server.

About setting the SQL Server logon for scheduled

operations

When using the NetBackup Database Extension GUI, SQL Server security is

satisfied. This is based upon either your current Windows account (if you use

integrated security) or a SQL Server-based user ID and password.

See “About SQL Server privileges” on page 46.

When the NetBackup scheduler is used, backup operations that are launched from

a daemon process called the NetBackup Client Service. You must ensure that the

Client Service has SQL Server privileges to perform backup and restore operations.

If you use integrated security, you must ensure that the NetBackup Client Service

specifies a Windows account that has been granted SQL Server administrative

privileges.

Note: If your site does not place any SQL Server security restrictions on the right

to back up databases then you do not need to authorize schedule operations or

configure standard SQL Server security.

[Mark_Solutions]

That is all great - but i have found when you come to actually do it that the legacy network services also needs to use that account - doesnt seem to get mentioned anywhere in the docs! - seems to be either a windows 2008 or SQL 2008 requirement (cant remember which now)

[inn_kam]

ok thanks Marks Solution

i have Win 2003 R2 32 BIT Server 

SQL 2008 R2 Agent

[Mark_Solutions]

OK - well being SQL 2008 you may need to do it for that - if it fails without it then set the legacy network service too to see if it resolves it

[inn_kam]

well i will check and will tell u tomorrow

[Marianne]

My whole idea behind referring you to the manual is that you should read it, show it to the SQL dba and then decide between the two of you if it is necessary to change NBU logon account and which account should be used.

My recommendation has always been to use the same service account as for SQL services.