Have a look at these 2 TechNotes regarding permissions for VM backups and restores:
http://www.symantec.com/docs/TECH130493
http://www.symantec.com/docs/TECH128513
In a secure environment, the ‘minimum’ requirements will probably not be sufficient.
The following extract from the 1st TN says that :
"These are the minimum required permissions that has been found to be sufficient in the tests performed by Symantec for a basic vSphere environment. This is not a complete list. Additional privileges might be required if advanced features are in use. "
(notice the words ‘test’ and ‘basic vSphere environment’)
The second TN has the following recommendation:
"During restores, NetBackup can be instructed to provision the virtual machine anywhere in the vSphere cloud. NetBackup also provides options to handle the existing machine (whether to overwrite the original machine, reuse it UUID etc.). Hence the minimum permissions to provision the restored virtual machine anywhere in the vSphere could would be almost close to built-in Administrator role. Symantec recommends cloning the Administrator role and removing permissions related to operations that NetBackup should not perform based on business and security requirements."
IMHO, the VMware Admins should play a leading role in determining these permissions, as each environment is unique with unique security limitations.
Also have a look at the Recommendations under Option 1 and Option 2 in the 2nd TechNote and see if the VM Admins are agreeable to be closer involved when restores are needed - similar to Database Administrators (SQL, Oracle, DB2) involvement when database restores need to be done.
