Forum Discussion

sadek's avatar
sadek
Level 2
14 years ago

How to delegate the backup and restore to local IT

Hi,

we are installing Backup Exec 2010 R2 in our remote sites, I need to delegate the backup and restore tasks to my local ITs.

they have a account with delegation in Our Active Directory2008  and Exchange 2007 environnements.

they are not part of the domain admin group.

 

how can give them just necessary permission to backup and restore on the server that are installed on their site ?

 

the service account used, is part of domain admin group and has a specific right that are mentionned in Quick Start Guide.

 

thank You

 

 

  • Hi,

     

    There is actually a way that you can use. BE ships with Backup Exec remote Console, which is a free installation x-number of times...ie: unlimited.

    What you can consider doing is installing this on the local IT staff workstations. When they open it up, it looks like BE (same icon etc).

    HOWEVER...this is where you can get selective...create a user account that is relevant to a specific site and give it backup operators permissions to a backup server on that site. From there they can do what they need too. However, it isn't too granular...so it's got to be a member of either the Power Users/Backup Operators/Local Admins group on that server.

    Read my article below for more information on this...

     

    https://www-secure.symantec.com/connect/articles/how-leverage-backup-execs-remote-console

    Thanks!

  • Hi,

     

    There is actually a way that you can use. BE ships with Backup Exec remote Console, which is a free installation x-number of times...ie: unlimited.

    What you can consider doing is installing this on the local IT staff workstations. When they open it up, it looks like BE (same icon etc).

    HOWEVER...this is where you can get selective...create a user account that is relevant to a specific site and give it backup operators permissions to a backup server on that site. From there they can do what they need too. However, it isn't too granular...so it's got to be a member of either the Power Users/Backup Operators/Local Admins group on that server.

    Read my article below for more information on this...

     

    https://www-secure.symantec.com/connect/articles/how-leverage-backup-execs-remote-console

    Thanks!

    • RedgeVinzel's avatar
      RedgeVinzel
      Level 1

      CraigV

      I would like to see the docs that you share.

      Could you gave me permission to view it?

       

  • There is no role based management present in Backup Exec.

  • The user can get into Administration console with the account under which Backup Exec services are running. For example, if there is a user X, whom you want should be able to access the Administration console, you can change the services logon credentials in windows services applet to use user X's credentials. User X will then be able to access the Administration console.

    However, local Administrative and Domain Administrative righst are recommended because, unless you have local admin rights on machine, you will not be able to backup or restore on local system and domain admin rights are needed to backup remote systems in a domain and run Backup Exec operations on Remote systems.

    The account designated for Backup Exec services - whether it is a new account or an existing user account - will be assigned the following rights, which helps in managing Backup Exec
    - Authenticate as any user and gain access to resources under any user identity.
    - Create a token object, which can then be used to access any local resources.
    - Log on as a service.
    - Administrative rights (provides complete and unrestricted rights to the computer).
    - Backup operator rights (provides rights to restore files and directories).
    - Manage auditing and security log.

     

    So Domain Admin / Admin privledges are a must