Protected Users for AD Veeam Service Accounts

[Lukas-K]

Dear forum,

I'm quite sure to remember from the past that a domain service account that is used for Veeam guest processing (AAP / GFSI) must not be member of the AD Protected Users group.

Is it currently supported with v12 / v12.2? I cannot find the required information in the manuals, maybe you can help and give a feedback.

Hint: I know that gMSA can be used instead but I have many customers that are using AD tiering along with "classic" service accounts and these customers are the target of my idea.

Thanks in advance!

Best regards from Germany
Lukas

[PetrM]

Hi Lukas,

We quickly checked this scenario in our lab, and everything works fine. The accounts used for guest processing must have the following permissions:
1. Logon as a batch job granted
2. Deny logon as a batch job not set
3. Deny logon as a service not set

Thanks!