[Request for improvement] Remove access check during adding SMB share

[milosk]

Hello,

we are testing NAS capability of Veeam. For backup/restore we use service account added to Backup Operators group on CIFS server (overriding permissions during backup/restore operations) which means that this service account doesn't need to have NTFS permissions on each file/folder on share. But when adding SMB share, Veeam is checking access of our service account and if it doesn't have NTFS permission at least on highest level of share, it will end up with access denied message.

I did a test: once SMB share was added to Veeam (service account had access), I removed service account access to share. And backup/restore worked as it should.

So question is, is it really necessary to check accessibility during adding SMB share? Removal of such check would save a lot of work with changing permissions on shares.

Thanks.

[HannesK]

Hello,
"really necessary" is hard to answer... if we would remove that check, we would probably get several thousand more support cases where our support would have to investigate why things went wrong. Even if the job logs say "permission denied", these are things users hardly read, compared to an error that stops them from adding a share with missing permissions.

Best regards,
Hannes

[milosk]

Hi Hannes,

thank you for response. OK, lets imagine that account used for backup will have partial access to share but is not added to Backup Operators group on CIFS server. Adding of SMB share will pass, but then backup will fail .

Veeam documentation itself says to add backup account to Backup Operators group:

"To correctly back up SACL (Ownership) files and folders from the SMB file share and restore them:

1. When you are specifying access settings for the SMB file share, select the This share requires access credentials check box.

2. Make sure that the account you use to access the file share is either added to the Backup Operators group or has the SeBackupPrivilege and SeRestorePrivilege privileges in Windows Server on the file share."

That's why I do not see reason for access check during adding SMB share. Or keep that check, but give us at least option to "Add share anyway" for users who know what they are doing .

Thanks.
Milos

[Dima P.]

Hello Milos,

We will discuss this idea with RnD folks. Thank you for sharing your feedback!

[milosk]

Thank you Dima.