File-level backup from NAS, file shares and file servers
Post Reply
milosk
Novice
Posts: 5
Liked: never
Joined: May 03, 2022 10:39 am
Contact:

[Request for improvement] Remove access check during adding SMB share

Post by milosk »

Hello,

we are testing NAS capability of Veeam. For backup/restore we use service account added to Backup Operators group on CIFS server (overriding permissions during backup/restore operations) which means that this service account doesn't need to have NTFS permissions on each file/folder on share. But when adding SMB share, Veeam is checking access of our service account and if it doesn't have NTFS permission at least on highest level of share, it will end up with access denied message.

I did a test: once SMB share was added to Veeam (service account had access), I removed service account access to share. And backup/restore worked as it should.

So question is, is it really necessary to check accessibility during adding SMB share? Removal of such check would save a lot of work with changing permissions on shares.

Thanks.

HannesK
Veeam Software
Posts: 11005
Liked: 2089 times
Joined: Sep 01, 2014 11:46 am
Full Name: Hannes Kasparick
Location: Austria
Contact:

Re: [Request for improvement] Remove access check during adding SMB share

Post by HannesK »

Hello,
"really necessary" is hard to answer... if we would remove that check, we would probably get several thousand more support cases where our support would have to investigate why things went wrong. Even if the job logs say "permission denied", these are things users hardly read, compared to an error that stops them from adding a share with missing permissions.

Best regards,
Hannes

milosk
Novice
Posts: 5
Liked: never
Joined: May 03, 2022 10:39 am
Contact:

Re: [Request for improvement] Remove access check during adding SMB share

Post by milosk »

Hi Hannes,

thank you for response. OK, lets imagine that account used for backup will have partial access to share but is not added to Backup Operators group on CIFS server. Adding of SMB share will pass, but then backup will fail :).

Veeam documentation itself says to add backup account to Backup Operators group:

"To correctly back up SACL (Ownership) files and folders from the SMB file share and restore them:

1. When you are specifying access settings for the SMB file share, select the This share requires access credentials check box.

2. Make sure that the account you use to access the file share is either added to the Backup Operators group or has the SeBackupPrivilege and SeRestorePrivilege privileges in Windows Server on the file share."

That's why I do not see reason for access check during adding SMB share. Or keep that check, but give us at least option to "Add share anyway" for users who know what they are doing :).

Thanks.
Milos

Dima P.
Product Manager
Posts: 13485
Liked: 1314 times
Joined: Feb 04, 2013 2:07 pm
Full Name: Dmitry Popov
Location: Prague
Contact:

Re: [Request for improvement] Remove access check during adding SMB share

Post by Dima P. »

Hello Milos,

We will discuss this idea with RnD folks. Thank you for sharing your feedback!

milosk
Novice
Posts: 5
Liked: never
Joined: May 03, 2022 10:39 am
Contact:

Re: [Request for improvement] Remove access check during adding SMB share

Post by milosk »

Thank you Dima.

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests