Veeam in Domain eller Workgroup

[Ultra_Cool]

Hello,

I have a question about veeam design. What is best practice to have: veeam in domain or in workgroup? i am planning to start from scratch and I want that my clients share Veeam server.
It should be 3-4 clients per server. What is the best way to achive this without a lot of administrative work?

best regards

[dellock6]

Hi, this is one of those never-ending debate, each solution has pros and cons. Just two of the best of them:
- Domain: you can better limit access to Veeam backups, since a backup administrator can read even files and data of all other users
- Workgroup: in a failover scenario, you can also loose active directory without having problems to run Veeam software. Otherwise, plan to offer high avaiability also to AD/DNS services so Veeam can start even during a disaster situation...

Luca.

[Ultra_Cool]

Hi Luca,

Thank you for your fast reply! I think that better solution is workgroup. So there is no best practice what veeam recommends to use?

[Vitaliy S.]

Luca has pinpointed all the pros and cons correctly. There is no best practice, however I would prefer Domain configuration still, as it's much easier to manage backup server permissions and control access to the backup server. As to the workgroup question, I bet you will backup your AD/DNS VMs anyway, right?

[Ultra_Cool]

Hi Vitaliy,

I want to backup 3-4 clients with one server because of that I think that is better to have it in workgroup or? I want that 3-4 client share one veeam server and not that every client have his own if it is possible?

[Vitaliy S.]

Yes, that's possible. Do you plan to give access to that backup server for your clients?

[Ultra_Cool]

I want to protect them with one server and skip to have one server for each client? No i dont want that they have access (if they not ask/or need) only that i can restore itel-level or full if it's needed from one place. If is in workgroup so i need to run certificate-based authentication or?

[Vitaliy S.]

In this case it doesn't matter whether you install Veeam B&R in a Workgroup or Domain environment, just specify the vCenter Server connection account in the backup console and that's it.

If is in workgroup so i need to run certificate-based authentication or?

No, you do not need that.

[Ultra_Cool]

Okej, thank you Vitaliy.

[trackstar]

Hello,

Curious what others have their Veeam Server as part of a domain or workgroup. Currently I have as workgroup but not sure if I will have any issue down the road.


TT

[foggy]

Generally, both ways are equally supported. However, the considerations given above should be taken into account when planning either this or that deployment.

[hoFFy]

I have to dig this old thread out....

I have a discussion with a few of my colleagues:

WHat if I install Veeam on a VM which is a member of the domain and the Veeam services run under domain\Administrator and in case of desaster all DCs (in smaller environments the only one dc) are unavailable and the only vm that would come up again is the veeam vm... is it possible to restore the DCs if Veeams service accounts can't authenticate against the domain? What would be the best way in those circumstances? Can I just change the user of the veeam services to local admin? What's about the database installed by Veeam during setup - can Veeam still authenticate there when I would change it to local admin?

[foggy]

Sebastian, yes, you can stop the services, change the account, give it corresponding rights on the database, and perform restore, given all the required resources including vCenter server and target storage are available (i.e. not added via the domain account).

Btw, if the Veeam B&R VM is available in case of DR, doesn't this mean that there's a DR host somewhere that could potentially host replicas of those DCs as well (or even secondary DC itself)?

[hoFFy]

Thanks Alexander!

Yes thats possible, but we often recycle old hosts by simply installing Win7 with Veeam on them, using the old local hard discs as a local repository and a new NAS as another repository. If there is an unused 2008 license its theoretically possible to install another DC... but best practices of Microsoft... leave the DC as a DC and don't install anything else on it. Otherwise we need another vSphere license to run a DC and Win 7 on the old host...
Especially in small environments its all about money and available licenses
But yes, our bigger customers use several hosts with more than one DC, so failure of one DC is not a kind of big trouble...

You said in case of DR I have to give the local admin account rights on the database.. but how can I authenticate in SQL Manager, when there is no logon server?

[foggy]

Well, you can assign rights beforehand. Or use SQL authentication instead. Also, using local SQL server installed as a part of Veeam B&R installation helps in this case.

[Anders]

Is there any functionality in Veeam that require it to be a domain member?

I'm thinking Veeam Explorers for AD/Exchange/Sharepoint/SQL ?
I know the enterprise manager's self service requires it, but if that is installed on a seperate domain-joined machine, it should not be a problem I guess?

[foggy]

Anders, as you can see from this thread, there're no specific requirements in this regard. Regarding Enterprise Manager, there's one point that you should keep in mind is that Exchange items restore from it is only available for mailboxes that belong to users from the same forest as EM itself, so if it does not belong to any domain, you will not be able to perform Exchange items restores.

[DizzzyD]

One question I do not see answered while working in a workgroup mode is:
Do Veeam Explorers for AD/Exchange/SQL/Oracle work?
(I assume trying to restore by Veeam Explorers Veeam will asks for domain credentials?)

[nielsengelen]

Veeam Explorers can work without a domain, they just open the specific backup dataset.