Failed to Add Veeam B&R Server

[Markus.K1985]

Hello,

I try to add my Veeam B&R Server 9.5 U3 Server to the DR Site. But I only get a "Wrong credentials" Error. I have connected from DR Server to this Veeam B&R Server via the Console successful.

Are only AD Accounts Supported for the Connection?

Best regards,
Markus

[Alec King]

Hello Markus,

Correct, an Active Directory account is required to deploy the VAO Agent to B&R.
VAO and B&R server should be in the same domain or have domain trust in place.

[Markus.K1985]

Thanks Alec.

The huge dependency to AD in a DR solution is limiting the use cases in my opinion...

[Alec King]

Hi Markus,

I don't really see use case where VAO customer does not have AD.
Also I don't see use case where VAO customer has lost their entire AD! Even after production site disaster, the DR site can still have DCs running.

Can you elaborate on the use cases you are talking about?

Thanks!

[Mark]

I thought best practise was to not have your Veeam infrastructure on the domain to protect all servers from compromise?

[Berniebgf]

Hello all,

Same "Solution Design" issue here, we have left our Veeam Management, Proxies, Repository servers isolated from the main networks and domain to protect our backups and recover-ability as much as possible. Deployed VAO onto the domain (no choice), and now cannot add our Veeam Management Server??

We're now considering creating a "Management Domain" on which we can place / isolate all of our VMware, Veeam infrastructure. However its a bit of effort to change!

Bernie.

[Alec King]

We currently have no plans to support non-AD deployment for VAO - so a 'Management Domain' would be the answer. Thanks!

[tmue]

That is a big issue for our planned deployments. The customer will not join their existing veeam backupservers to any domain. Why is there an option in the orchestrator deployment to add an non domain backup server when it is not working? I have the same error as the thread starter.
It is not about that there is no AD in DR site or no DCs after a disaster, no. It is the isolation of backups and backup copies that our customer is not willing to give up, what i can totally unterstand. Is there simply no way of deploying the VAO Agent on a non domain B&R server or is there maybe a manual procedure / will there be a procedure? Maybe I did not read everything, but I did not recognize that a domain join is necessary for EVERY Veeam server to use Orchestrator DR.

[haslund]

The is no requirement to domain-join any backup repositories so you can easily meet the customer requirements you have mentioned. Worst-case create a new domain and migrate the backup server into the domain and you are done.

[tmue]

Yeah, that's what i thought. But I have the same problem as the thread starter. I cannot install the VAO Agent on my non-domain B&R Servers. I always get the error "Wrong Credentials" too. And like it says in the previous posts in this thread, the VAO and B&R Server have to be in the same domain for agent deployment. Or is there any workaround?

[Alec King]

Hi Thomas,

It's not required that VAO server and Veeam Backup server(s) are in the same domain - only that a domain trust is in place.

Please note that our Veeam Best Practice documentation is being updated to reflect that keeping Veeam Backup server in a workgroup is not more secure (it provides some "security through obscurity", that's all). The documented best practice going forward will be that Veeam Backup server should be in a domain, however that can be a 'resource' domain, separate from the everyday user domain, containing critical infrastructure accounts and servers, and of course highly-secured.

[andrie]

Hi all,

it looks like nothing has changed. Most other Veeam products don't require a domain joined backup server, only the VAO.
Are there any plans to change that? If not, consider this as a feature request.

[Vitaliy S.]

Hi Andy,

Yes, currently, a domain-joined backup server is a requirement for VAO. Thanks for your FR!

[KLinville]

We've run into this issue doing a customer deployment of DR Orchestrator 4.0.

[Alec King]

We are currently developing the feature for adding non-domain VBR server to Orchestrator. Although I cannot promise exactly which delivery vehicle will be used, we will ship this capability in a future update.
Please keep the feedback and feature requests coming!

[Mildur]

The feature is now available with the new Release V 5.0. From the guide, it looks like you don‘t need a domain anymore.

VDRO - Requirements

Note: If you connect a standalone Veeam Backup & Replication server to the Orchestrator server, it must be joined to either the same domain, a trusted domain or a workgroup.

[Alec King]

Just to confirm, we did ship this feature - deploying VDRO agent to a non-domain VBR - in VDRO version 5 last week