Comprehensive data protection for all workloads
Gostev
Chief Product Officer
Posts: 31460
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Gostev »

For Veeam console, Local Administrator is currently the requirement.
For Enterprise Manager, they can use a regular user.
JTT
Service Provider
Posts: 99
Liked: 2 times
Joined: Jan 02, 2017 7:31 am
Full Name: JTT
Contact:

Re: Veeam B&R console needs admin rights to start

Post by JTT »

Gostev wrote: May 01, 2020 3:23 pm As far as the feature request itself, we're now working on adding this capability to the next major release. Thanks!
So is this feature going to make it in V11 version or not?
It is even nonsense to request it, 4 years and still admin rights are needed. This is totally against every security best practice to give admin rights just for the console.
Gostev
Chief Product Officer
Posts: 31460
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Gostev » 1 person likes this post

Yes, good chances it will make it in v11. Thanks!
c.schulzejn
Enthusiast
Posts: 53
Liked: 3 times
Joined: Oct 24, 2018 8:22 am
Full Name: Christoph Schulze
Contact:

Re: Veeam B&R console needs admin rights to start

Post by c.schulzejn »

Seems like that topic/feature request could be marked as "solved" ;)
Gostev
Chief Product Officer
Posts: 31460
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Gostev » 1 person likes this post

To be mathematically correct, we will do that once v11 is GA :D
Seve CH
Enthusiast
Posts: 67
Liked: 29 times
Joined: May 09, 2016 2:34 pm
Full Name: JM Severino
Location: Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Seve CH »

Great news!

Does it mean that the user required by Enterprise Manager won't need any local admin rights on the Veeam Server? :-)

https://helpcenter.veeam.com/docs/backu ... ml?ver=100
"Provide a name and password of the user with administrative rights on the added server. The Veeam Backup Enterprise Manager user must be assigned the Veeam Backup Administrator role on the Veeam backup server. For more information see Veeam Backup & Replication Server Roles."
We have our Veeam Servers isolated and stand-alone, but providing a local admin account to Enterprise Manager (domain-joined) is the weakest spot in our architecture.

Regards
Gostev
Chief Product Officer
Posts: 31460
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Gostev »

Steve, no. This whole topic and everything said above is related strictly to the "fat" client only (Windows-based console). Thanks!
ChuckS42
Expert
Posts: 189
Liked: 27 times
Joined: Apr 24, 2013 8:53 pm
Full Name: Chuck Stevens
Location: Seattle, WA
Contact:

Re: Veeam B&R console needs admin rights to start

Post by ChuckS42 »

Did this get solved? Just installed the console (latest release) on a workstation and it's asking for elevation.
Veeaming since 2013
Gostev
Chief Product Officer
Posts: 31460
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Gostev »

Yes, it was in V11 (see the What's New document).
christian.naenny
Enthusiast
Posts: 38
Liked: 13 times
Joined: Apr 08, 2015 11:52 am
Full Name: Christian Naenny
Location: Zurich, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by christian.naenny »

Just to get this topic rolling again...
We just upgraded our Veeam Server to V11a and the Console on our Terminal Server also has been upgraded to V11a.
Now the console has become unusable again for all the users accessing the Console on Terminal Server Cluster without Local Admin rights, because the Console asks the users to update the plugins on a user by user basis!
Since we have a Terminal Server cluster with 3 nodes we would have to give all the Console users Local Admin rights on all the Terminal Server nodes for the installation to work. Not going to happen!
Why can't the console be installed to a completely usable state by an admin (installation) user? After it has been installed, I expect the console to work without Local Admin permissions for the users.
I fully understand that there is certain use cases where the console needs Local Admin permissions (e.g. for mounting files) but these use cases are 0.1% of all the users use cases!
wishr
Veteran
Posts: 3077
Liked: 453 times
Joined: Aug 07, 2018 3:11 pm
Full Name: Fedor Maslov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by wishr »

Hi Christian,

Could you please share a screenshot of the message your users are getting for our better understanding?

Thanks
ChuckS42
Expert
Posts: 189
Liked: 27 times
Joined: Apr 24, 2013 8:53 pm
Full Name: Chuck Stevens
Location: Seattle, WA
Contact:

Re: Veeam B&R console needs admin rights to start

Post by ChuckS42 »

Can confirm this happens when installing the console on a workstation as well.
Veeaming since 2013
Gostev
Chief Product Officer
Posts: 31460
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Gostev »

Looks like a bug with some plug-in. Does anyone have a support case open on this with the logs already uploaded?
Gostev
Chief Product Officer
Posts: 31460
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Gostev »

We could not reproduce this issue internally so are unable to move forward. So if anyone is actually interested in seeing this fixed, please share the support case ID for this issue. Live troubleshooting session may be required.
christian.naenny
Enthusiast
Posts: 38
Liked: 13 times
Joined: Apr 08, 2015 11:52 am
Full Name: Christian Naenny
Location: Zurich, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by christian.naenny »

The case number I had for this issue was Case # 05253335
christian.naenny
Enthusiast
Posts: 38
Liked: 13 times
Joined: Apr 08, 2015 11:52 am
Full Name: Christian Naenny
Location: Zurich, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by christian.naenny »

wishr wrote: Feb 10, 2022 9:30 am Hi Christian,
Could you please share a screenshot of the message your users are getting for our better understanding?
Thanks
How can I share a screenshot without using imgur.com or the like (to which I do not have access from within my corporate network)?
Gostev
Chief Product Officer
Posts: 31460
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Gostev »

No worries, I only needed a support case ID to pass to R&D.
christian.naenny
Enthusiast
Posts: 38
Liked: 13 times
Joined: Apr 08, 2015 11:52 am
Full Name: Christian Naenny
Location: Zurich, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by christian.naenny » 1 person likes this post

wishr wrote: Feb 10, 2022 9:30 am Hi Christian,
Could you please share a screenshot of the message your users are getting for our better understanding?
Thanks
Here you go:
Image

This is after upgrading the console on the terminal server. I"m expecting the console to work after the upgrade. This makes it look like the user has to upgrade the console.
wishr
Veteran
Posts: 3077
Liked: 453 times
Joined: Aug 07, 2018 3:11 pm
Full Name: Fedor Maslov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by wishr »

Hi Christian,

I've run through the case, the FR our TS engineers have created and the rest of the information. We've done a few tests and cannot confirm the described behavior.

Have you tried to launch the console at least once under a user with local administrator permissions after updating it? According to our QC team, after this, all users regardless of their permissions should be able to launch the console without any requests for elevation. A single launch with elevated permissions after upgrading is required for completing the installation of the updated console plugins. It's reasonable that this action should be carried out by the person performing the upgrade.

Thanks
christian.naenny
Enthusiast
Posts: 38
Liked: 13 times
Joined: Apr 08, 2015 11:52 am
Full Name: Christian Naenny
Location: Zurich, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by christian.naenny »

Hi Fedor,
Yes, we managed for the console to be usable in the past by starting it once by the (local admin) user who installed it. This usually did the trick and then the console was usable for the rest of the users without local admin.
But now (after the upgrade of Veeam B&R and the console to 11a) this is not enough anymore. The console asks every user to update the plugins on a user by user basis. This we cannot do as the useres are not supposed to have local admin rights on the terminal server where the console is installed to.
Regards, Christian
wishr
Veteran
Posts: 3077
Liked: 453 times
Joined: Aug 07, 2018 3:11 pm
Full Name: Fedor Maslov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by wishr »

Hi Christian,

This is not the expected behavior. What version you have upgraded from?

Thanks
christian.naenny
Enthusiast
Posts: 38
Liked: 13 times
Joined: Apr 08, 2015 11:52 am
Full Name: Christian Naenny
Location: Zurich, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by christian.naenny » 1 person likes this post

I upgraded from V11 (11.0.0.837) to V11a (11.0.1.1261 P20211211)
wishr
Veteran
Posts: 3077
Liked: 453 times
Joined: Aug 07, 2018 3:11 pm
Full Name: Fedor Maslov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by wishr »

Thank you.

Is the issue still present? If so, I'd ask our support management to reach you back and collect additional details because we cannot reproduce the issue and do not see any discrepancies in the code. Would this be possible?
christian.naenny
Enthusiast
Posts: 38
Liked: 13 times
Joined: Apr 08, 2015 11:52 am
Full Name: Christian Naenny
Location: Zurich, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by christian.naenny »

Well, since I opened the support case (#05253335) I have not changed the code either on the Veeam Server nor on the Terminal Server where the Console is installed to.
And no, it still does not work.
The server cluster the console was installed to consists of Windows Server 2016 Standard machines. No user (except the admins from the Win Server team and the technical user for Ivanti LAN Desk) has local admin privileges on this cluster.
Some background information: this is a HA RDP cluster spanned over 2 locations. Everyone is starting their applications on this cluster since this cluster is located in management network compartment. It's only possible to reach all the other machines in the network from this management compartment. I'm not able to connect to the Veeam Servers from my personal machine!
wishr
Veteran
Posts: 3077
Liked: 453 times
Joined: Aug 07, 2018 3:11 pm
Full Name: Fedor Maslov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by wishr » 1 person likes this post

I highly doubt the clustering aspect affects the console upgrade behavior in any way. I'll speak to our TS leadership and ask them to reach you back shortly to continue the investigation. Stay tuned.

Upd: turned out there was an issue with the permissions on the registry of the machine hosting VBR Console. For future readers: if you face somewhat similar, please reach out to our technical support team for investigation.

Thanks
tomatoschewps
Lurker
Posts: 2
Liked: 1 time
Joined: Oct 06, 2023 9:36 am
Contact:

Re: Veeam B&R console needs admin rights to start

Post by tomatoschewps »

Hi,

We are in the process of setting up the Veeam console on RDSH servers to access several Veeam B&R servers from a secure zone and thus block more direct access to the Veeam B&R servers, but we are faced with a problem of admin rights request when launching the consoles.

If we start up the console in admin mode to update plugins while connecting to a Veeam B&R "X" server, we won't have to worry about future connections to this server.
However, as soon as we try to connect to another Veeam B&R server (Y, Z, ...), we'll again be asked to update the plugins.

If we perform the update when connecting to server "Y", it's OK again as long as we only connect to server "Y". If we try to connect to server "X" or "Z", we get another update request.

Is there anything I can do to avoid this?

Thanks
tomatoschewps
Lurker
Posts: 2
Liked: 1 time
Joined: Oct 06, 2023 9:36 am
Contact:

Re: Veeam B&R console needs admin rights to start

Post by tomatoschewps » 1 person likes this post

Update :
All my B&R servers was up to date but one pulgin (GCP) on one of my B&R servers was't on the same version as others.
Plugin updated, problem gone ^^
Post Reply

Who is online

Users browsing this forum: BackupBytesTim, Bing [Bot] and 280 guests