Application-Aware Processing access denied

[andreas2012]

Hi,

We have had a veeam service account that has been domain admin, and today we removed that account from the domain admin group, and then offcourse problems started... If we have a application aware processing enabled on the VM`s, do the veeam service account then need to be added to the local admin group on each VM ?

Thanks for reply.
Andreas

[Dima P.]

Hello Andreas,

Yes, account for application-aware processing required administrative access on the machine. Cheers!

[andreas2012]

Hi,

Ok, so what about backing up a domain controller, I guess I need to add the account to the Administrators group on the Domain controller as well?
If that's the case, I guess I could just leave the service account in the Domain Admin group ? Or am I missing something here ?

R
Andreas

[foggy]

Hi Andreas, to perform AAIP on a domain controller, an account that is a member of the built-in DOMAIN\Administrators group is required. Thanks!

[andreas2012]

Hi,

Ok I see. So AAIP is also recommended right to have a consistent backup, so that means a service account that veeam uses should be domain admin or how else would I be able to backup the domain controller consistent. I see that you also should add the user to local admin group on each server, but that would not be needed so long its added to the domain admin, and as long as i add it to domain\administrators it also have domiain admin cred... and can then login to the DC and create other accounts... right ? please advice.

/R
Andreas

[Mildur]

You can find the required permissions for "Application-Aware Processing" for each application here:

https://helpcenter.veeam.com/docs/backu ... =100#rptcb

[foggy]

Ok I see. So AAIP is also recommended right to have a consistent backup, so that means a service account that veeam uses should be domain admin or how else would I be able to backup the domain controller consistent. I see that you also should add the user to local admin group on each server, but that would not be needed so long its added to the domain admin, and as long as i add it to domain\administrators it also have domiain admin cred... and can then login to the DC and create other accounts... right ? please advice.

Right.