Enterprise Manager - Privileges for restoring SQL Backups

[HansMeiser]

Hello,

we use current Version of Veeam11 for a bunch of VM and SQL Backups. Now we try to provide EnterpriseManager for our persons who are responsible for single applications, so they are able to restore a sql database on there own without help of Veeam-admins.
Basically they have privileges on sql server to backup and restore databases (sql management studio) and have a bunch of functions for all kinds of serviceworks, but they dont have the sysadmin-privileg.
Unfortunately Veeam Enterprise Manager denies restoring a database with message "sysadmin privileges needed" when sql userdata are entered.
Why enterprise manager requires sysadmin privileges for used sql-user to restore a single database? I dont find any setting to adjust this.
If sysadmin privilege for the single sql-user really is a requirement then enterprise manager is useless for us.

Thanks,
Hans

[Andreas Neufert]

We are mounting data and installing/uninstalling our transport agents as our processing is agentless and there is no software by design on the system. (VM backup I assume)

[HansMeiser]

Hello,

yes, but i assume that this only affects the side on backuphost itself, collecting needed data etc. This works for my portal users. But for my understanding used sql-user should be db_owner/db_backupoperator but sysadmin seems to much.
If every SQL User who uses the enterprisemanager should be a sysadmin, then i dont need the enterprise manager. In this case i can restore the regular way by using B&R Console.
So it is not possible to establish a kind of selfservice for db-owners.

Thanks,
Hans

[PetrM]

Hello,

The account used for restore must have the sysadmin role on the target server. It is mentioned on this page of our help center:

The account being used must be a member of the Local Administrator group and must be granted the sysadmin role on a target Microsoft SQL Server. For more information about Microsoft SQL Server roles, see this Microsoft article.

Enterprise Manager acts as a single management point whereas actual restore is performed by Veeam Explorer for Microsoft SQL itself. Let us consider your question as as a feature request for future releases, we'll think about implementation if we have enough similar requests.

Thanks!

[Andreas Neufert]

sysadmin is a requirement as we are using some of the operations that need sysadmin requirements at restore.
For example: https://docs.microsoft.com/en-us/sql/t- ... rver-ver16
Needed for UNC path processing at restore.

[HansMeiser]

Hello,

thanks for your answers.
sysadmin privileges contradicts a "self service" for db owner. Everybody is sysadmin is not corresponding with best practices for IT security.
i dont think not every sql-code/backup needs sysadmin privileges, because a typical db restore works with roles owner/backupoerator/priv: create any database etc.
instead of strictly requiring sysadmin privileges for all cases i would suggest to use given sql-user and react to return code/message of sql server and show some hints in case the restore was not succesful.

Thanks,
Hans

[Andreas Neufert]

I agree, tasked the team to research.

[HansMeiser]

Hello,

thanks, may be we have this feature in future releases.

Thanks,
Hans