AD Backup - Managed Service Accounts

[HansMeiser]

Veeam 12.2

Hello,

we use Veeam to do backups of our DomaincontrollIers.
I browsed different backups and i noticed that i miss our Managed Service Acccounts in the backup structure. I see everything else like users, groups, gpos, computers but no MSA.
The job itself works with application aware processing.
I dont see any possibility to configure object types of AD Backup.
Are MSA excluded from backup or how to enable it?

Thank you,
Hans

[PetrM]

Hello,

Please go over these three simple steps presented on this page.

Thanks!

[SnakeSK]

Petře he want to know why are msas excluded from AAP and unable to be restored as objects. Not using MSAs for AAP

[HansMeiser]

Hello,

thanks for your answer. SnakeSK is right. I dont want to create a MSA currently, i wonder why my existing MSA not appear in a succesful AD Backup.
I also noticed, that the Computerobjects of AD Domaincontrollers not appear in an AD Backup.
Is this expected or not well configured?

Thanks,
Hans

[PetrM]

Hello,

My apologies, I indeed misunderstood the question. It is clear now, but I need some time to work on it. I'll update the topic as soon as I have more information.

Thanks!

[HansMeiser]

Hello,

no problem. Thank you for your help.

Hans

[PetrM]

Hello,

@HansMeiser after our testing in the lab, we can say that:
1.

Are MSA excluded from backup or how to enable it?

We can see MSA in the AD backup. May I ask you to open a support ticket and share the support case ID?

2.

Computerobjects of AD Domaincontrollers not appear

This behavior is by design, in fact, it's a known limitation, as stated on this page:

Veeam Explorer for Microsoft Active Directory does not support recovery of the contents of the Domain Controllers container and most of the contents of the System container (in particular, the Password Settings container), as this may cause system stability issues on the target machine.

Thanks!

[HansMeiser]

Hello,

we opened a ticket and we were told that AD Explorer is not able to restore ManagedServiceAccounts.The Veeam Support Technician referenced to this URL.
veeam-backup-replication-f2/restore-a-d ... 79929.html

So it seems that this feature is not implemented and one should use the AD Recycle bin as only alternative.

So the question is what did you see in your AD Backup?

Thanks,
Hans

[PetrM]

Hi Hans,

In the object tree on the left side, we see a folder called "Managed Service Accounts". Within this folder, we can see an MSA object and we can successfully restore it. We checked it once more with my colleague just 10 minutes ago. Could you please provide a case ID so I can contact our support team to clarify the situation? I think there was a misunderstanding. Additionally, the post they referred to is already 3 years old.

Are you talking about MSA, not gMSA, right?

Thanks!

[HansMeiser]

Hello Petr,

Are you talking about MSA, not gMSA, right?

Would this make a difference? I think in most cases we use gMSA. I will create explicitely a MSA and check if it will be visible in backup.

So long.

Thanks,
Hans

[PetrM]

Hi Hans,

Yes, there is a difference: gMSA objects are not available.

Thanks!

[HansMeiser]

Hello Petr,

you are right. The MSA was backuped and i did a successful restore. gMSA still not visible.
I did not expect a difference in behaviour, therefore my inaccurate topicopening.

Thank you,
Hans

[PetrM]

Hi Hans,

No problem at all! It's not obvious, therefore it's not expected.

Thanks!