Least amount of Veeam backup service account

[Backup.Operator]

My service account is flagged by the auditor to be Kerberoastable and using high privileged Enterprise Administrator role in my AD domain.

What is the minimum amount of privilege required that I can configure to avoid this security issue?

The recommendation is using: https://learn.microsoft.com/en-us/windo ... s-overview

[Mildur]

Hi

The required permissions are documented in our help center.

gMSA is supported for guest processing. You can also find all the information in the help center.

Best,
Fabian

[Backup.Operator]

FAbian,

So is there any best practice suggestions for how many service accounts I should use to assign for these Veeam Services?

Code: Select all

Veeam Analytics Service
Veeam ONE Caching Service
Veeam ONE Error Reporting Service
Veeam ONE Monitoring Service
Veeam ONE Reporting Service
Veeam Backup Enterprise Manager
Veeam Backup Server RESTful API Service
Veeam Backup Service
Veeam Backup Update Service
Veeam Broker Service
Veeam CDP Coordinator Service
Veeam Cloud Connect Service
Veeam Data Analyzer Service
Veeam Guest Catalog Service
Veeam RESTful API Service

Because so far the systems are working fine, but with just one AD Service account called DOMAIN\Veeam-User using the overprivileged roles like Domain Admins, Enterprise and Schema Admins.

What is the suggested service account and its role for example ?