Where exactly do I install VBR?

[wilddoktor]

(I have a ticket in on this [#5209306], but thought maybe I could get some thoughts from the community as well since it's the weekend.)

Maybe a dumb question, or maybe I'm blind; but I can't find this basic info. Where do I install VBR? I'm using the free version as this is a super tiny environment and they have no money.

The environment:
1x Physical Server running 2008R2 w/Hyper-v role, *not* domain joined, hosting 3 VMs
3 VMs: AD DC, RDSH, Utility. All are running 2008R2
The 3 VMs are all joined to the domain (the AD DC handles this)

So...where do I install VBR? And, if I install it on a VM, can I backup the VM it's installed on?

I've tried:
Installing on one of the VMs (the "utility" VM). Cannot add the off-domain Hyper-V host due to "access denied". That's driving me crazy. I'm logged onto the VM as a domain admin, but obviously domain accounts don't work on the off-domain host, so when adding the server I enter the local admin creds. Doesn't matter; in the logs it says my domain admin account is "access denied"...even though I'm giving it local admin creds. Why is it doing that??

Installing on the physical host itself. Cannot add the local hyper-v host due to "access denied"!! Even though I'm logged into the local host as a local admin, and I'm using the same creds to add the host to VBR.

In KB1362 (and in the docs) it says: "Ensure that File and Printer Sharing is enabled in the network connection settings of the server; otherwise, the components will not be installed." The problem with that is, the hyper-v host only has one NIC, and I've got an External Virtual Network attached to that NIC, which is how the 3 VMs connect to the outside world. On the host, of course the physical nic cannot be modified, so I can't enable file and printer sharing on it. The Virtual Network Adapter *does* have file and printer sharing enabled.

This is crazy...thoughts? Links to answers?? This is the second time I've tried to use Veeam, and so far...the second time it's not worked. (To be fair, the first time turned out to be because Veeam doesn't support the free version of ESXi...however, it took 8 days and 12 emails in order for support to figure that out!)

Unfortunately, I'm not impressed so far...even though I'm a partner and a Veeam Sales Professional, I'm finding it hard to recommend this to clients.

[wilddoktor]

Well, I guess "where do I install VBR" isn't the right question, as I've discovered that Veeam can connect to off-domain hosts via a bunch of WMI (which in my experince takes a bit of monkeying around).

The actual issue for my situation, if I understand it correctly, is:

Veeam requires the use of the builtin account named "administrator" (either local administrator for off-domain or domain administrator for on-domain) to connect a hyper-v host.

I tried it; it works.

The problem is, of course, that Microsoft best practices say to disable the local and domain administrator accounts after creating alternative local and domain administrator accounts, and I do that as a best practice.

I request that we be allowed to use local\domain accounts that are *not* the "administrator" account. The dialog to add a hyper-v host *states* that we can...but it's not accurate. Can we at least get that dialog changed until the functionality is changed?

(Currently it says “Type in an account with local administrator privileges on the server you are adding. Use DOMAIN\USER format for domain accounts, or HOST\USER for local accounts”. That's nice…but that’s really not the case. It should instead say something like “You must use a builtin account called Administrator to add a host. Type in DOMAIN\ADMINISTRATOR for domain accounts, or HOST\ADMINISTRATOR for local accounts”.)

Just a thought...

[tsightler]

The problem is that UAC blocks all attempts to escalate to administrator with accounts other than the built-in local admin. You might be able to manually install the Veeam proxy agent on the off-host proxy, and then it might work, but I've not tested this.

[Gostev]

Yes, this approach is supported.

[wilddoktor]

So theoretically I could disable UAC on the host and then would be able to use something other than the builtin administrator account.

Except of course disabling UAC isn't recommended, either...

[Gostev]

I was talking about this being a supported approach:

You might be able to manually install the Veeam proxy agent on the off-host proxy.

[tsightler]

My understanding of the issue is that you cannot get the Veeam proxy services installed on a host due to the fact that your host are not members of the domain, but systems that are not members of a domain do not allow connection to the administrative shares due to UAC. However, you should be able to work around this by manually installing the installer and transport components on the host and then adding it to the Veeam console. Either that, or disable UAC long enough to get the components installed, then enable it again.