Agent Backups of Domain Controllers

[infraerik]

Just checking here, I see that it's possible to install and use the Veeam Agent with physical Domain Controllers, but I'm just wondering if anyone can confirm/deny/give some tips on whether I have to use an account with Domain Admin privileges in this situation.

We have a number of RODC boxes in branch offices that are also used as file servers (yes, I know, bad idea and I'm trying to change this), and I don't need Application Aware backups of AD since there's another group that manages that, so I just need to back up the file system, but I'd like to be able to use a backup service account that doesn't have domain admin.

Any information appreciated.

[Dima P.]

Hello infraerik,

Can you please clarify if you plan to install the backup agent manually or via Veeam B&R server? Thank you!

[infraerik]

Well, I’m inheriting an environment that was put together by hand all over the place. Installation appears to be done via B&R on the existing ones, so I guess I’ll continue down that route.

[Dima P.]

For agent installations made via Veeam B&R server machine admin is required to perform periodic updates of your backup agent anyway, so there is no need to disable the application processing since you already store the admin password for your DC in Veeam B&R console. You can check the list of accounts in Veeam B&R credential manager. Cheers!

[huddie]

you already store the admin password for your DC

DCs don't have local accounts or groups.

Does anyone know how to provide the necessary permissions to the Veeam agent service account in order to install the Veeam agent on a DC, as per the Original Poster's question ?

[Dima P.]

Paul,

Correct, but you still can use account from the Administrators group of your Active Directory, for agent deployment (if we are talking about Agent Management functionality of Veeam B&R). Once installed agent and it's service will run under localsystem account on your machine.