Repo Permissions

[lobo519]

I am setting up Endpoint back for a few laptop users to backup to a V&R repo. My question is should I create separate repos for each user and apply permissions to each? If I just use one repo I am concerned that everyone would have access to each others backups.

[Gostev]

Actually, no - even with a single repository, each user will only be able to access its own backups. Each endpoint backup has ownership information in its metadata that is tied to account used to connect to B&R from VEB.

[lobo519]

perfect!

[Dima P.]

P.S. Don’t forget that VBR admin account (and restore operator) can see all the backups in the repository – that might be useful when performing a Bare Metal Recovery.

[lobo519]

So i have another problem - When the user changes their password, the backup breaks without notification.

Why can't the app just use the current user permissions?? I either have to set the user on the service or in the repo wizard. Both of which break on a password reset.

[Dima P.]

There are two options, actually. First described in the Help Center - Specify Backup Server Settings page:

If you do not select the Specify your personal credentials check box, Veeam Endpoint Backup will connect to the backup repository using the NT AUTHORITY\SYSTEM account of the computer where the product is installed. You can use this scenario if the Veeam Endpoint computer is joined to the Active Directory domain. In this case, you can simply add the computer account (DOMAIN\COMPUTERNAME$) to an AD group and grant access rights on the backup repository to this group.

You can use Endpoint’s machine local computer account to authenticate to VBR repository but don’t forget to set up permissions same way in the repository level (add computer account to the permission list)

Another option is to have a separate service account for every endpoint machine – it’s more likely used for file share destinations, but you can keep this option in mind as well.

[lobo519]

ahhhhhh - i missed that! Thanks!!!

[Dima P.]

You are welcome