AD Protected User can't use Veeam Console remotely

[DeadEyedJacks]

Hi,
Is it expected behaviour that an Active directory user who is in the "Protected Users" group is unable to connect to Veeam Backup and Replication server when launching console from a remote server?
"Failed to connect to Veeam Backup & Replication Server: The logon attempt failed"
NB As soon as user account is removed from "Protected Users" you are able to connect.
TIA

[foggy]

Most likely it is NTLM authentication, which is not allowed for "Protected Users" group members while required when connecting remotely. We will add this note to the corresponding documentation section, thanks for the heads up!

[hke]

Will this issue (lack of Kerberos support for console connections) be fixed or just documented?

As you know, NTLM authentication is much weaker than Kerberos and protecting critical backup assets from passed hashes and other exploits is a top priority for many customers.

[foggy]

Yes, we have a requirement to support Kerberos-only authentication for backup infrastructure connections logged for the future versions.

[AOK-BV]

+1
We have the same issue.

[komzolkin]

Yes, we have a requirement to support Kerberos-only authentication for backup infrastructure connections logged for the future versions.

+1 for the FR

[hke]

Any update on this? Veeam (and all other backup systems) are prime targets for ransomware operators. Protected Users group (i.e., Kerberos-only logins) is a frequently-recommended protection for admin accounts.

The way things stand now, you can't have a very secure admin ID if you also use Veeam (from anywhere other than the VBR server - which raises even more security issues).

[Vitaliy S.]

Hi hke,

The update is the following > currently, we are in the investigation stage (what is required from the RnD team standpoint to support it). As to when Kerberos support will be added to the product, then I cannot share any ETA yet.

Thanks!

[rvjr]

Ping... any update on this? As far as I can see it's still not working in the latests v11.

[Vitaliy S.]

Hi Rainer,

Yes, you're correct. This functionality is not part of the v11 release. Plans are to introduce this functionality (Kerberos support) in our next major versions.

Thanks!

[joebranca]

Did I hear right that Kerberos only authentication is confirmed included in v12?

[Vitaliy S.]

Yes, that's correct > NTLM and Kerberos