change user (log on as) service

[StingerTW]

Hey @ all,
i got one question.
is it poosible to change the the account after installing veeam.

at the moment all veeam service are : log on as local system.
i would chage ist to example : domain/administrator.
is this possible?

thx

[foggy]

Hi Daniel, yes, you should be able to do that. Thanks.

[bdufour]

Sure you can, but why would you want too? When you use an account to log into a service - windows will store its hash in memory I’m pretty sure. Just like when you’re logged into a pc/server windows will store your hash in memory. If you’re not enforcing SMB signing and/or you have NTbios and multicast enabled (default and dangerous AND not needed if you have dns configured properly). That hash isn’t protected trust me, and if you’re using less than 15 character passwords it can be cracked rather easily (15+ won’t use LM hash algorithm, u want ntlmv2 and should enforce it!!)... SO - you should disable the built in administrator account over your domain for one. It has local admin rights to all servers and PCs in your domain. Just have yourself a domain admin account that you use to evaluate privileges and/or log into servers with - treated as a service account in a sense and a fine grain password policy - never stay logged In as this account always log off! Your personal account, for email, logging in daily, ect should be a domain user account. If u pm me - I can give u some more pointers. I go through pen testing every year as part of our audits - I work in banking. Microsoft is about availability, not security - by default. But it can be made very secure, in fact, with the right knowledge.

[StingerTW]

Thanks for your replies.
During the installation process you can specify: local system or another user.
by default we have selected local system. we want to change this during operation. can we do this at all without reinstallation?

[bdufour]

No you wouldn’t have to reinstall. Just understand there is a difference between domain/administrator and (this pc)or ./administrator.
Good luck.

[mvrk]

And how do we do that without reinstall?

[foggy]

Just change the account for the Veeam services using the Services snap-in.