Feature request - Managed Service Accounts. MSA and GMSA

[adrian.tanguay]

I would like the capability to use MSA or gMSA accounts to both run the Veeam services as well as use it for Guest OS file system indexing. Thanks.

https://technet.microsoft.com/en-us/lib ... 31782.aspx

-Adrian

[smurteira]

I was asked the same question today by my management team. Can someone from Veeam chime in and let us know if it is supported?

[veremin]

Could you clarify where you're going to use those accounts? For VSS processing or for Veeam servers/SQL?

[smurteira]

When enabling application away processing. You have to pass credentials that can backup and restore the DB's at the table level, which seems needs to be an sa account

[Vitaliy S.]

I would like the capability to use MSA or gMSA accounts to both run the Veeam services as well as use it for Guest OS file system indexing

Have you tried specifying these accounts in your job configuration already?

You have to pass credentials that can backup and restore the DB's at the table level, which seems needs to be an sa account

Yes, that's correct. For SQL Server processing these permissions are required > Latest Patch broke transaction log truncation

[ekisner]

I hate to necro a months old post, but it looks like this is the most recent thread on the subject. Wanted to touch base on this and see if this is a supported configuration. I too believe it would be most easily set up to use a gMSA.

[lukeroom]

Good Morning,

we have the same requirements.

"I would like the capability to use MSA or gMSA accounts to both run the Veeam services as well as use it for Guest OS file system indexing."

Support Case: 01184911

What is the current status?
regards

[ekisner]

I honestly hadn't even thought of using a gMSA for guest OS indexing. That would be wicked useful from a security standpoint.

[Vitaliy S.]

Hi Lukas, there is no update since my previous post. I have forwarded this info to our QA team for investigation. On a side note, can you please tell me what is the error message you receive when trying to use this account?

[bpr-backup]

I too would like to throw in my request for a gMSA related to Veeam Backup Jobs.

http://pasteboard.co/H0EdpcNPy.png <- Link to image since the forum software doesn't seem to like the img tag.

[oleg.scherbinin]

We would highly appreciated once you can add an option for Guest OS credentials to use msa/gmsa accounts. at present moment it is unavailable option to use such accounts

[veremin]

Your post has been merged into existing thread discussing similar matter.

Currently, it is not possible to leverage such accounts for both running Veeam-specific services and guest processing.

However, we appreciate you taking time and sharing your feedback with us.

Thanks.

[john.brodhurst]

Now that 9.5U3 has dropped - or 9.9 to quote Gostev, has there been any movement on this? Is it planned for vNext?

[Vitaliy S.]

John, yes there was some movement. This functionality is still logged for our next updates.

[cedwards_BREMCO]

I would also like to express interest in this functionality.

[Zew]

I also would like to move to a better user setup. I currently have a standard domain account, with some pretty heavy previledges. It would be nice to move away from a very generic open account that almost anyone of my sysadmins could use. To reconfigure all jobs with dedicated MSA's (2008 R2) or gMSAs (2012 +).

The less amount of accounts I need to store usernames and passwords for are great.

I've recently moved almost all SQL or IIS services to start using gMSAs, and managed to get SharePoint to manage my SP service accounts (Since SharePoint can't even leverage MSAs/gMSAs) so it has its own in-house solution.

This would be the final nail in the coffin for me to move away from almost any and all storing of "service accounts" usernames and passwords.

[nmaas87]

I need this feature as well

[mrholm]

Hi
I've seen some posts and feature request around MSA and gMSA in this and other forums but I want to ask for my self.
We have a situation where we will have a Veeam Server in central DC and a Veeam Proxy in all remote sites (15 sites). In the local sites there's 2-15 VMs being protected with Veeam and our plan was to have one account for each site like; svc-veeam-itaxxx. This account wolud be granted local administrators rights on all servers in the itaxxx site and can be used for guest interaction in only that site.
Our security/AD responsible wants to use gMSA for all this situations so I ask can we use gMSA together with Veeam telling Veeam to use this specific account?

//mats

[Vitaliy S.]

Hi Mats, gMSA are not yet fully supported in the application, but thank you for your FR.

[mdiver]

Has there already been any progress on this? I see this being requested a lot from larger customers.

Thanks,
Mike

[Vitaliy S.]

This is still on our radar. Currently the Update 4 is in the feature lock state, but we will discuss this for our next updates.

[Zew]

Ouch....

[kevin.mcdonnell]

I think this is going to become a necessity as more users look to enhance the security of their environments.

We already have the ability to use SSH keys for Linux system, and really this would be the next logical step for Windows.

[Vitaliy S.]

Kevin, thanks for your feedback. Just for my own education - do you want to use these accounts for services or for AAP as well?

[jklaw91]

Our company also needs to request that Veeam Backup & Replication support MSA and gMSA. We recently were audited and dinged for any servers that must run using a regular domain account. We have migrated a number of services for other vendors to Group Managed Service Accounts and need Veeam ONE to support as well. Thanks.

[electricd7]

Hello- We need this feature as well. Any update? Would like to support using gMSA for both running of the Veeam service as well as for security context for AAP. Thanks.

[Vitaliy S.]

It is still on the discussion table, thanks for the push, it will help me in the discussions with RnD.

[jones.nickolas]

GMSA's are in high demand from the security team here. Adding my vote to get this thread for a feature request.

[Ctek]

Plus 1 here for that feature, we are having an strong internal push to gMSA.

[Salm]

I'll add my vote as well.