Comprehensive data protection for all workloads
Post Reply
kratos31
Influencer
Posts: 13
Liked: never
Joined: Jun 01, 2011 8:11 am
Contact:

File Restore or Lack of

Post by kratos31 » Jun 21, 2011 2:53 pm

I have been having an issue with File Level Restores, after raising a support ticket I thought I would post my results

Windows File Level Restore cannot restore files unless the account Veeam is running as has NTFS rights over the file
Linux File Level Restore can restore files without NTFS rights, but does not maintain NTFS rights on the file when it is restored.

Being told to restore the whole VMDK and mount it to another machine is not much of a solution - coupled with the fact it probably wouldnt work.

This is quite a sour note as so far I had been impressed with Veeam in terms of its Backup, the restores at this point are the exact opposite.

Gostev
SVP, Product Management
Posts: 24674
Liked: 3475 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: File Restore or Lack of

Post by Gostev » Jun 21, 2011 3:41 pm

I would suggest keep working with support on this to investigate further, because one of the new v5 features is local privilege elevation for Windows FLR process (this is even documented in the What's New). This functionality allows to restore files Veeam account does not have access to.

As for Linux FLR, this is expected. Multi-OS FLR was never designed to provide complete Windows FLR capabilities (since we have a dedicated wizard for this). It is rather focused on other OSes (for example, it does preserve Linux file permissions).

Please continue working with support to troubleshoot why privilege elevation does not work with Windows FLR.

Thanks.

tsightler
VP, Product Management
Posts: 5405
Liked: 2230 times
Joined: Jun 05, 2009 12:57 pm
Full Name: Tom Sightler
Contact:

Re: File Restore or Lack of

Post by tsightler » Jun 21, 2011 6:00 pm

The most likely reason being that the account being used for the restore operation is not a local admin on the machine.

kratos31
Influencer
Posts: 13
Liked: never
Joined: Jun 01, 2011 8:11 am
Contact:

Re: File Restore or Lack of

Post by kratos31 » Jun 22, 2011 6:54 am

I will mention the privelage escalation to the support tech as this has not been mentioned yet.
The account is a domain admin and as admin rights on all servers.

kratos31
Influencer
Posts: 13
Liked: never
Joined: Jun 01, 2011 8:11 am
Contact:

Re: File Restore or Lack of

Post by kratos31 » Jul 13, 2011 9:57 am

Well Support have been hacking round with this problem for around a month and dont seem to be getting very far.

Has no one else run into the problem of restoring a file they dont have NTFS permissions over?

At the moment robocopy is doing a better job than Veeam

ShadFX
Novice
Posts: 5
Liked: never
Joined: May 16, 2011 1:13 pm
Full Name: Matt Neal
Contact:

Re: File Restore or Lack of

Post by ShadFX » Jul 13, 2011 10:25 am

Have you tried taking ownership of the folder and then restoring it? I think I had a similar issue once and solved it by taking ownership of the folder then changing the security permissions - all within the FLR :)

Gostev
SVP, Product Management
Posts: 24674
Liked: 3475 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: File Restore or Lack of

Post by Gostev » Jul 13, 2011 10:30 am

And no, these changes will not be applied into backup, backup remains read-only no matter what you do. I guessed this is going to be the next question ;)

kratos31
Influencer
Posts: 13
Liked: never
Joined: Jun 01, 2011 8:11 am
Contact:

Re: File Restore or Lack of

Post by kratos31 » Jul 13, 2011 10:31 am

if i take ownership and add in NTFS rights for the user it works, but not really in the spirit of things is it????
Particularly if you have a large restore to do, and then you have to undo all the changes on the restored files. Restoring files is 50% of what a Backup product has to do, and I am amazed that Veeam is so clunky when it comes to this.

Gostev
SVP, Product Management
Posts: 24674
Liked: 3475 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: File Restore or Lack of

Post by Gostev » Jul 13, 2011 10:38 am

Well, I hope our support can figure out why it is so clunky for you, because as I've said, with privilege elevation feature added in v5 it should work out of the box in any scenario. Of course, there is always a chance of bug or environment-specific issue that affects the designed behavior.

kratos31
Influencer
Posts: 13
Liked: never
Joined: Jun 01, 2011 8:11 am
Contact:

Re: File Restore or Lack of

Post by kratos31 » Jul 15, 2011 2:28 pm

Can someone else try this and let me know the results - it would be interesting to see if others are affected.
Create a file that the Veeam Backup account does not have NTFS permissions over. Run a backup then try and do a windows file level restore on that file.

I get access denied messages.

Currently working with support, although they have been unable to recreate the issue...

Thanks

tsightler
VP, Product Management
Posts: 5405
Liked: 2230 times
Joined: Jun 05, 2009 12:57 pm
Full Name: Tom Sightler
Contact:

Re: File Restore or Lack of

Post by tsightler » Jul 16, 2011 2:45 am

Well, it works fine for me, but you didn't provide much detail on exactly how you are attempting to make this work. Specifically, is the Veeam account a local administrator on the machine? What about the account you are logging in as to preform the restore? Are you attempting to restore the file directly to the backed up VM, or only to the local Veeam server? If you provide the exact information I'll try to reproduce the exact scenario.

kratos31
Influencer
Posts: 13
Liked: never
Joined: Jun 01, 2011 8:11 am
Contact:

Re: File Restore or Lack of

Post by kratos31 » Jul 20, 2011 7:30 am

The Veeam account used for the restore is a local admin (also a domain admin) - this is the same account Veeam uses to backup the VM's
The account does not have NTFS permissions over the file that I am trying to restore.
I am trying to restore to the local Veeam server.
Looking at process explorer the Veeam Shell does not get SeRestorePrivelage which i think it should have - it does get SeBackup

Gostev
SVP, Product Management
Posts: 24674
Liked: 3475 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: File Restore or Lack of

Post by Gostev » Jul 20, 2011 11:20 am

kratos31 wrote:SeRestorePrivelage
No such thing. SeBackupPrivelege is the privilege that should get added. This is Backup Operator's privilege which allows the account to read files it does not have NTFS access permissions to. Designed specifically to be used by backup applications.

kratos31
Influencer
Posts: 13
Liked: never
Joined: Jun 01, 2011 8:11 am
Contact:

Re: File Restore or Lack of

Post by kratos31 » Jul 20, 2011 12:11 pm

SeBackupPrivilage does get enabled.

SeRestorePrivilage is visible in Process Explorer,

Gostev
SVP, Product Management
Posts: 24674
Liked: 3475 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: File Restore or Lack of

Post by Gostev » Jul 20, 2011 2:50 pm

SeRestorePrivilege is required to conduct actual restore (write a file to a location which the account does not have access to). But you said you are restoring to local Veeam server, so this privilege is irrelevant, because your account has full right there.

In your case what fails is reading the file that the account does not have access to (and this is exactly what SeBackupPrivelege covers).

Post Reply

Who is online

Users browsing this forum: Baidu [Spider] and 55 guests