Moving Veeam server from domain to workgroup

[wa15]

To better protect against ransomware, we are looking on moving our Veeam server (mgmt/repo/proxy) from domain to workgroup. I couldn't find any information on whether this move will break anything on the Veeam side.

Any feedback/input on this?

[PetrM]

Hello,

For example this article describes pros and cons of every option including moving of Veeam server to a workgroup. I'd recommend to test it in non-production hours to make sure that everything goes fine.

Thanks!

[Novell2]

Hi, a customer wants to switch the physical Veeam server BR10 from the domain to a workgroup for security reasons. What are the Tasks? Do I need to change all BK jobs and permissions? What about proxy and repository? Maybe someone has already done it..
Thanks a lot!

Kind regards
Novell2

[Mildur]

You question was already asked and answered before. 8 days ago

post386083.html?hilit=Domain#p386083

[Mildur]

And have a look on this page. It‘s a good Guide to get started with infrastructure hardening.

https://bp.veeam.com/vbr/VBP/Security/i ... ening.html

[Novell2]

Hi Mildur, thanks for this!
Best regards
Novell2

[Natalia Lupacheva]

Hi Novell2,

I've moved your post to the existing thread.
It also might be helpful to take a look at the discussions here.

Thanks!

[ajped]

Hi,
I have a question about backup server joined to a active directory domain.
We have a backup infraestructure with the backup server, backup repository and backup tape server in the same physical server. This backup server is joined to a active directory domain.
We're worried about security of this server. I suppose a best practice is that this server wouldn't be part of any Microsoft Active Directory Domain and have a local administrator account to manage the backup server. Could I disjoin this server from the domain whithout problem?. In that case, Could we keep backup and restore all the domain infraestructure including active directory objects and exchange mail objects without any problem?

Thank you!!!

[Egor Yakovlev]

Hi Antonio,

I have merged your post into existing thread.
Please check answers above.

/Cheers!

[redhorse]

Hello,

I've read several threads regarding the question whether the backup server should be domainjoined or not. Today our backup server is domainjoined and I am currently planning a migration to new hardware. We have an all in one backup server and I am unsure if the new server should be part of our domain.

The server administration and maintenance is much easier if the server is domainjoined on the other hand we want to improve our security. I've read a few comments that it might be possible that we can't login to Veeam if our infrastructure is down and the login is not possible because the AD is available. But what if I use both advantages like this:

1. Server is domainjoined and it's possbile to use AD-User for administrative tasks for the OS
2. Use Veeam Users and Roles:
- AD-User (Server-Admins) -> Veeam Backup, Restore and Tape Operator
- Local User on Backup Server -> Veeam Backup Administrator

What do you think about this? I hope it's clear what I mean

[redhorse]

Addition: When I am right no domain user will be able to delete backups from the repository within the veeam console, a local user account without the need of AD is able to perform restore tasks and the server is domain joined and can be handeled as any other server from the OS perspective.