Preserve permissions during file level restore

[elwappo]

First let me start off by saying Veeam backup is really a great product. But I'm having one issue that's preventing me from switching gears on my current backup solution to this product. That issue is file level restores and NTFS permissions. It could be that I'm using the product wrong so I thought I would take a moment to ask you guys, the experts who made it, how you would accomplish this task that I do now with my current Backup software for file level restores. That product is Backup Exec just fyi.

If I want to do a file level restore how do I do so and keep the NTFS permissions on the file I am restoring? I cannot connect to the VMguest via the restore wizard to drop the file in a folder on the target guest. In backup exec all I do is redirect my file restore to the same computer and same ntfs volume, restore the file, and the permissions are intact. The only way I can restore, that I can find in the Veeam tool, is to map a drive to the system I want to restore to. However when I restore the file it does not keep the NTFS permissions. And when I view the permissions on the properties of the file I want to restore in the VEEAM plug in browser it looks strange. It shows groups that belong to my pc where the image is stored on and not the groups that are on the computer my backup came from.

This is really the only thing stopping me from saying I want to use this product on my production ESX hosts. Any insight would be greatly appreciated. I know it sounds confusing, and for that I apologize. But I like this product so much I want to see what I may be missing before I decided I cannot replace my existing file level backup utility.

Thanks!

[Gostev]

Help me understand your scenario. On source VM that you backup, do you have file permissions set granularly on all existing files, or you set them on top level folders and those files simply inherit the permissions?

[elwappo]

These are the granular NTFS permissions. If you have a windows volume formated with NTFS, view it's properties, you will see a tab that says security. I am trying to keep the permissions on the security tab intact when I restore these files. Right now, as long as my permissions on the files are set via Active Directory, with backup exec I can restore a file to any server in my domain with an NTFS volume and it will retain the granular permission set.

So to clarify I'm more concerned with AD permissions than local permissions. However this is still pretty much the same thing.

Thanks!

[vbussiro]

I think this method isn't supported by veeam backup. But if you mount a restored vmdk in a domain member, permissions should be presented correctly. Then you'll need a tool like robocopy to copy back your files with their permissions. Quite nasty, but veeam is more likely intented to restore entire vm than to restore files (that's how I see it...).

My infrastructure is well fitted for this, so i use windows shadow copies for this kind of problems, and it's even simplier than backup exec !

[ssimakov]

elwappo, permissions are preserved in case of using file level restore as the list of ACLs associated with the file is stored and copied together with the file. And of course permissions will be preserved when restoring VM files or the whole VM image.

[elwappo]

elwappo, permissions are preserved in case of using file level restore as the list of ACLs associated with the file is stored and copied together with the file. And of course permissions will be preserved when restoring VM files or the whole VM image.

I don't understand what your saying here. I want to be able to restore a single file back to the virtual server it came from with it's file permissions intact. Right now it is not doing that. If I open up a restore file made of a VMguest in VEEAM I can see all the files on a backed up disk. All I have is a "copy to" option. I have to browse to the computer via network neighborhood, or something that looks like it, and select where to restore the file to. When I do this it is not restoring with the permissions it had at backup. It is defaulting to just taking the inherited permission of the folder that it is copied into. My issue is with files that have had their ACL's separated from the folders above them and have specific, or exclusive if you would like to call it, permissions applied to it. They don't seem to be restoring with the file. If I'm doing something wrong let me know. I really would like to replace my backup software with this product. But right now this is stopping me from doing so as most of the restores I do on a daily basis are file level. Thanks!

And to clarify it works great restoring an entire VM. I'm talking about pulling a single file from a backup to restore if someone deletes just a file. Not restoring the whole vm.

[ssimakov]

Well, yes, in case of inherited permissions list of ACLs associated with the file contains record "inherit permissions". So when you copy file using Windows Explorer or Backup Browser it uses Windows API function which by default simply copies files together with the list of ACLs. And target file will also have "inherit permissions" in the ACL list. In case of explicitly set permissions restored file will of course have the same list of explicitly set permissions.

[Gostev]

Stanislav, we need to double-check in the lab if explicit permissions are indeed restored. If yes, it would be best to setup webex and see why this is not working in this case.

[elwappo]

When you test this in your lab remember that I am restoring from my workstation. I am not installing the client on the computer that I backed up. I don't know if that has an effect. Thanks guys!

[ssimakov]

elwappo, I have to apologize, yes, the behaviour is exactly the same as you've described. We'll discuss it with the product management and development team to provide an option of preserving ACLs when performing file level restore.

[elwappo]

Thanks for looking guys. If you can add that feature it would be an additional product selling point!

[kmccubbin]

I really love this product and have been working hard to sell it to my management, which seems to be working. However, this is the deal killer. We need the ability to do file level restores with the ACLs in tact. We work with a lot of Health and Human Services Departments who are, reasonably, very very granular with their permissions. If a folder gets deleted and needs restoring, there is no practical way to recreate those permissions.
Is there any chance that this feature will be included soon? I would love to stay with Veeam.

[Gostev]

Kelly, are you mostly interested in Linux, or Windows for this functionality?

[kmccubbin]

Almost entirely Windows. Thanks for the response!

[Gostev]

Kelly, the reason permissions are not preserved right now is because we are using the same API and logic used by Windows Explorer, which as you know does not preserve permissions when copying files. Based on the feedback from original poster, I have already discussed this with development and we agreed to add the option to preserve ACL to our product. This does not appear hard to do, and we will attempt to squeeze this into the next release.

Also, I've just spent some more time researching this, and as a temporare workaround, I am pretty sure that this registry mod and restoring files with Windows Explorer instead of built-in backup browser should help to preserve original ACL (I am on holidays right now and unfortunately don't have access to my lab to verify this for sure). Link: http://support.microsoft.com/kb/310316

Similarly, restoring with tools like scopy should also preserve original ACL.

(In case you did not know, during Windows file level restore all VM disks are mounted as local drives on your Veeam Backup console, and these drives are browsable and accessible normally by Windows Explorer or any other program or tool.)

Hope this helps!

[kmccubbin]

Thanks so much, Gostev. This completely fixed my issue!

[Gostev]

Kelly, thank you for the update. That would be official workaround then

[tim.matheson]

not sure if this needs to be a new topic or added here, but here it goes:

running 3.1. backing up a VM that contains files for different groups and individuals. some people have access to everything , some only to certain things.

VEEAM does a great job backing everything up, however the file level restore is another issue. Due to the fact that it backs up the files and security settings, the veeam VM cannot restore the same files it backed up because it did not have permission on that folder or file. So it can back the data up, just not restore it. to me that makes no sense. If I as the admin wants to restore a file to a VM, I should be able to and let the domain deem who has access to it as before.

so my question is this I guess. Why can there be a setting where you can do a pass through of folder or file level permissions? maybe a flag you could set somewhere that states, " I am taking responsibility for this action and no matter what the security of the file says, restore it" . does this not seem plausible?

I could not find anything relating to pass through of permissions, so I may have to start a new topic.

thanks for your feedback

[tsightler]

Tim,

I'm not sure in what scenario Veeam would fail to be able to restore a file. Veeam is an image backup product, it technically doesn't backup up files at all, it backups up disk images. The file level restore feature simply mounts these images just as the original volume mounted them, thus the same Windows permissions that affect the orginal filesystem will also affect the Veeam mounted filesystem. If the user account you are attempting to use to perform the restore has "backup operator" privilege, that user should be able to read and restore the file regardless of it's permissions. I never experienced any issues with permissions when attempting to restore a file but we use a special "veeambackup" account which has the Backup Operator privledge.

Even without this option you might be able to overcome any permissions issues by using the Veeam File Level Restore Wizard which uses a Linux virtual machine to perform the restore. Normally this isn't required for Windows restores, but you can use it and, since it uses a different method, rather than simply mounting the windows volumes in the host OS, it mounts the NTFS volumes within Linux, an OS that pretty much ignores Windows permissions. I've never really tried this, but it might work.

[tim.matheson]

well support said that if the file level permission was not there when veeam backed it up, then veeam won't be able to restore it which is irritating. I can see their point of why it is this way, but then veeam should not have been able to back up the file. I understand it is an image and not a file backup. however, i made a few changes and will see what happens tonight. but that would only fix things moving forward, not going back in the past.

my other option is to blow up the whole vmdk onto a host, if i can make enough room. it is 1.2 TB. then pluck the files out.

we will see what happens tonight.

[tsightler]

my other option is to blow up the whole vmdk onto a host, if i can make enough room. it is 1.2 TB. then pluck the files out.

But you can already do that, actually that's exactly what Veeam does. Veeam literally mounts an image of your disk exactly as it appeared when the snapshot was taken, permissions and EVERYTHING. The Veeam File Level Restore Browser then pops open, but you don't have to use it, you can simply minimize it and open regular Windows Explorer, and you will see the drives from the system you are attempting to restore from actually mounted under different drive letters. You can then simply use Windows Explorer, or other windows tools like XCOPY, to copy the files and, when you're done, go back to the Veeam File Level Restore browser and close it, and the drives will be unmounted.

[tim.matheson]

WTH? how come the support guy did not tell me this?

let me give that a try. keep your fingers crossed.

[tsightler]

I should clarify that this is only if you use the "Restore Guest Files" option directly from within the Veeam client, not the FLR Wizard. You generally shouldn't use/need the FLR Wizard (which uses a Linux appliance) to preform Windows restores.

[tim.matheson]

I understood what you meant, thanks. It worked, mostly. i still had to go in and take ownership of the folder that did not have inheritable permissions. but once i did that, i could see the file i needed and copied it to a folder for study.

thanks for your help!

still, there was a permissions issue. so the vm running veeam is albion. at the time of the backup, albion did not have any rights to that folder nor did the albion administrator. the vm that was being backed up allowed veeam to back it up. however, i still think there should be a setting in veeam that would allow permissions to pass through so that veeam could do a file level restore of the folder or file back to a location and keep the permissions in tact, without specifically being a member of that folder. does that make any sense?

[tsightler]

It doesn't really make any sense to me. The "vm" did not allow "albion" to "back it up", the ESX server alowed "albion" to create an image of the VM's VMDK file. For doing a backup with Veeam, Veeam does not need any permissions within the guest operating system, it performs the backup at the VMware/ESX layer, not the OS layer. The same is true of a restore of an entire virtual machine.

Now, when you attempt to perform a file level restore from a Veeam image, that's completely different. Veeam basically takes the image that it created, and mounts it within the Windows machine on which Veeam is running. At that point, the files on the image are now bound by Windows permissions, just as the would have been on the target machine. If the account you are running the Veeam restore with has been granted "Backup Operator" privledges within Windows, you should be able to restore the files regardless of the underlying permission.

I'm not really sure what you think Veeam can do in this situation, it is subject to Windows permissions just like every other backup application. Normally, a backup application grants the service account that it runs under the "Backup Operator" permission so that it can perform such restores, but nothing keeps you from doing this to the account that you are using the run Veeam.

[tim.matheson]

thanks, that makes perfect sense.

[gunnarwb]

I'm looking at purchasing Veeam and this was the very first question out of Management's mouth. Does this product restore and keep the permissions? I can see how I can work around this issue however, not having this ability in the Veeam software is going to keep management from giving me approval to purchase. It's been 10-months and I believe there has been a new release, but the restore still loses the NTFS security. Any recent information on this would be really helpful!

Thanks,

Gunnar

[Gostev]

Gunnar, you need to apply the registry mod I have provided on the previous page, then our file level restore process will restore files with original NTFS permissions. Thank you!

[athome]

Hi!

I see that during restore guest files(windows) on Veeam 5.02 in a VM I dont see the guests drives in explorer(they show up in the "restore browser-window").. shouldn't this be automatic in 5.02?

[Gostev]

Hi, sorry, but I do not understand your question.