SQL Server Guest Processing Permissions

[AndrewAdvnetsol]

I am setting up SQL server guest processing permissions. I have multiple databases in SQL. The Veeam documentation for permissions only mention Database-level roles and roles for the model system database, Database-level roles and roles for the master system database, Database-level roles and roles for the msdb system database. Do I need to add permissions to the other database that are in SQL? If so what permissions do I need to add to the database for the user account that is set at the guest processing account in VBR?

I am setting the minimal permissions. I don't want to give sysadmin.

https://helpcenter.veeam.com/docs/backu ... processing

[david.domask]

Hi Andrew,

The permissions listed there should be fine for the Guest Processing account -- were you having challenges after setting these permissions?

A brief reminder, that for Guest Processing of image level backups (i.e., snapshot-based backups from VMware and Hyper-V), VSS is triggered as part of the backup process to perform guest processing, and VSS is what ensures the SQL instance gets prepared and properly backed up. Log truncation happens outside of VSS, but the listed permissions are sufficient to allow this.

Please do be sure to check the Permissions for Restore Operations through Veeam Explorer for Microsoft SQL, as higher permissions will be required for some operations.

[AndrewAdvnetsol]

Thank you for your reply. I was having issues, but it was due to an other database that I didn't realize was there. It was a SQL 2014 database. It couldn't truncate the logs. I discovered https://www.veeam.com/kb2447 that for truncation of SQL Server 2012 or SQL Server 2014 database transaction logs, this account should have the db_backupoperator database role (minimal required) or the sysadmin server role. I wasn't able to assign the db_backupoperator role. I kept getting an error about permissions and triggering batches. The best I could tell based on the error is that there might be something in the database that was manually set to where permissions couldn't be changed, even connected to the database as SA. It is a database for a program called PC Law. I gave the account the sysadmin role and that worked. Not the way I would like to go, but easier than dealing with PC Law support. Thank you for your help.