Veeam B&R console needs admin rights to start

[Vitaliy S.]

Hi George,

Cannot speak for all companies, but many of them are using Veeam ONE or Enterprise Manager to give access to the helpdesk/monitoring engineers.

Hope this helps!

[foggy]

Any idea to when Veeam Console will be released without the need for "local admin"-privileges?

Unfortunately, we cannot give any particular ETA for this feature at this stage.

[Fenris]

We have the same issue, a fix would be appreciated!

[George_Washington]

Cannot speak for all companies, but many of them are using Veeam ONE or Enterprise Manager to give access to the helpdesk/monitoring engineers.

Hello Vitaly,

I have to agree that the Enterprise Manager has certain features that are usefull for a backup & restore-engineer, but it misses out on a lot of features the Windows Client has. For instance not being able to restore a virtual machine with a different name, so that the original one (that might be broken) sits next to the newly restored (though renamed) virtual machine.

For now we have implemented and intermediary fix, but it's suboptimal.

[Vitaliy S.]

Ok, thanks for the follow up. BTW, do you mind sharing your solution with Fenris who asks for a "fix" for that?

[George_Washington]

My sincere apologies for not sharing my "fix".

What I did was create a few virtual machines with Windows Server 2016 and Veeam Console, that sits between our Veeam-environment and the backup/restore-engineers. It's suffice to say that we locked everything down from a network perspective, because on the VM all backup/restore-engineers need (or should is say Veeam Console) "local admin"-privileges.

[EmpTee]

While we are on the topic of delegating permissions, it would be incredibly useful to be able to delegate starting a configured backup job to a normal user (not backup admin).

I have devs working that need to be able to easily rollback major changes to development environments via a veeam restore.

I can delegate the restore process to them via Veeam Enterprise Manager, but am unable to delegate starting the backup job to them. This means support always has to be available to initiate a manual backup as required.

If i'm allowing a dev to restore an entire VM, why can't I allow them to back it up too (unless i'm missing an obvious way to do this)?

[Vitaliy S.]

Hi EmpTee,

Have you considered using Quick Backup function (see the portal user role section) in this case? For example, your dev team can initiate it at any time when they need to do some tests and create a backup.

Thanks!

[EmpTee]

Hi Vitaly,

Didn't realise the quick backup option was available.

Is there a way to delegate only initiating backup jobs, and not allowing restores at all?

Thanks

[Vitaliy S.]

Not that i can think of, but you can potentially limit the restore types for these users.

[mephisto]

Hi guys,

I'm wondering if there are best practices recommended to manage Veeama backup servers as I noticed we can't run the console without admin rights for example and I think the web interface it part of enterprise product which at the moment we have no requirement. I've checked https://bp.veeam.expert/ but no luck finding what I'm after.

What are the best methods for letting people run Veeam console to manage backups/restores without needing admin access to the machine they run the console? Normally we allow people to RDP into the server that has the management console installed for example.

Any suggestions would be really appreciated

[DGrinev]

Hi Mephisto,

We have this on the roadmap to change the said requirement in the future releases.
Please review this big thread for additional information. Thanks!

[mephisto]

the only other way around would be the enterprise console to have that web interface then?

[Vitaliy S.]

Yes, that's correct (still a FR), or you can use VAC or Veeam ONE (depending on your scenario).

[Andrew1344]

Hello ALL,

I am trying to give users access to the Veeam Console without making the user an administrator on the underlying os. Basicall I want to allow the user to open the console but have no access to the OS itself. Any suggestions?

[bdufour]

this topic has been beat to death, you can search through the forums. you may give them access to enterprise manager or veeam one for monitoring purposes, but you cant give them access to the console without the user being an admin on the underlying OS bc the account needs to mount files. veeam is working to make it so that this isnt a requirement in future releases.

[lkooe]

Until now the Backup Console worked without admin rights (under Windows10 or Windows Server 2016/19 only with UAC disabled). In larger environments this is necessary, because not every backup operator has admin rights. Since 9.5 update 4 the restore without admin rights does not work anymore, the cryptic error "Value cannot be null Parameter name: disposableObject" occurs.
This is unprofessional. When will the use of the backup console without admin rights finally be officially supported?

[foggy]

Have you tried to perform the same restore operation under account with administrative rights and it succeeded?

[powersjo]

+1 please make this feature available so local users don't need admin rights to run the veeam backup and replication console.

[Sloan]

I'm watching this too because when I was running the 9.5 Update 3 version of the console I could run from my VDI or PC without providing admin credentials but after it installed update 4b I'm having to provide admin credentials.

Where I'm at we don't just have an admin account on our desktops. We have to request it (for 24 hours) then log off and back on and get a generated password for the local administrator account... Then any operations in the console reflect as "pc_name\administrator" and it's difficult to track who is doing what to the environment.

[Regnor]

+1

I didn't even know that you need administrative rights until now.
We advise customers that they can use the console from their desktops in order to manage Veeam.
And often there's non-technical personal which only needs to manage/export tapes, so they should have no access to the backup server itself and of course also don't have local admin rights.

[BrianBuchanan]

I have two work-arounds

Batch File

Save this as a batch file to launch the console without elevating:

Code: Select all

set __COMPAT_LAYER=RunAsInvoker
start "Veeam Backup & Replication Console" "C:\Program Files\Veeam\Backup and Replication\Console\veeam.backup.shell.exe"

Application Compatibility Toolkit

This does the same thing as the batch file, for anyone launching veeam.backup.shell.exe on the machine using the Application Compatibility Database. It requires more setup to create the Application Compatibility Database, which then needs to be distributed and installed, but doesn't need a batch file. This is more "corporate" as this might be used for more difficult programs needing more compatibility fixes.

Setup:
1. Download the latest Windows Assessment and Deployment Kit (ADK)
- https://docs.microsoft.com/en-us/window ... dk-install
1a. Install only the Application Compatibility Tools

Create the Compatibility Database:
1. Launch the Compatbility Administrator (64-bit) (As Administrator)
2. Right-Click the Untitled entry under Custom Databases
2a. Create New Application Fix
3. Name: Veeam Backup & Replication Console
3a. Name of the vendor: Veeam
3b. Program file location: C:\Program Files\Veeam\Backup and Replication\Console\veeam.backup.shell.exe
4. Next past the "Compatibility Modes" dialog
5. On Compatiblity Fixes, select "RunAsInvoker", Next
6. Finish
7. Click Save
7a. Name the database "Veeam"
7b. Save the file as Veeam.sdb
8. Optional: Install the Database and Test
8a. Right-Click on the Veeam database and choose Install
8b. Launch Veeam, notice no prompt for Admin rights.

Deploy the compatibility database (on the same machine or any other machine)
1. Install the sdb with the Application Compatibility Database Installer (included with Windows, not part of the ADK)
1a. Elevated Command Prompt
1b. sdbinst.exe veeam.sdb
- https://docs.microsoft.com/en-us/window ... -line-tool

Disclaimer, use at your own risk.
This is not endorsed by Veeam and I have no idea what problems could arise, eg. executing restores.

References:
https://www.nirsoft.net/articles/run_ap ... ation.html

[Gostev]

As far as the feature request itself, we're now working on adding this capability to the next major release. Thanks!

[c.schulzejn]

Thx Gostev!

Local VAW Console is started w/o admin rights in first place. If you need to perform administrative tasks (e.g. edit job, restore files) it asks for more permission. I am exptecting something similar for VBR, maybe you can reuse some of the VAW code

[cherzyk]

As far as the feature request itself, we're now working on adding this capability to the next major release. Thanks!

So, with major release you are talking about 11.0 or about 10.1?

[Vitaliy S.]

Major is 11, 10.1 is a minor. release. Thanks!

[cherzyk]

So we are talking a time frame of like 2+ years, judging from the lifespan of 9.x.

[Vitaliy S.]

I don't want to speculate on this, but I would recommend joining our VeeamON 2020 (free online event) to know more about our upcoming releases.

[Gostev]

So we are talking a time frame of like 2+ years, judging from the lifespan of 9.x.

Our major release cadence is annual, and those multiple yearly 9.5 updates were major releases. Bad naming though, and we're no longer using it starting last year.

[morrisng]

Same problem that our client was facing, due to the security compliance, the local administrator right is restricted to user. I would like to know what is the minimum user privilege to perform the following operation using Veeam console / Enterprise Manager?

Manually Start/Stop PC Backup Jobs
Modify Backup Policy settings
Create/Delete/Modify Protection Group
Create/Delete/Modify Gateway Server settings
Add/Delete/modify DataDomain Repository

Thanks!