Veeam B&R console needs admin rights to start

[Gostev]

For Veeam console, Local Administrator is currently the requirement.
For Enterprise Manager, they can use a regular user.

[JTT]

As far as the feature request itself, we're now working on adding this capability to the next major release. Thanks!

So is this feature going to make it in V11 version or not?
It is even nonsense to request it, 4 years and still admin rights are needed. This is totally against every security best practice to give admin rights just for the console.

[Gostev]

Yes, good chances it will make it in v11. Thanks!

[c.schulzejn]

Seems like that topic/feature request could be marked as "solved"

[Gostev]

To be mathematically correct, we will do that once v11 is GA

[Seve CH]

Great news!

Does it mean that the user required by Enterprise Manager won't need any local admin rights on the Veeam Server?

https://helpcenter.veeam.com/docs/backu ... ml?ver=100

"Provide a name and password of the user with administrative rights on the added server. The Veeam Backup Enterprise Manager user must be assigned the Veeam Backup Administrator role on the Veeam backup server. For more information see Veeam Backup & Replication Server Roles."

We have our Veeam Servers isolated and stand-alone, but providing a local admin account to Enterprise Manager (domain-joined) is the weakest spot in our architecture.

Regards

[Gostev]

Steve, no. This whole topic and everything said above is related strictly to the "fat" client only (Windows-based console). Thanks!

[ChuckS42]

Did this get solved? Just installed the console (latest release) on a workstation and it's asking for elevation.

[Gostev]

Yes, it was in V11 (see the What's New document).

[christian.naenny]

Just to get this topic rolling again...
We just upgraded our Veeam Server to V11a and the Console on our Terminal Server also has been upgraded to V11a.
Now the console has become unusable again for all the users accessing the Console on Terminal Server Cluster without Local Admin rights, because the Console asks the users to update the plugins on a user by user basis!
Since we have a Terminal Server cluster with 3 nodes we would have to give all the Console users Local Admin rights on all the Terminal Server nodes for the installation to work. Not going to happen!
Why can't the console be installed to a completely usable state by an admin (installation) user? After it has been installed, I expect the console to work without Local Admin permissions for the users.
I fully understand that there is certain use cases where the console needs Local Admin permissions (e.g. for mounting files) but these use cases are 0.1% of all the users use cases!

[wishr]

Hi Christian,

Could you please share a screenshot of the message your users are getting for our better understanding?

Thanks

[ChuckS42]

Can confirm this happens when installing the console on a workstation as well.

[Gostev]

Looks like a bug with some plug-in. Does anyone have a support case open on this with the logs already uploaded?

[Gostev]

We could not reproduce this issue internally so are unable to move forward. So if anyone is actually interested in seeing this fixed, please share the support case ID for this issue. Live troubleshooting session may be required.

[christian.naenny]

The case number I had for this issue was Case # 05253335

[christian.naenny]

Hi Christian,
Could you please share a screenshot of the message your users are getting for our better understanding?
Thanks

How can I share a screenshot without using imgur.com or the like (to which I do not have access from within my corporate network)?

[Gostev]

No worries, I only needed a support case ID to pass to R&D.

[christian.naenny]

Hi Christian,
Could you please share a screenshot of the message your users are getting for our better understanding?
Thanks

Here you go:


This is after upgrading the console on the terminal server. I"m expecting the console to work after the upgrade. This makes it look like the user has to upgrade the console.

[wishr]

Hi Christian,

I've run through the case, the FR our TS engineers have created and the rest of the information. We've done a few tests and cannot confirm the described behavior.

Have you tried to launch the console at least once under a user with local administrator permissions after updating it? According to our QC team, after this, all users regardless of their permissions should be able to launch the console without any requests for elevation. A single launch with elevated permissions after upgrading is required for completing the installation of the updated console plugins. It's reasonable that this action should be carried out by the person performing the upgrade.

Thanks

[christian.naenny]

Hi Fedor,
Yes, we managed for the console to be usable in the past by starting it once by the (local admin) user who installed it. This usually did the trick and then the console was usable for the rest of the users without local admin.
But now (after the upgrade of Veeam B&R and the console to 11a) this is not enough anymore. The console asks every user to update the plugins on a user by user basis. This we cannot do as the useres are not supposed to have local admin rights on the terminal server where the console is installed to.
Regards, Christian

[wishr]

Hi Christian,

This is not the expected behavior. What version you have upgraded from?

Thanks

[christian.naenny]

I upgraded from V11 (11.0.0.837) to V11a (11.0.1.1261 P20211211)

[wishr]

Thank you.

Is the issue still present? If so, I'd ask our support management to reach you back and collect additional details because we cannot reproduce the issue and do not see any discrepancies in the code. Would this be possible?

[christian.naenny]

Well, since I opened the support case (#05253335) I have not changed the code either on the Veeam Server nor on the Terminal Server where the Console is installed to.
And no, it still does not work.
The server cluster the console was installed to consists of Windows Server 2016 Standard machines. No user (except the admins from the Win Server team and the technical user for Ivanti LAN Desk) has local admin privileges on this cluster.
Some background information: this is a HA RDP cluster spanned over 2 locations. Everyone is starting their applications on this cluster since this cluster is located in management network compartment. It's only possible to reach all the other machines in the network from this management compartment. I'm not able to connect to the Veeam Servers from my personal machine!

[wishr]

I highly doubt the clustering aspect affects the console upgrade behavior in any way. I'll speak to our TS leadership and ask them to reach you back shortly to continue the investigation. Stay tuned.

Upd: turned out there was an issue with the permissions on the registry of the machine hosting VBR Console. For future readers: if you face somewhat similar, please reach out to our technical support team for investigation.

Thanks

[tomatoschewps]

Hi,

We are in the process of setting up the Veeam console on RDSH servers to access several Veeam B&R servers from a secure zone and thus block more direct access to the Veeam B&R servers, but we are faced with a problem of admin rights request when launching the consoles.

If we start up the console in admin mode to update plugins while connecting to a Veeam B&R "X" server, we won't have to worry about future connections to this server.
However, as soon as we try to connect to another Veeam B&R server (Y, Z, ...), we'll again be asked to update the plugins.

If we perform the update when connecting to server "Y", it's OK again as long as we only connect to server "Y". If we try to connect to server "X" or "Z", we get another update request.

Is there anything I can do to avoid this?

Thanks

[tomatoschewps]

Update :
All my B&R servers was up to date but one pulgin (GCP) on one of my B&R servers was't on the same version as others.
Plugin updated, problem gone ^^