Veeam B&R console needs admin rights to start

[pavela]

Launching B&R console always requires the administrator password. It doesn’t matter whether run locally on the B&R server, or remotely - from different computer.
From the User Guide: "The account used to start the Veeam Backup & Replication console must have the Local Administrator permissions on the machine where the console is installed."
When starting the console locally on the B&R server I can understand that more or less. By contrast, I do not understand the meaning of this requirement when you start the console remotely.
Since v9 B&R console connects through TCP port 9392. What is the point of having an ordinary client/console application that needs admin rights to work? From my standpoint, this app is useless for remote work. Our rules do not allow to daily work on accounts with admin privileges.

Pawel

[the_mentor]

I think the reason it need admin rights on the local workstation is because it needs permissions to mount restores in c:\VeeamFLR and a few other things.
Where i work we use regular accounts for day to day work and privileged accounts for other stuff so i just run the veeam console as the privileged account using run as a different user.

[foggy]

Correct, administrative rights are required for backup files mount (mount server component is installed as a part of remote console installation) and for reading some configuration settings from the registry. If you're not going to perform restores through the console, you can try to give the account rights to registry, probably this will work without elevation then (however, was not tested). Or just use the workaround mentioned above in case the need for restore arises.

[Gostev]

I've brought this up before v9 was released. Devs have done some research and we should be able to get rid of this requirement in future releases. Thanks!

[Steen]

Is there any plans for a version that works for non-admins (local computer)?

[foggy]

Hi Steen, yes, there are plans in this regard, please see above.

[Steen]

Nice to hear.
To bad Your support doesnt know this information (or wouldnt tell)

[Vitaliy S.]

Our support just doesn't know any time frames. Posting feature requests in these forums is definitely the best way to share your feedback and get understanding on the current feature state.

[HolgerE]

+1 for this feature request (launch Veeam B&R console without admin rights).
Is there already a time frame for the implementation?

[foggy]

Thank you for the feedback, however we cannot share any particular ETA.

[hyvokar]

Hi!

I have a scenario where I want our help desk to be able to login from RDS server to veeam backup server and check the backups.
For that I've installed VBR Console on our RDS server. However, starting the console requires elevation. Now I dont want to give admin rights to help desk staff on RDS server, so what should I do?

[Vitaliy S.]

Veeam backup console required local admin access on the server, please review this topic for more info. On a side note, can you please tell us what actions/operations your help desk staff should do within the backup console?

[hyvokar]

Primarily just to check that the backups are OK. I have assigned only viewer role for them.

[hyvokar]

Correct, administrative rights are required for backup files mount (mount server component is installed as a part of remote console installation) and for reading some configuration settings from the registry. If you're not going to perform restores through the console, you can try to give the account rights to registry, probably this will work without elevation then (however, was not tested). Or just use the workaround mentioned above in case the need for restore arises.

So where exactly should I add permissions?

[Vitaliy S.]

If you need to check whether backups are OK or not, then you can use Veeam ONE that has Veeam B&R monitoring and reporting built-in.

[foggy]

You can right-click Veeam B&R hive in registry editor, select Permissions and give rights to corresponding accounts. However, again, we haven't tested Veeam B&R console operation without elevation.

[hyvokar]

If you need to check whether backups are OK or not, then you can use Veeam ONE that has Veeam B&R monitoring and reporting built-in.

No i cant.

[hyvokar]

You can right-click Veeam B&R hive in registry editor, select Permissions and give rights to corresponding accounts. However, again, we haven't tested Veeam B&R console operation without elevation.

Well can you test it?
Server\users has a read permissions to hklm\software\veeam , should that be enough?

[foggy]

Yes, read access should be enough.

[hyvokar]

It's still asking for elevation

[foggy]

Seems that permissions are required regardless of whether you're going to perform restores or not then and my assumption on the first page was not correct.

[hyvokar]

If you need to check whether backups are OK or not, then you can use Veeam ONE that has Veeam B&R monitoring and reporting built-in.

I dont have license for veeam ONE.

[Vitaliy S.]

That's a pity, in this case try to take a look at Enterprise Manager that should give basic information about job states, maybe it can help in your case.

[Tech471]

Another idea is to enable email notifications and check the "Notify on warning" and "Notify on failure" boxes under Options > Email settings.

Speaking of which I have a quick question re: warnings vs failures. If a job throws the warning "Guest processing skipped" isn't this essentially the same as a failure? If not what exactly is the difference?

[Vitaliy S.]

Hank, It depends on your setting defined over here, it can be both a failure and a warning > Application-Aware Processing

[hyvokar]

That's a pity, in this case try to take a look at Enterprise Manager that should give basic information about job states, maybe it can help in your case.

Hi!

We cannot use EM, since it totally messes up our restoration process.

[Vitaliy S.]

Can you please clarify that? You can use EM for monitoring, and keep doing restores with your current approach.

[hyvokar]

Our restores via guest interaction proxies will stop functioning, if we install EM. We tried to found the reason for that with your support but with no success. The problem went away the moment we uninstalled EM.

[Vitaliy S.]

In this case I would suggest to re-open a ticket with our support team to find out the reason for this behavior (or try to deploy EM on another machine, not on the backup server).

[salzsieder]

Are there plans to provide the Veeam console without admin rights? We have absolutely no possibility to assign local administrative rights. With > 240 sockets licensed this is very unfortunate. Thanks.