Veeam Backup Enterprise Manager -> Security

[fgw]

i have setup two backup servers VB0 and VB1.
enterprise manager is installed on server VB0.

both servers have their jobs defind and are working. well, get some errors on some vm's but will post this issues later. for now i will focus on enterprise manager:

in enterprise manager i have configured both servers and i'm able to run data collection to get job info on all defined jobs for both servers. also if i start a job on a server locally this information is displayed in enterprise manager too.

i can start a job via enterprise manager if the job is located on server VB0 (the server also running enterprise manager) but im not able to start a job via enterprise manager if the job is located on the second server VB1!

Veeam Backup and FastSCP Service runs under the local user called LocalAdmin on each backup server. this user is also a member of Administrators.

i'm logged into enterprise manager with a domain user. no matter if i add this doman user to "Users and Roles ..." on VB1 i cant sart the jobs! also there is no additional user configured in "Users and Roles ..." on VB0 and everything is working fine there ...

what's wrong here? how to set this up correctly?

[Gostev]

Franz, you need to grant your domain account (the account you use to logon to the Enteprise Manager) Veeam Backup Operator or Veeam Backup Administrator role in the Users and Roles dialog on each Veeam Backup server. See page 79 and also page 90 of the User's Guide. Thank you.

[fgw]

Franz, you need to grant your domain account (the account you use to logon to the Enteprise Manager) Veeam Backup Operator or Veeam Backup Administrator role in the Users and Roles dialog on each Veeam Backup server. See page 79 and also page 90 of the User's Guide. Thank you.

anton, tried this already - unfortunately this does not change anything!

added the domain user as "Veeam Backup Administrator" and even restarted the "Veeam Backup and FastSCP Service" on this backup server, but i still get the dialoq to enter user credentials when i try to run start a job on this server from enterprise manager.

thought about this, when i checked the enterprise manager logfile VeeamBES.log as there is the domain user listed in the security context before the error is logged:

removed timestamp for readability

Code: Select all

Info     Initialize lifetime service of CTaskInvoker
Info     Launching job.
Info     Job parameters:
Info     {
Info         job name: [VM]
Info         backup server: [VB1]
Info         backup server DNS name (ip): [vb1]
Info         backup server port: [9392]
Info         SSO user security context: [DOMAIN\user]
Info     }
Info        User impersonating
Error    Failed to execute task: [132a630e-8b8a-472c-9eae-752b6b23bdfd].
Error    System.Security.SecurityException: Access denied.
Error    Server stack trace: 
Error       at Veeam.Backup.Service.CAccessChecker.DoCheck(IPrincipal principal, Permissions permission)
Error       at Veeam.Backup.Service.CJobManager.StartJob(Guid jobId)
Error       at Veeam.Backup.Service.CJobManagementService.Veeam.Backup.Interaction.Management.IJobManagementService.StartJob(Guid jobId)
Error       at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs)
Error       at System.Runtime.Remoting.Messaging.StackBuilderSink.PrivateProcessMessage(RuntimeMethodHandle md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs)
Error       at System.Runtime.Remoting.Messaging.StackBuilderSink.SyncProcessMessage(IMessage msg, Int32 methodPtr, Boolean fExecuteInContext)
Error    Exception rethrown at [0]: 
Error       at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
Error       at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
Error       at Veeam.Backup.Interaction.Management.IJobManagementService.StartJob(Guid idJob)
Error       at Veeam.Backup.EnterpriseServices.CBJobsLauncher.<>c__DisplayClass1.<RunJobs>b__0(IJobManagementService jobSvc)
Error       at Veeam.Backup.EnterpriseServices.CBJobsLauncher.QueuingTask(CBJobLaunchParams jobLaunchParams, CTaskCredentials creds, JobLaunchDelegate dlg)
Error       at Veeam.Backup.EnterpriseServices.CBJobsLauncher.RunJobs(CObjectLink[] jobIds, CTaskCredentials creds)
Error       at Veeam.Backup.EnterpriseServices.CTaskInvoker.Veeam.Backup.Interaction.Reporting.ITaskInvoker.Invoke(Guid taskId, CObjectLink[] links, CTaskCredentials creds)
Error    The Zone of the assembly that failed was:
Error    MyComputer

[Gostev]

Franz, it would be best if you contact our support with the logs. I believe this is environment-specific issue (some non-standard Windows security settings) here, as other customers never reported similar issues.