Comprehensive data protection for all workloads
Post Reply
Ultra_Cool
Expert
Posts: 127
Liked: 3 times
Joined: Oct 30, 2012 12:18 pm
Location: Helsingborg, Sweden
Contact:

Veeam in Domain eller Workgroup

Post by Ultra_Cool »

Hello,

I have a question about veeam design. What is best practice to have: veeam in domain or in workgroup? i am planning to start from scratch and I want that my clients share Veeam server.
It should be 3-4 clients per server. What is the best way to achive this without a lot of administrative work?

best regards
dellock6
Veeam Software
Posts: 6137
Liked: 1928 times
Joined: Jul 26, 2009 3:39 pm
Full Name: Luca Dell'Oca
Location: Varese, Italy
Contact:

Re: Veeam in Domain eller Workgroup

Post by dellock6 » 1 person likes this post

Hi, this is one of those never-ending debate, each solution has pros and cons. Just two of the best of them:
- Domain: you can better limit access to Veeam backups, since a backup administrator can read even files and data of all other users
- Workgroup: in a failover scenario, you can also loose active directory without having problems to run Veeam software. Otherwise, plan to offer high avaiability also to AD/DNS services so Veeam can start even during a disaster situation...

Luca.
Luca Dell'Oca
Principal EMEA Cloud Architect @ Veeam Software

@dellock6
https://www.virtualtothecore.com/
vExpert 2011 -> 2022
Veeam VMCE #1
Ultra_Cool
Expert
Posts: 127
Liked: 3 times
Joined: Oct 30, 2012 12:18 pm
Location: Helsingborg, Sweden
Contact:

Re: Veeam in Domain eller Workgroup

Post by Ultra_Cool »

Hi Luca,

Thank you for your fast reply! I think that better solution is workgroup. So there is no best practice what veeam recommends to use?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Veeam in Domain eller Workgroup

Post by Vitaliy S. »

Luca has pinpointed all the pros and cons correctly. There is no best practice, however I would prefer Domain configuration still, as it's much easier to manage backup server permissions and control access to the backup server. As to the workgroup question, I bet you will backup your AD/DNS VMs anyway, right?
Ultra_Cool
Expert
Posts: 127
Liked: 3 times
Joined: Oct 30, 2012 12:18 pm
Location: Helsingborg, Sweden
Contact:

Re: Veeam in Domain eller Workgroup

Post by Ultra_Cool »

Hi Vitaliy,

I want to backup 3-4 clients with one server because of that I think that is better to have it in workgroup or? I want that 3-4 client share one veeam server and not that every client have his own if it is possible?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Veeam in Domain eller Workgroup

Post by Vitaliy S. »

Yes, that's possible. Do you plan to give access to that backup server for your clients?
Ultra_Cool
Expert
Posts: 127
Liked: 3 times
Joined: Oct 30, 2012 12:18 pm
Location: Helsingborg, Sweden
Contact:

Re: Veeam in Domain eller Workgroup

Post by Ultra_Cool »

I want to protect them with one server and skip to have one server for each client? No i dont want that they have access (if they not ask/or need) only that i can restore itel-level or full if it's needed from one place. If is in workgroup so i need to run certificate-based authentication or?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Veeam in Domain eller Workgroup

Post by Vitaliy S. »

In this case it doesn't matter whether you install Veeam B&R in a Workgroup or Domain environment, just specify the vCenter Server connection account in the backup console and that's it.
Ultra_Cool wrote:If is in workgroup so i need to run certificate-based authentication or?
No, you do not need that.
Ultra_Cool
Expert
Posts: 127
Liked: 3 times
Joined: Oct 30, 2012 12:18 pm
Location: Helsingborg, Sweden
Contact:

Re: Veeam in Domain eller Workgroup

Post by Ultra_Cool »

Okej, thank you Vitaliy.
trackstar
Expert
Posts: 161
Liked: 4 times
Joined: Mar 11, 2013 9:47 pm
Contact:

[MERGED] Veeam Server part of a workgroup or domain

Post by trackstar »

Hello,

Curious what others have their Veeam Server as part of a domain or workgroup. Currently I have as workgroup but not sure if I will have any issue down the road.


TT
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Veeam in Domain eller Workgroup

Post by foggy »

Generally, both ways are equally supported. However, the considerations given above should be taken into account when planning either this or that deployment.
hoFFy
Service Provider
Posts: 183
Liked: 40 times
Joined: Apr 27, 2012 1:10 pm
Full Name: Sebastian Hoffmann
Location: Germany / Lohne
Contact:

Re: Veeam in Domain eller Workgroup

Post by hoFFy »

I have to dig this old thread out....

I have a discussion with a few of my colleagues:

WHat if I install Veeam on a VM which is a member of the domain and the Veeam services run under domain\Administrator and in case of desaster all DCs (in smaller environments the only one dc) are unavailable and the only vm that would come up again is the veeam vm... is it possible to restore the DCs if Veeams service accounts can't authenticate against the domain? What would be the best way in those circumstances? Can I just change the user of the veeam services to local admin? What's about the database installed by Veeam during setup - can Veeam still authenticate there when I would change it to local admin?
VMCE 7 / 8 / 9, VCP-DC 5 / 5.5 / 6, MCITP:SA
Blog: machinewithoutbrain.de
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Veeam in Domain eller Workgroup

Post by foggy »

Sebastian, yes, you can stop the services, change the account, give it corresponding rights on the database, and perform restore, given all the required resources including vCenter server and target storage are available (i.e. not added via the domain account).

Btw, if the Veeam B&R VM is available in case of DR, doesn't this mean that there's a DR host somewhere that could potentially host replicas of those DCs as well (or even secondary DC itself)?
hoFFy
Service Provider
Posts: 183
Liked: 40 times
Joined: Apr 27, 2012 1:10 pm
Full Name: Sebastian Hoffmann
Location: Germany / Lohne
Contact:

Re: Veeam in Domain eller Workgroup

Post by hoFFy »

Thanks Alexander!

Yes thats possible, but we often recycle old hosts by simply installing Win7 with Veeam on them, using the old local hard discs as a local repository and a new NAS as another repository. If there is an unused 2008 license its theoretically possible to install another DC... but best practices of Microsoft... leave the DC as a DC and don't install anything else on it. Otherwise we need another vSphere license to run a DC and Win 7 on the old host...
Especially in small environments its all about money and available licenses ;)
But yes, our bigger customers use several hosts with more than one DC, so failure of one DC is not a kind of big trouble...

You said in case of DR I have to give the local admin account rights on the database.. but how can I authenticate in SQL Manager, when there is no logon server?
VMCE 7 / 8 / 9, VCP-DC 5 / 5.5 / 6, MCITP:SA
Blog: machinewithoutbrain.de
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Veeam in Domain eller Workgroup

Post by foggy »

Well, you can assign rights beforehand. ;) Or use SQL authentication instead. Also, using local SQL server installed as a part of Veeam B&R installation helps in this case.
Anders
Enthusiast
Posts: 58
Liked: 12 times
Joined: Sep 09, 2010 9:45 am
Full Name: Anders Lorensen
Contact:

Re: Veeam in Domain eller Workgroup

Post by Anders »

Is there any functionality in Veeam that require it to be a domain member?

I'm thinking Veeam Explorers for AD/Exchange/Sharepoint/SQL ?
I know the enterprise manager's self service requires it, but if that is installed on a seperate domain-joined machine, it should not be a problem I guess?
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Veeam in Domain eller Workgroup

Post by foggy »

Anders, as you can see from this thread, there're no specific requirements in this regard. Regarding Enterprise Manager, there's one point that you should keep in mind is that Exchange items restore from it is only available for mailboxes that belong to users from the same forest as EM itself, so if it does not belong to any domain, you will not be able to perform Exchange items restores.
DizzzyD
Lurker
Posts: 1
Liked: never
Joined: Feb 28, 2020 8:55 am
Full Name: Dennis
Contact:

Re: Veeam in Domain eller Workgroup

Post by DizzzyD »

One question I do not see answered while working in a workgroup mode is:
Do Veeam Explorers for AD/Exchange/SQL/Oracle work?
(I assume trying to restore by Veeam Explorers Veeam will asks for domain credentials?)
nielsengelen
Product Manager
Posts: 5619
Liked: 1177 times
Joined: Jul 15, 2013 11:09 am
Full Name: Niels Engelen
Contact:

Re: Veeam in Domain eller Workgroup

Post by nielsengelen »

Veeam Explorers can work without a domain, they just open the specific backup dataset.
Personal blog: https://foonet.be
GitHub: https://github.com/nielsengelen
Post Reply

Who is online

Users browsing this forum: ante_704, Google [Bot], ybarrap2003 and 166 guests