VM Permissions not Restored

[zidtugraz]

Hi all,

We are currently evaluating Veeam Backup & Replication 5.0.2.230 (64 Bit) on a Windows Server 2008 R2 SP1 (64 Bit). The environment we are backing up is a VMware vSphere 4.1 (Enterprise Edition) with ESXi 4.1 hosts and one vCenter Server 4.1. The management of our virtual infrastructure is decentralised, i.e., there are several administrators of virtual machines, where every administrator can only see his/her virtual machines.

We backed up several virtual machines, which worked like a charm. When restoring the virtual machines (expand a backup job in the "Backups" section, select a virtual machine, right-click and select "Restore entire VM"; options: on the same host as the original VM; new VM name; Default Resource pool; Restore disks as on original VM), the permissions for the virtual machine in vCenter are not set. I.e., the virtual machine is fully restored, but only the Administrator (plus a few other "system" users) will be able to access it.

Did we miss any options when backing up or restoring the virtual machine? Is it not possible to restore the permissions as well? (Does the vSphere API/SDK not provide any functions for this?)


Thanks in advance and best regards,
Josef.

[Vitaliy S.]

Hello Josef,

When VM is restored it receives a new ID number (moref) from vCenter Server, that is why it is treated as new VM, thus meaning you need to re-assign the permissions. On the other hand, have you tried restoring to a resource pool or vApp with security permissions in place? Were the permissions propagated?

Thanks.

[zidtugraz]

Hi Vitaly,

When VM is restored it receives a new ID number (moref) from vCenter Server, that is why it is treated as new VM, thus meaning you need to re-assign the permissions.

Which can be some effort with a large number of VMs and 20+ administrators ...

On the other hand, have you tried restoring to a resource pool or vApp with security permissions in place? Were the permissions propagated?

The permissions are inherited from parent objects, but that is not what we are looking for. We have, for instance, a cluster with 20 virtual machines. The administrator, a read-only user for Nagios and similar "system" accounts are defined on cluster-level and are inherited to all child objects (i.e., the VMs). The permissions for individual VMs are, however, defined on the VM-level. This means that users A and B, for instance, have permissions for VM-1, while users C and D only have permissions for VM-2, and A and D have permissions for VM-3. These permissions are initially assigned manually ... and it would be nice if they could be restored.


Best regards,
Josef

[Vitaliy S.]

Got it, thanks for the feedback.

[Bunce]

Full VM restore - ID retention
Refer above for other posters who have came across the same issue.

an option not to override the vmx file would be a useful addition, as the current workflow isn't 100% obvious.

[zidtugraz]

Hi,

http://www.veeam.com/forums/viewtopic.php?f=2&t=7968
refer above for other posters who have came across the same issue.

Thanks for that thread. Now it's obvious for me, why the permissions are not restored, and which other side-effects we will have to think of (e.g., setting up a backup job for the restored VM).


As a side note: I think it would be possible to implement backing up and restoring the permissions of virtual machines. See, for instance, http://www.vmware.com/support/developer ... gguide.pdf (pp. 42, Granting Privileges through Permissions).