Page 2 of 3

Re: VBR "users and role" utility

Veeam LogoPosted: Wed Jan 08, 2014 12:16 pm
by dragos.rosu
I really hope this post will eventually help someone. These days we had tried to find a way to implement "Users and Roles" Veeam feature into our environment (each of our VBRs are Win2k8 R2, 64 bit -mixed installation of Veeam 6.5 and Veeam 7 ) and we digged deep to find how.

Roles and functions In Veeam 7.0:
Veeam Restore Operator - Can perform restore operations using existing backups and replicas. ONLY
Veeam Backup Viewer - Has the “read-only” access to Veeam Backup & Replication — can view existing and performed jobs and review the job session details.
Veeam Backup Operator - Can start and stop existing jobs. BUT can't use Restore Option
Veeam Backup Administrator -Can perform all administrative activities in Veeam Backup & Replication.
Note:If you need a user to Start/Stop jobs and Restore u need to add it in "Users and Roles" Veeam feature two times - as Backup Operator and Restore Operator.

Note: Another thing we found out is when installing Veeam 6.0 and 6.5 it deploys the DB in MSSQL2005 and when we install Veeam 7.0 it deploys the DB in MSSQl2008R2, so we had two slightly different cases to configure.If you upgraded from 6.0 or 6.5 to 7.0 the DB remains the same in MSSQL2005.

1. For Veeam 6.0, 6.5, 7.0 with MSSQL2005:
-*-go to Veeam under Users and Roles and add the user you need access for.

-*-go to Computer Management->System Tools->Local Users and Groups ->Groups:
a. Add the user you need access for in the built-in group that is created by Veeam named: SQLServer2005MSSQLUser$VBR_NAme$VEEAM -> where VBR_name is the name of the computer where Veeam is installed;
b. Add the user to a remote users group if your environment has this;
c. Add the user to a group that can override security restrictions but is not Administrator, otherwise when you try to make a restore the user will have access only to the files from drive C: and on the rest of the drives it will get the Error: Access is Denied;
Note: I don't know exactly what kind of access must have the group from the point C. because we already had a built-in group only for restore purposes.
d. Finish, try to log in.

2. For Veeam 7.0 with MSSQL2008R2:
-*-go to Veeam under Users and Roles and add the user you need access for.

-*-go to Computer Management->System Tools->Local Users and Groups ->Groups:
a. Add the user u need acces for in the built-in group that is created by Veeam named: ServerMSSQLUser$VBR_Name$VEEAMSQL2008R2 -> where VBR_name is the name of the computer where Veeam is installed;
b. Add the user to a remote users group if your environment has this;
c. Add the user to a group that can override security restrictions but is not Administrator, otherwise when you try to make a restore the user will have access only to the files from drive C: and on the rest of the drives it will get the Error: Access is Denied.
Note: I don't know exactly what kind of access must have the group from the point C. because we had a build in group only for restore purposes.go to Veeam under Users and Roles and add the user you need acces for.

-*-Install Microsoft® SQL Server® 2008 Management Studio Express -> http://www.microsoft.com/en-us/download ... px?id=7593

-*-Login to the VeeamDB go to Security -> Logins -> New Login. At the Login - New page :
a.go to General -> Search and add the user you need access for;
b. go to User Mapping -> check the check-box at Map where the VeeamBackup is displayed, then database role membership for: VeeamBackup can be modified;
c. check db_owner at Database role membership for VeeamBackup;
d. Hit Ok and you Finished, try to log in.

Re: VBR "users and role" utility

Veeam LogoPosted: Wed Jan 08, 2014 12:20 pm
by Vitaliy S.
Dragos, thank you for re-using the existing topic and sharing this post with the community.

Re: VBR "users and role" utility

Veeam LogoPosted: Wed Jan 08, 2014 1:35 pm
by liviu.tutuianu
dragos.rosu wrote:c. Add the user to a group that can override security restrictions but is not Administrator, otherwise when you try to make a restore the user will have access only to the files from drive C: and on the rest of the drives it will get the Error: Access is Denied;
Note: I don't know exactly what kind of access must have the group from the point C. because we already had a built-in group only for restore purposes.
-> The built-in Backup Operators group is the most suitable..

@Dragos: Excellent work.

All the best,
Liviu

Re: VBR "users and role" utility

Veeam LogoPosted: Wed Jan 08, 2014 2:08 pm
by Andreas Neufert
Again thank you for sharing this. Looking forward to the next Call/Meeting. CU Andy

Re: VBR "users and role" utility

Veeam LogoPosted: Tue Jan 28, 2014 2:16 pm
by brunofernandez
thank you for sharing your information with us.
but I still recieve the User Account Control pop up and can't open the Veeam console with user whitch are not local admins :cry:

Edit: I also added the User Group to the Backup Operators local group but no chance

Re: VBR "users and role" utility

Veeam LogoPosted: Thu Feb 06, 2014 1:42 pm
by MarcoZ
brunofernandez wrote:thank you for sharing your information with us.
but I still recieve the User Account Control pop up and can't open the Veeam console with user whitch are not local admins :cry:

Edit: I also added the User Group to the Backup Operators local group but no chance

Some problem here and I don't want the Restore Operators to be local admin on the server.

Any idea how to get this to work?

Re: VBR "users and role" utility

Veeam LogoPosted: Thu Feb 06, 2014 2:11 pm
by Vitaliy S.
Local admin account is required to open Veeam backup console, however you can use Enterprise Manager to perform FLR restores. In this case you don't need to add your account to the local admin group on the backup server.

Re: VBR "users and role" utility

Veeam LogoPosted: Thu Feb 06, 2014 4:00 pm
by brunofernandez
Vitaliy S. wrote:Unfortunately, I'm not aware of any workarounds, but we are going to address this in the next releases.

Vitaliy said to me that they will resolv this problem in the next releases :wink:

Re: VBR "users and role" utility

Veeam LogoPosted: Fri Feb 07, 2014 10:18 am
by MarcoZ
Vitaliy S. wrote:Local admin account is required to open Veeam backup console, however you can use Enterprise Manager to perform FLR restores. In this case you don't need to add your account to the local admin group on the backup server.

but for Enterprise Manager you need enterprise licenses before you can use the restore option :(

Re: VBR "users and role" utility

Veeam LogoPosted: Fri Feb 07, 2014 10:22 am
by Vitaliy S.
Enterprise Manager itself does not require enterprise license edition, however in order to use 1-click FLR you should have either Enterprise or Enterprise Plus edition.

Re: VBR "users and role" utility

Veeam LogoPosted: Fri Feb 07, 2014 10:52 am
by MarcoZ
Vitaliy S. wrote:Enterprise Manager itself does not require enterprise license edition, however in order to use 1-click FLR you should have either Enterprise or Enterprise Plus edition.

Yeah that's the problem, we use Standard licenses. So for now I should give the restore operators local admin rights to the server. Hopefully this will be changed in future releases

Re: VBR "users and role" utility

Veeam LogoPosted: Tue Feb 11, 2014 1:53 pm
by Ben Milligan
Thank you, Dragos, for your post. We have created a KB article as well that describes these roles as well.

http://www.veeam.com/kb1853

Thanks!

[MERGED] Permissions

Veeam LogoPosted: Thu Feb 13, 2014 9:53 pm
by r1819m
I am trying to give a group of people read only access in Veeam. Which is a very easy setup in Veeam BUT the problem starts with local server access. I really do not want to give the local admin access but seems like i might have to in order to start veeam. I am hosting veeam on server 2008 R2. Anyone have any advise or know a fix? thanks!

Re: VBR "users and role" utility

Veeam LogoPosted: Fri Feb 14, 2014 5:29 am
by foggy
Ryan, please review this thread for some hints and feel free to ask if any clarification is required. Thanks.

Re: VBR "users and role" utility

Veeam LogoPosted: Fri Mar 11, 2016 5:58 pm
by wilkins44
Sorry to dig up an old post, but did the permissions change for some of the roles with V8?

I've got a group of operators that monitor the status and completion of our backup jobs. They will occasionally need to start or stop jobs, so Backup Operator is the role that they've got now. In V7 we gave them the Backup Operator role, and they were able to import and export tapes. We did the same thing for V8, but now they can't do the import or export. The only other change is that we are using the tape proxy feature on the repository instead of connecting the B&R up to the autoloader.

I'm able to import and export as an administrator, but I'd like to get things set up so I don't have to do this for them every week.

I'd rather not give them Restore Operator permissions since they don't do any restores, but if that's the only option...