VBR v13 appliance not joined to domain cannot add AD objects to Protection group

[jancernohorsky]

Hi,
I have a tricky question, maybe a discovery, maybe a misunderstanding.
Best practice is not to have the VBR server connected to the domain.

With v12, I was able to connect objects from the ActiveDirectory domain when creating a Protection group by simply filling in the domain (domain controller) and the service account from the domain in the wizard. The objects loaded normally, I selected what I needed and everything works as it should.
According to the documentation, the username is entered in the form "DOMAIN\account".
So much for v12, which is installed on a Windows Server outside the domain.

With v13, which I now have installed as an appliance (i.e. it runs on Linux), the same operation ends with an error.
Accordingly, if I use a username in the form "accout@FQDN" (UPN), the objects will be loaded from the domain, but adding them further and the test will fail, because according to the documentation, usernames should be in the form "DOMAIN\account".
The appliance is not connected to the domain according to best practice.
In other words, I am not able to connect objects from Active Directory to the Protection group in v13.

I am just guessing, from previous experience with Linux, that without a correct configuration of sssd/kerberos it will not be possible to connect to the domain at all. But I am just guessing.

Has anyone encountered this before? Has anyone solved this?

[Dima P.]

Hello Jan and welcome to the forums!

It's not required to join the Veeam Software Appliance to domain in order to add Active Directory protection groups.

The AD environment however requires properly configured Kerberos infrastructure then you can use username@fqdn or fqdn\username format for AD credentials within protection group.

Can you please share the error you got while adding domain objects to the protection group and the support case ID where we can find debug logs? Thank you!

[jancernohorsky]

Hi,
thanks for the reply.
Sure, I'll share the error with a description of how I got it to work. I haven't tested the behavior of the MSSQL cluster with this login 100% yet, so far I've only managed to create a Protection Group .

I could manage it this week, or possibly over the weekend.

Have a nice day, John