BP Veeam Proxy Domain Join

[Holster]

Out of Security and best practises, our Veeam Backup Server Infrastructure does not reside in our Domain, but we have a new Backup Proxy Server that is currently domain joined.
our engineering team is currently split between keeping this Proxy in the domain or joining it into a WORKGROUP, because (as far as I know) there is only a Connection from the Backup Server to the Proxy and no way from the Proxy to the Backup Server. Therefore, if the Proxy gets compromised, there would not be a way get into the Backup Server, to get to other components.

What would you say?

[Andreas Neufert]

Proxy transports data to the Repository Server.
The Backup Server communicates with both of them.
The Backup Server and the Proxy Servers communicate with VMware.

The risk you talk about is the fact that when a hacker can get Administrator rights on one of the system, the others might be affected.
For Veeam the servers do not have to be in the same Domain or Workgroup. So I would not even place them in the same workgroup.
Use individual accounts with different passwords. Do not join any server to the domain.
Then add each server with an individual user to Veeam.

[Holster]

Thank you very much, we will do that!