Comprehensive data protection for all workloads
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Vitaliy S. »

Hi George,

Cannot speak for all companies, but many of them are using Veeam ONE or Enterprise Manager to give access to the helpdesk/monitoring engineers.

Hope this helps!
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Veeam B&R console needs admin rights to start

Post by foggy »

George_Washington wrote: Oct 26, 2018 12:21 pm Any idea to when Veeam Console will be released without the need for "local admin"-privileges?
Unfortunately, we cannot give any particular ETA for this feature at this stage.
Fenris
Novice
Posts: 4
Liked: 1 time
Joined: Oct 25, 2018 6:55 pm
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Fenris »

We have the same issue, a fix would be appreciated!
George_Washington
Influencer
Posts: 12
Liked: 1 time
Joined: Nov 10, 2017 9:10 am
Full Name: veeamuser001

Re: Veeam B&R console needs admin rights to start

Post by George_Washington »

Vitaliy S. wrote: Oct 26, 2018 12:59 pm Cannot speak for all companies, but many of them are using Veeam ONE or Enterprise Manager to give access to the helpdesk/monitoring engineers.
Hello Vitaly,

I have to agree that the Enterprise Manager has certain features that are usefull for a backup & restore-engineer, but it misses out on a lot of features the Windows Client has. For instance not being able to restore a virtual machine with a different name, so that the original one (that might be broken) sits next to the newly restored (though renamed) virtual machine.

For now we have implemented and intermediary fix, but it's suboptimal.
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Vitaliy S. »

Ok, thanks for the follow up. BTW, do you mind sharing your solution with Fenris who asks for a "fix" for that? ;)
George_Washington
Influencer
Posts: 12
Liked: 1 time
Joined: Nov 10, 2017 9:10 am
Full Name: veeamuser001

Re: Veeam B&R console needs admin rights to start

Post by George_Washington » 1 person likes this post

My sincere apologies for not sharing my "fix".

What I did was create a few virtual machines with Windows Server 2016 and Veeam Console, that sits between our Veeam-environment and the backup/restore-engineers. It's suffice to say that we locked everything down from a network perspective, because on the VM all backup/restore-engineers need (or should is say Veeam Console) "local admin"-privileges.
EmpTee
Novice
Posts: 9
Liked: never
Joined: Feb 04, 2016 2:14 am
Contact:

Re: Veeam B&R console needs admin rights to start

Post by EmpTee »

While we are on the topic of delegating permissions, it would be incredibly useful to be able to delegate starting a configured backup job to a normal user (not backup admin).

I have devs working that need to be able to easily rollback major changes to development environments via a veeam restore.

I can delegate the restore process to them via Veeam Enterprise Manager, but am unable to delegate starting the backup job to them. This means support always has to be available to initiate a manual backup as required.

If i'm allowing a dev to restore an entire VM, why can't I allow them to back it up too (unless i'm missing an obvious way to do this)?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Vitaliy S. »

Hi EmpTee,

Have you considered using Quick Backup function (see the portal user role section) in this case? For example, your dev team can initiate it at any time when they need to do some tests and create a backup.

Thanks!
EmpTee
Novice
Posts: 9
Liked: never
Joined: Feb 04, 2016 2:14 am
Contact:

Re: Veeam B&R console needs admin rights to start

Post by EmpTee »

Hi Vitaly,

Didn't realise the quick backup option was available.

Is there a way to delegate only initiating backup jobs, and not allowing restores at all?

Thanks
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Vitaliy S. »

Not that i can think of, but you can potentially limit the restore types for these users.
mephisto
Expert
Posts: 121
Liked: 7 times
Joined: Nov 07, 2012 6:49 pm
Full Name: Mephisto poa
Contact:

[MERGED] best practices to access veeam console and security for techs

Post by mephisto »

Hi guys,

I'm wondering if there are best practices recommended to manage Veeama backup servers as I noticed we can't run the console without admin rights for example and I think the web interface it part of enterprise product which at the moment we have no requirement. I've checked https://bp.veeam.expert/ but no luck finding what I'm after.

What are the best methods for letting people run Veeam console to manage backups/restores without needing admin access to the machine they run the console? Normally we allow people to RDP into the server that has the management console installed for example.

Any suggestions would be really appreciated :)
DGrinev
Veteran
Posts: 1943
Liked: 247 times
Joined: Dec 01, 2016 3:49 pm
Full Name: Dmitry Grinev
Location: St.Petersburg
Contact:

Re: best practices to access veeam console and security for techs

Post by DGrinev » 1 person likes this post

Hi Mephisto,

We have this on the roadmap to change the said requirement in the future releases.
Please review this big thread for additional information. Thanks!
mephisto
Expert
Posts: 121
Liked: 7 times
Joined: Nov 07, 2012 6:49 pm
Full Name: Mephisto poa
Contact:

Re: Veeam B&R console needs admin rights to start

Post by mephisto »

the only other way around would be the enterprise console to have that web interface then?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Vitaliy S. »

Yes, that's correct (still a FR), or you can use VAC or Veeam ONE (depending on your scenario).
Andrew1344
Novice
Posts: 5
Liked: never
Joined: Feb 24, 2012 3:03 pm
Full Name: andrew
Contact:

[MERGED] Windows Permissions for Backup Console

Post by Andrew1344 »

Hello ALL,

I am trying to give users access to the Veeam Console without making the user an administrator on the underlying os. Basicall I want to allow the user to open the console but have no access to the OS itself. Any suggestions?
bdufour
Expert
Posts: 206
Liked: 41 times
Joined: Nov 01, 2017 8:52 pm
Full Name: blake dufour
Contact:

Re: Windows Permissions for Backup Console

Post by bdufour » 2 people like this post

this topic has been beat to death, you can search through the forums. you may give them access to enterprise manager or veeam one for monitoring purposes, but you cant give them access to the console without the user being an admin on the underlying OS bc the account needs to mount files. veeam is working to make it so that this isnt a requirement in future releases.
lkooe
Lurker
Posts: 1
Liked: never
Joined: Apr 08, 2019 9:19 am
Full Name: LKOOE
Contact:

Re: Veeam B&R console needs admin rights to start

Post by lkooe »

Until now the Backup Console worked without admin rights (under Windows10 or Windows Server 2016/19 only with UAC disabled). In larger environments this is necessary, because not every backup operator has admin rights. Since 9.5 update 4 the restore without admin rights does not work anymore, the cryptic error "Value cannot be null Parameter name: disposableObject" occurs.
This is unprofessional. When will the use of the backup console without admin rights finally be officially supported?
foggy
Veeam Software
Posts: 21069
Liked: 2115 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Veeam B&R console needs admin rights to start

Post by foggy »

Have you tried to perform the same restore operation under account with administrative rights and it succeeded?
powersjo
Influencer
Posts: 23
Liked: 7 times
Joined: Jun 07, 2016 12:35 pm
Full Name: Jonathan Powers
Location: United States
Contact:

Re: Veeam B&R console needs admin rights to start

Post by powersjo »

+1 please make this feature available so local users don't need admin rights to run the veeam backup and replication console.
Thank you,
- Powersjo :mrgreen:

https://powersjo.com/veeam
Sloan
Enthusiast
Posts: 27
Liked: 2 times
Joined: Jan 14, 2013 6:40 pm
Full Name: Sloan Essman
Location: Houston, TX
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Sloan »

I'm watching this too because when I was running the 9.5 Update 3 version of the console I could run from my VDI or PC without providing admin credentials but after it installed update 4b I'm having to provide admin credentials.

Where I'm at we don't just have an admin account on our desktops. We have to request it (for 24 hours) then log off and back on and get a generated password for the local administrator account... Then any operations in the console reflect as "pc_name\administrator" and it's difficult to track who is doing what to the environment.
Sloan Essman
Lead Specialist - Backups and Data Protection
Energy Transfer Partners
Regnor
Veeam Software
Posts: 934
Liked: 287 times
Joined: Jan 31, 2011 11:17 am
Full Name: Max
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Regnor »

+1

I didn't even know that you need administrative rights until now.
We advise customers that they can use the console from their desktops in order to manage Veeam.
And often there's non-technical personal which only needs to manage/export tapes, so they should have no access to the backup server itself and of course also don't have local admin rights.
BrianBuchanan
Enthusiast
Posts: 52
Liked: 9 times
Joined: Nov 29, 2019 12:56 pm
Full Name: Brian Buchanan
Contact:

Re: Veeam B&R console needs admin rights to start

Post by BrianBuchanan » 2 people like this post

I have two work-arounds

Batch File

Save this as a batch file to launch the console without elevating:

Code: Select all

set __COMPAT_LAYER=RunAsInvoker
start "Veeam Backup & Replication Console" "C:\Program Files\Veeam\Backup and Replication\Console\veeam.backup.shell.exe"
Application Compatibility Toolkit

This does the same thing as the batch file, for anyone launching veeam.backup.shell.exe on the machine using the Application Compatibility Database. It requires more setup to create the Application Compatibility Database, which then needs to be distributed and installed, but doesn't need a batch file. This is more "corporate" as this might be used for more difficult programs needing more compatibility fixes.

Setup:
1. Download the latest Windows Assessment and Deployment Kit (ADK)
- https://docs.microsoft.com/en-us/window ... dk-install
1a. Install only the Application Compatibility Tools

Create the Compatibility Database:
1. Launch the Compatbility Administrator (64-bit) (As Administrator)
2. Right-Click the Untitled entry under Custom Databases
2a. Create New Application Fix
3. Name: Veeam Backup & Replication Console
3a. Name of the vendor: Veeam
3b. Program file location: C:\Program Files\Veeam\Backup and Replication\Console\veeam.backup.shell.exe
4. Next past the "Compatibility Modes" dialog
5. On Compatiblity Fixes, select "RunAsInvoker", Next
6. Finish
7. Click Save
7a. Name the database "Veeam"
7b. Save the file as Veeam.sdb
8. Optional: Install the Database and Test
8a. Right-Click on the Veeam database and choose Install
8b. Launch Veeam, notice no prompt for Admin rights.

Deploy the compatibility database (on the same machine or any other machine)
1. Install the sdb with the Application Compatibility Database Installer (included with Windows, not part of the ADK)
1a. Elevated Command Prompt
1b. sdbinst.exe veeam.sdb
- https://docs.microsoft.com/en-us/window ... -line-tool

Disclaimer, use at your own risk.
This is not endorsed by Veeam and I have no idea what problems could arise, eg. executing restores.

References:
https://www.nirsoft.net/articles/run_ap ... ation.html
Gostev
Chief Product Officer
Posts: 31455
Liked: 6646 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Gostev » 7 people like this post

As far as the feature request itself, we're now working on adding this capability to the next major release. Thanks!
c.schulzejn
Enthusiast
Posts: 53
Liked: 3 times
Joined: Oct 24, 2018 8:22 am
Full Name: Christoph Schulze
Contact:

Re: Veeam B&R console needs admin rights to start

Post by c.schulzejn »

Thx Gostev!

Local VAW Console is started w/o admin rights in first place. If you need to perform administrative tasks (e.g. edit job, restore files) it asks for more permission. I am exptecting something similar for VBR, maybe you can reuse some of the VAW code :)
cherzyk
Lurker
Posts: 2
Liked: never
Joined: May 29, 2020 6:55 am
Contact:

Re: Veeam B&R console needs admin rights to start

Post by cherzyk »

Gostev wrote: May 01, 2020 3:23 pm As far as the feature request itself, we're now working on adding this capability to the next major release. Thanks!
So, with major release you are talking about 11.0 or about 10.1?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Vitaliy S. »

Major is 11, 10.1 is a minor. release. Thanks!
cherzyk
Lurker
Posts: 2
Liked: never
Joined: May 29, 2020 6:55 am
Contact:

Re: Veeam B&R console needs admin rights to start

Post by cherzyk »

So we are talking a time frame of like 2+ years, judging from the lifespan of 9.x.
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Vitaliy S. »

I don't want to speculate on this, but I would recommend joining our VeeamON 2020 (free online event) to know more about our upcoming releases.
Gostev
Chief Product Officer
Posts: 31455
Liked: 6646 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Veeam B&R console needs admin rights to start

Post by Gostev »

cherzyk wrote: May 29, 2020 10:58 amSo we are talking a time frame of like 2+ years, judging from the lifespan of 9.x.
Our major release cadence is annual, and those multiple yearly 9.5 updates were major releases. Bad naming though, and we're no longer using it starting last year.
morrisng
Veeam Software
Posts: 155
Liked: 3 times
Joined: Jun 19, 2020 2:30 am
Full Name: Morris Ng
Contact:

Re: Veeam B&R console needs admin rights to start

Post by morrisng »

Same problem that our client was facing, due to the security compliance, the local administrator right is restricted to user. I would like to know what is the minimum user privilege to perform the following operation using Veeam console / Enterprise Manager?

Manually Start/Stop PC Backup Jobs
Modify Backup Policy settings
Create/Delete/Modify Protection Group
Create/Delete/Modify Gateway Server settings
Add/Delete/modify DataDomain Repository

Thanks!
Post Reply

Who is online

Users browsing this forum: Bing [Bot], Google [Bot] and 149 guests