VEEAM services service account goes back to Local System on proxy servers after upgrade

[sasilik]

We have VEAAM proxy servers where Data mover account runs under domain user account. After every upgrade I must go through all proxy servers and change service account back to domain user account because every upgrade changes service account back to Local System account. On the VEEAM server itself the service accounts stays as they are after the upgrade. Why can't proxy components upgrade retain the account under which services run? Or am I doing something wrong when I do upgrade. I have always checked the "Update remote components automatically" checkbox when upgrading.

[TshepoM]

Hi

When perfoming the upgrade do you use the domain account and also during upgrade there is a part where it asks which account to use are
you choosing the domain account?

Regard

[sasilik]

I am using domain admin account when doing upgrade and I have no recollection that upgrade would ask any information about accounts during the process. At least last couple upgrades, 4a and 4b. Before that the setup process detected the VEEAM service account and I left it as it was.

[PetrM]

Hi Markko!

This is the behavior by design.
Proxy upgrade implies the new installation of updated components. Local System is the only possible option to start services after the new installation otherwise it would be required to ask for credentials during components upgrade and such dialog was not implemented.

Thanks!

[sasilik]

What is then difference between the server where I ran setup and proxy server. On both server I see in event viewer that:
Windows Installer removed the product. Product Name: Veeam Backup Transport. Product Version: 9.5.4.2753.
...
Windows Installer installed the product. Product Name: Veeam Backup Transport. Product Version: 9.5.4.2866.
...

But on local server the service account remains same and I don' have to change it back even when there is also new installation of this component.

[PetrM]

Yes, that's right because upgrade mechanism is different in these 2 cases.

On Veeam B&R server, it just updates the existing version of the service preserving its startup options.
Data Mover is considered as removed from Windows perspective however Data Mover binaries remain on the disk as a part of the whole Veeam B&R installation.
That's why Windows Installer triggers mentioned events to appear in the Event Viewer.

Thanks!

[sasilik]

On both servers there is Transport component installed. Data mover service runs constantly and on both servers it runs under domain account. On both servers data mover service is stopped, old version is removed, same msi file is executed silently and new transport service files are installed and data mover service is started. I guess there must be some deep technical difference if it behaves differently but I fail to understand it.

[PetrM]

Hi Markko,

The main difference is that Veeam Data Mover (Veeam Backup Transport) component is deployed as independent product on proxy server. In this case, components upgrade process includes full uninstall of the product with deletion of its binaries from disk and removing of Veeam Data Mover service itself. The service is recreated during the new installation of Veeam Data Mover and is running under Local System because there is no dialog to specify credentials.

However, Veeam Data Mover component is referenced by other installed Veeam products on Veeam B&R server (Veeam B&R, Veeam B&R Console, EM) so it's not possible to remove component binaries from disk and to remove the service itself despite the uninstall of Veeam Data Mover as a product (you see the corresponfing event in Windows Event Viewer). Binaries are replaced and service is restarted under the same account as it had been using before components upgrade.

Thanks!

[mweissen13]

Hello Markko!
While I understand your problem and that it's really inconvenient. Could you please elaborate on why you would want the service to run with a domain user in the first place? In other words what is the use case or benefit of that?

[sasilik]

Thank you PetrM for clarifications. Searched for additional information and it sure be seems that it is by design. For example https://stackoverflow.com/questions/269 ... d-password
I guess I use some information found from https://stackoverflow.com/questions/313 ... ce-account and make a script to change the account and password for services.

For mweissen13, we have Datadomain box holding files(NFS and CIFS shares) from which we do backups and I was not able to get access to files when services were using local system account. So the need for separate domain account.