Make sure that user accounts that you plan to use have permissions described in the following sections:
- Installing and Using Veeam Backup & Replication
- Using Virtualization Servers and Hosts
- Performing Guest Processing
- Using Amazon S3 Object Storage
The accounts used for installing and using Veeam Backup & Replication must have the following permissions.
The account used for product installation must have the local Administrator permissions on the target machine.
Veeam Backup & Replication Console Permissions
The account used to start the Veeam Backup & Replication console must have the local Administrator permissions on the machine where the console is installed.
To perform file-level restore for Microsoft Windows VMs, the account must have the following permissions and privileges:
In most environments, SeBackupPrivilege and SeRestorePrivilege are assigned to user accounts added to the Administrators group. For more information, see Microsoft Docs.
Accounts that are members of the Protected Users Active Directory group cannot be used to access the backup server remotely over the Veeam Backup & Replication console. For more information, see Microsoft Docs.
Veeam Backup Service Account
The account used to run the Veeam Backup Service must be a LocalSystem account or must have the local Administrator permissions on the backup server.
Microsoft SQL Server
You require different sets of Microsoft SQL permissions in the following cases:
The following are required permissions to work with virtualization servers and hosts during data protection tasks.
Root permissions on the ESXi host.
If the vCenter Server is added to the backup infrastructure, an account that has administrative permissions is required.
Linux Backup Repository
Root or equivalent permissions.
SMB Backup Repository
Write permission on the target folder and share.
To use guest OS processing (application-aware processing, pre-freeze and post-thaw scripts, transaction log processing, guest file indexing and file exclusions), make sure to configure your accounts according to the requirements listed in this section. For more information on guest processing, see Guest Processing.
All user accounts used for guest processing must have the following permissions:
- Logon as a batch job granted
- Deny logon as a batch job not set
Other permissions depend on applications that you back up. You can find permissions for backup operations in the following table. For restore operation permissions, see Required Permissions sections in the Veeam Explorers User Guide.
To back up Microsoft SQL Server data, the following roles must be assigned:
If you need to provide minimal permissions, the account must be assigned the following roles and permissions:
To back up Microsoft Active Directory data, the account must be a member of the Domain Admins group.
To back up Microsoft Exchange data, the account must have the local Administrator permissions on the machine where Microsoft Exchange is installed.
The account specified at the Specify Guest Processing Settings step must be configured as follows:
To back up Oracle databases, make sure the account specified on the Oracle tab has been granted SYSDBA privileges. You can use either the same account that was specified at the Specify Guest Processing Settings step if such an account is a member of the ORA_DBA group for a Windows-based VM and OSASM, OSDBA and OINSTALL groups for a Linux-based VM, or you can use, for example, the SYS Oracle account or any other Oracle account that has been granted SYSDBA privileges.
To back up Microsoft SharePoint server, the account must be assigned the Farm Administrator role.
To back up Microsoft SQL databases of the Microsoft SharePoint Server, the account must have the same privileges as that of Veeam Explorer for Microsoft SQL Server.
Consider the following general requirements when choosing a user account:
- [For guest OS file indexing] For Windows-based workloads, choose an account that has administrator privileges. For Linux-based workloads, choose an account of a root user or user elevated to root.
- If Veeam Backup & Replication has to perform networkless guest processing over VMware VIX/vSphere Web Services, check that UAC is disabled on VM guest OS and the specified account has local Administrator permissions in addition to the permissions listed in the table. For more information on how to disable UAC, see this Veeam KB article.
- When using Active Directory accounts, make sure to provide an account in the DOMAIN\Username format.
- When using local user accounts, make sure to provide an account in the Username or HOST\Username format.
- To process a Domain Controller server, make sure that you are using an account that is a member of the DOMAIN\Administrators group.
- To back up a Read-Only Domain controller, a delegated RODC administrator account is sufficient. For more information, see this Microsoft article.
The following are required permissions to use Amazon S3 object storage with immutability disabled.
Make sure the account you are using has access to Amazon buckets and folders.
The following are required permissions to use Amazon S3 object storage with immutability enabled. For more information on immutability, see Immutability.
For permissions required for Veeam Backup Enterprise Manager, see Required Permissions in the Enterprise Manager User Guide.