Permissions

Setup Account

The account used for product installation must have the local Administrator permissions on the target machine.

Veeam Backup & Replication Console Permissions

When you open the Veeam Backup & Replication console for the first time or after a cumulative patch is installed on the backup server, you must run the console under an account with the local Administrator permissions on the machine where the console is installed. In other cases, you can run it under an account that is a member of the Users group on the machine where the console is installed. However, you may require additional permissions to recover guest OS files of Microsoft Windows VMs.

[For recovery of Microsoft Windows VM guest OS files] If you plan to save files to a new location, the user who launched the Veeam Backup & Replication console does not have permissions to read and write data to the new location, and the mount point is located on the same machine as the Veeam Backup & Replication console, check that the user has the SeBackupPrivilege and SeRestorePrivilege. For more information on where mount points are created, see Mount Points and Restore Scenarios.

Accounts that are members of the Protected Users Active Directory group cannot be used to access the backup server remotely over the Veeam Backup & Replication console. For more information, see Microsoft Docs.

Veeam Backup Service Account

The account used to run the Veeam Backup Service must be a LocalSystem account or must have the local Administrator permissions on the backup server.

Microsoft SQL Server
(where the configuration database is stored)

You require different sets of Microsoft SQL permissions in the following cases:

• Installation (remote or local): current account needs CREATE ANY DATABASE permission on the SQL server level. After database creation this account automatically gets a db_owner role and can perform all operations with the database. If the current account does not have this permission, a Database Administrator may create an empty database in advance and grant the db_owner role to the account that will be used for installing Veeam Backup & Replication.
• Upgrade: current account should have sufficient permissions for that database. To grant these permissions through role assignment, it is recommended that you use the account with db_owner role.

• Operation: the Backup Service and Cloud Connect Service must have access to the remote SQL instance. The account that runs Veeam Backup Service requires db_datareader and db_datawriter roles as well as permissions to execute stored procedures for the configuration database on the Microsoft SQL Server. Alternatively, you can assign the db_owner role for this database to the service account.

For more information, see Microsoft Docs.

Source/Target Host

Root permissions on the ESXi host.

If the vCenter Server is added to the backup infrastructure, an account that has administrative permissions is required.
You can either grant the Administrator role to the account or configure granular vCenter Server permissions for certain Veeam Backup & Replication operations in the VMware vSphere environment. For more information, see the Required Permissions Reference.

Windows Server
added to the backup infrastructure

The user account that you use to add a Microsoft Windows server must be in the local administrators group (on the server being added).

Linux Server
added to the backup infrastructure

Permissions for the account that you specify when adding a Linux server differ depending on the role that you plan to assign to this server:

• Roles for which Veeam Data Movers must be persistent (VMware backup proxy, hardened repository) require root or equivalent permissions. For the full list of roles, see Veeam Data Movers.
• Gateway server that communicates with NFS share requires root or equivalent permissions.
• Backup repository requires read and write permissions on the folder where backups will be stored. You will configure this folder at the Configure Backup Repository Settings step of the backup repository wizard.
• Other roles require read and write permissions on files and folders with which the server will work.

SMB Backup Repository

Write permission on the target folder and share.

Microsoft SQL Server

To back up Microsoft SQL Server data, the user whose account you plan to use must be:

• Local Administrator on the target VM.
• System administrator (has the Sysadmin role) on the target Microsoft SQL Server.

If you need to provide minimal permissions, the account must be assigned the following roles and permissions:

• SQL Server instance-level role: public and dbcreator.
• Database-level roles and roles for the model system database: db_backupoperator, db_denydatareader, public;
  for the master system database — db_backupoperator, db_datareader, public;
  for the msdb system database — db_backupoperator, db_datareader, public, db_datawriter.
• Securables: view any definition, view server state, connect SQL.

Microsoft Active Directory

To back up Microsoft Active Directory data, the account must be a member of the built-in Administrators group.

Microsoft Exchange

To back up Microsoft Exchange data, the account must have the local Administrator permissions on the machine where Microsoft Exchange is installed.

Oracle

The account specified at the Guest Processing step must be configured as follows:

• For a Windows-based VM, the account must be a member of both the Local Administrator group and the ORA_DBA group (if OS authentication is used). In addition, if ASM is used, then such an account must be a member of the ORA_ASMADMIN group (for Oracle 12 and higher).
• For a Linux-based VM, the account must be a Linux user elevated to root. The account must have the home directory created.

To back up Oracle databases, make sure the account specified on the Oracle tab has been granted SYSDBA privileges. You can use either the same account that was specified at the Guest Processing step if such an account is a member of the ORA_DBA group for a Windows-based VM and OSASM, OSDBA and OINSTALL groups for a Linux-based VM, or you can use, for example, the SYS Oracle account or any other Oracle account that has been granted SYSDBA privileges.

To perform guest processing for Oracle databases on Linux servers, make sure that the /tmp directory is mounted with the exec option. Otherwise, you will get an error with the permission denial.

Microsoft SharePoint

To back up Microsoft SharePoint server, the account must be assigned the Farm Administrator role.

To back up Microsoft SQL databases of the Microsoft SharePoint Server, the account must have the same privileges as that of Veeam Explorer for Microsoft SQL Server.

DEFAULT

readonly

cluster

readonly

metrocluster

readonly

fcp

readonly

file

readonly

igroup

all

iscsi

all

network

readonly

node

readonly

security

readonly

security login

readonly

set

readonly

snapmirror

all

system

readonly

version

readonly

qtree

readonly

lun

all

nfs

all

snapshot

all

volume

all

vserver

all

DEFAULT

none

lun

all

lun igroup

all

network

readonly

security

readonly

security login

readonly

snapmirror

all

system

readonly

version

readonly

volume

all

volume file

readonly

volume qtree

all

volume snapshot

all

vserver

all

vserver fcp

all

vserver iscsi

all

vserver nfs

all

DEFAULT

readonly

security

readonly

security login

readonly

volume snapshot

all

vserver

all

vserver nfs

all

DEFAULT

none

lun

readonly

network

readonly

security

readonly

security login

readonly

snapmirror

readonly

version

readonly

volume

readonly

volume snapshot

all

vserver

all

cluster

readonly

lun

all

metrocluster

readonly

network

readonly

system license

readonly

system node

readonly

version

readonly

volume

all

volume snapshot

all

vserver

all

lun

all

network

readonly

version

readonly

volume

all

volume snapshot

all

vserver

all