Connection to Veeam Backup & Replication Servers

The account used to connect Veeam Backup & Replication or Veeam Backup Enterprise Manager servers must:

Have the Veeam Backup Administrator role assigned.

This role must be assigned to the account on the machine that run Veeam Backup & Replication. If you connect Veeam Backup Enterprise Manager, the account must have this role assigned on all underlying Veeam Backup & Replication servers.

Be a member of the Performance Monitor Users and Event Log Readers security groups.

These permissions must be granted to the account on machines that run:

Veeam Backup & Replication
Veeam Backup Enterprise Manager
Backup proxy, backup repository (Windows-based), WAN Accelerator, tape server and cloud gateway components (required to collect performance data from these servers)

An Veeam Backup Enterprise Manager machine built-in administrator account is required to add Veeam Backup Enterprise Manager for monitoring into Veeam ONE.

Have permissions to remotely access WMI.

This includes remote access, activation and launching the DCOM application of WMI, and remote access to the root WMI namespace and sub-namespaces. For details on granting these permissions, see Configuring Permissions to Remotely Access WMI.

This permission must be granted to the account on machines that run:

Veeam Backup & Replication
Veeam Backup Enterprise Manager
Backup proxy, backup repository (Windows-based), WAN Accelerator, tape server and cloud gateway components (required to collect performance data from these servers)

Note:

You must use the account with local Administrator permissions in the following cases:

If you plan to install Veeam ONE agent on Veeam Backup & Replication server.

You must also disable MFA for the account under which Veeam ONE agent connects to Veeam Backup & Replication. For details, see section Disabling MFA for Service Accounts of the Veeam Backup & Replication User Guide.

If machines that run Veeam ONE server and Veeam Backup & Replication server belong to different domains or workgroups.
If you are using the default local administrator account, UAC settings do not affect elevation behavior. If you are using a custom local administrator account, you must either configure the LocalAccountTokenFilterPolicy registry key or disable UAC to ensure proper elevation. UAC behavior is affected if a custom user is added to the local Administrators group, regardless of whether Veeam Backup & Replication and Veeam ONE are deployed on the same domain, different domains, or workgroups.