Installation and Usage of Veeam Backup & Replication

Installation for Veeam Backup & Replication on Microsoft Windows

The account used to install the product must have the local Administrator permissions on the target machine.

Installation for Veeam Backup & Replication on Linux from .ISO

The account used to install the product must have access to manage input/output and boot devices. If you install Veeam Backup & Replication on a VM, the account must also have permission to create virtual machines with attached disk images on the hypervisor level.

Installation for Veeam Backup & Replication on Linux from .OVA

The account used to install the product must have permissions to deploy .OVA files. For details on the minimum required permissions, see the Permissions Reference.

Veeam Backup & Replication Console Permissions

The account used to install the Veeam Backup & Replication console must have the local Administrator permissions on the machine where the console will be installed. After installation, users can connect to the console with standard (non-administrative) permissions.

When connecting to the backup server, the console automatically checks for updates. If the backup server has been updated (for example, after installing a private fix or upgrading to a new product version), or if any console program files or services are missing, the console prompts users to elevate their rights to administrator to complete the update process. After the update, users can connect to and use the console with standard user permissions. If the administrator permissions are not an option, consider installing the console on another server where you can use the administrator permissions or use the web UI instead of the Veeam Backup & Replication console.

[For recovery of Microsoft Windows VM guest OS files] The user who launched the Veeam Backup & Replication console must also have the SeBackupPrivilege and SeRestorePrivilege privileges if the following conditions are met:

• You plan to save files to a new location.
• The user who launched the Veeam Backup & Replication console does not have permissions to read and write data to the new location.
• The mount point is located on the same machine as the Veeam Backup & Replication console. For more information on where mount points are created, see Mount Points and Restore Scenarios.

Veeam Backup & Replication Services for Veeam Backup & Replication on Microsoft Windows

The account used to run the Veeam Backup & Replication Services must be the LocalSystem account or must have local Administrator permissions on the backup server (be a member of the Administrators group on the machine where Veeam Backup & Replication is installed). The account must also have db_owner rights for the configuration database.

Note: Only specific Veeam Backup & Replication services support running under a custom account. For the complete list of services, see Changing VBR Service Account.

These permissions are required because the services need access to the Veeam registry configuration, which is available only to privileged users. Some services also perform disk management operations, open ports in firewalls and perform other operations that require a high permission level.

Veeam Backup & Replication automatically grants the Log on as service right to the specified user account.

Accounts that are a part of Active Directory must also have permissions to read the following AD attributes:

• userPrincipalName

Ensure that the used account has a valid userPrincipalName set in AD.

• userAccountControl
• pwdLastSet
• accountExpires
• msDS-UserPasswordExpiryTimeComputed
• tokenGroupsGlobalAndUniversal

Microsoft SQL Server
(where the configuration database is stored)
(Veeam Backup & Replication on Microsoft Windows)

You require different sets of Microsoft SQL permissions in the following cases:

• Installation (remote or local): current account needs CREATE ANY DATABASE permission on the SQL server level. After database creation this account automatically gets a db_owner role and can perform all operations with the database. If the current account does not have this permission, a Database Administrator may create an empty database in advance and grant the db_owner role to the account that will be used for installing Veeam Backup & Replication.
• Upgrade: current account should have sufficient permissions for that database. To grant these permissions through role assignment, it is recommended that you use the account with db_owner role.
• Operation: the account used to run Veeam Backup Service requires db_datareader and db_datawriter roles as well as permissions to execute stored procedures for the configuration database on the Microsoft SQL Server. Alternatively, you can assign db_owner role for this database to the service account.

For more information, see Microsoft Docs.

PostgreSQL

The account used for installation, upgrade and operation requires superuser role.