VEEAM - Services - Accounts - Credentials

[Koldov]

OK, so I'm getting quite annoyed with myself for not even being able to understand what I need to do to get this sorted...

 

Every time I change the Domain\Administrator account password (which I do regularly) VEEAM has an utter meltdown, as it appears I have a lot of services that run as Domain\Administrator!

 

I must have made a few mistakes on the install as I didn't really understand what accounts I needed to put in, but when I tried to be clever recently on the v12 upgrade I changed it to SYSTEM and then found I couldn't even log in to the console...

 

I have been advised to create a separate VEEAM user (give it a complex password and never change it), but I've heard this can cause issues on restores and to be fair I have no real idea how to create a specific user and give it all the permissions/rights to do every job VEEAM needs to do.

 

So, first things first, will I break anything if I change all these services to SYSTEM...?

 

 

Next, if I change all of these to some other user what will break (also can I delete all of those 'root' credentials)?

 

 

Lastly I do not want the console to be allowed to log in with 'Windows session authentication' (as long as I can manually sign-in) is there anyway to change that?

Edited May 5, 2023 by Koldov

[Steve21]

By default the accounts need local admin rights "and" SQL permissions, which is probably where SYSTEM breaks

 

Create a service account with local admin rights on the applicable servers (and add it directly to the SQL server for the Veeam database, unless you have all admins aroup added already) (Veeam, HyperV, Member Servers etc) and nothing should stop working as it'd still have permissions to restore VMs/files as required

 

Obviously you can go further and do per HOST/VM accounts within the account settings, but the above would be first step to removing domain admin

 

Steve

[free780]

By default the accounts need local admin rights "and" SQL permissions, which is probably where SYSTEM breaks

 

Create a service account with local admin rights on the applicable servers (and add it directly to the SQL server for the Veeam database, unless you have all admins aroup added already) (Veeam, HyperV, Member Servers etc) and nothing should stop working as it'd still have permissions to restore VMs/files as required

 

Obviously you can go further and do per HOST/VM accounts within the account settings, but the above would be first step to removing domain admin

 

Steve

 

You will need a domain admin service account for backing up DCs but use it only for that purpose. Try and block interactive logins for the account etc.