Required Permissions

Authorizing with Veeam ONE

To authorize with Veeam ONE software components (Veeam ONE Monitor, Reporter and Business View), a user must have the Allow log on locally privilege assigned.

By default, this privilege is assigned to users included in the local Administrators group. For users not included in the local Administrators group, you must assign this privilege manually. For details, see this Microsoft TechNet article.

Connection to Microsoft SQL Server

The account used to connect to the Microsoft SQL Server hosting the Veeam ONE database must have the following permissions:

• Public role (default permissions)
• CREATE ANY DATABASE permissions
• db_owner role on the Veeam ONE database
• db_datareader permissions on the master database
• public, db_datareader, SQLAgentUserRole permissions on the msdb database
• [For Always-On Availability Groups] VIEW SERVER STATE permissions 

Connection to Microsoft Hyper-V VM Guest OS

The account used to collect data from guest OSes of Microsoft Hyper-V Windows VMs, must have local Administrator permissions on the guest OS.

Connection Under UAC

Veeam ONE collects data from Microsoft Windows servers using WMI. For some configurations, UAC access token filtering can prevent running WMI commands on connected machines, which in turn will cause data collection failures.

The affected configurations are:

• Non-domain machines (machines in a workgroup)
• Machines with an unelevated local Administrator account (the account that is not Built-in Administrator)

To allow Veeam ONE collect data from these machines, perform the following steps on target virtual servers:

1. Set the network location to private:

1. Log on to a machine as Administrator.
2. Open the Network and Sharing Center.
3. In the list of active networks, click the necessary network and change its location to Private.

In some Windows OS versions, this location is called Home or Work.

1. Configure Windows Remote Management.

To do so, in the command prompt, type winrm quickconfig and press [Enter].

For more details on UAC access token filtering, see User Account Control and WMI.

Authorizing with Veeam ONE

To authorize with Veeam ONE software components (Veeam ONE Monitor, Reporter and Business View), a user must have the Allow log on locally privilege assigned.

By default, this privilege is assigned to users included in the local Administrators group. For users not included in the local Administrators group, you must assign this privilege manually. For details, see this Microsoft TechNet article.

Remote Access

To be able to access Veeam ONE software components installed on a remote machine, you can use one of the following options.

Remote Access to Veeam ONE Reporter and Business View through Web Browser

Veeam ONE Reporter and Business View consoles can be accessed using a web browser on a remote machine. To learn more on how to access Veeam ONE software components, see Accessing Veeam ONE Monitor, Reporter and Business View.

Veeam ONE Reporter and Business View consoles remotely, a user must be a member of the Veeam ONE Administrators or Veeam ONE Read-Only Users group on the machine where Veeam ONE Web UI component is installed. For details on Veeam ONEsecurity groups, see Security Groups.

Remote Access for Multi-Tenant Monitoring and Reporting

Veeam ONE supports multi-tenant access to its monitoring and reporting capabilities. Authorized users can remotely monitor a subset of the vCenter Server or vCloud Director infrastructure and create reports.

To monitor and report on a restricted scope of the virtual infrastructure, a user must have permissions assigned on objects of the vCenter Server or vCloud Director inventory hierarchy. For details, see Veeam ONE Multi-Tenant Monitoring and Reporting.

Required Ports

1 You must open these ports manually
2 To learn about enabling and disabling WMI traffic, see http://msdn.microsoft.com/en-us/library/aa389286(v=vs.85).aspx and http://msdn.microsoft.com/en-us/library/aa822854(v=vs.85).aspx 
3 Associated with the File and Printer Sharing service
4 To gather performance data from Windows Server 2012 and 2012R2, you must additionally enable network discovery.