Users and Roles: Account Setup and Permissions

KB ID: 1853
Product: Veeam Backup & Replication
Version: 6.5, 7.x, 8.x
Published:
Last Modified: 2015-08-21

Challenge

Note: all added users with any role need to be in the Local Administrators group on the Veeam server.

Insufficient permissions to perform Users and Roles specific functions, or inability to login to server to perform Users and Roles tasks.

Cause

Permissions may not be set correctly in Veeam SA account or in Veeam Database in conjunction with Users and Roles settings.

Solution

Note: Permissions are inclusive, for instance if a user is already a member of the Administrators group and they are also manually added to the “Users and Roles” list, they will have the privileges that are the greatest. To work around this, either create a custom user group within AD and add it to Veeam Backup & Replication’s “Users and Roles” section and remove the Administrators group, or manually specify all users that you wish to have access to Veeam Backup & Replication and remove the Administrators group from the “Users and Roles” section.

USERS AND ROLES SETUP

Adding User roles: http://helpcenter.veeam.com/backup/70/vsphere/users_roles.html?zoom_highlightsub=user%2Broles

Roles and Role functions In Veeam 7.0

Veeam Restore Operator - Can perform restore operations using existing backups and replicas ONLY
Veeam Backup Viewer - Has “read-only” access to Veeam Backup & Replication — can view existing and performed jobs and review the job session details.
Veeam Backup Operator - Can start and stop existing jobs, BUT cannot use Restore Option
Veeam Backup Administrator - Can perform all administrative activities in Veeam Backup & Replication.


You can access the Users & Roles dialog by opening the Main File icon in the upper-left corner of the GUI:

User-added image

Once opened, you can add local or Domain users as needed:

User-added image

Note: If you need a user to perform multiple operations, such as Start/Stop jobs and Restore, add the user to Users and Roles multiple times as all required role groups (ex: User_1\Backup Operator and User_1\Restore Operator).


Adding Users to the SA group on the Veeam Server
 
For Veeam installations with MSSQL2008R2:

To add users to the Veeam group, navigate to Computer Management->System Tools->Local Users and Groups >Groups
 
Add the user in the built-in Veeam group named: ServerMSSQLUser$(VBRServerName)$VEEAMSQL2008R2: 

User-added image

Add the user to a remote users group if applicable.

Add the user to a group that can override security restrictions but is not Administrator (The built-in Backup Operators group is the most suitable). Otherwise, restore attempts with this user will have access only to the files from the C: drive, and receive ‘Access denied’ on other system drives.

Note: all added users with any role need to be in the Local Administrators group on the Veeam server.
 
For Veeam installations with MSSQL2005:
To add users to the Veeam group, navigate to Computer Management->System Tools->Local Users and Groups >Groups
 
Add the user in the built-in Veeam group named: SQLServer2005MSSQLUser$(VBRServerName)$VEEAM: 

User-added image

Add the user to a remote users group if applicable.

Add the user to a group that can override security restrictions but is not Administrator (the built-in Backup Operators group is the most suitable). Otherwise, restore attempts with this user will have access only to the files from the C: drive, and receive ‘Access denied’ on other system drives.

Editing User permissions in Veeam SQL Instance
 

You will need to install Install Microsoft® SQL Server® 2012 Management Studio Express in order to configure the database roles: https://www.microsoft.com/ru-ru/download/details.aspx?id=29062

This is compatible with 2005 and 2008R2 SQL instances, and the permissions are the same in either instance.

Connect to the Veeam Database Instance using windows authentication (Servername)\VEEAMSQL2008R2 is the default path for SQL 2008R2 instances, and (Servername)\VEEAM is the default path for SQL 2005:

User-added image

Navigate to Security >Logins >New Login.

Navigate to General >Search, and add the user you need access for:

User-added image

Under ‘User Mapping’, check the VeeamBackup Mapping checkbox; database role membership for: VeeamBackup can then be modified.
 
Check the db_owner Database role checkbox:

User-added image


Click ‘OK’, you should now be able to attempt Server login using the modified SA credentials.
 

More Information

How helpful is this article: 
3 out of 5 based on 21 ratings

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.

Request new content

Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Orphus system