• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 891
  • Last Modified:

Backup Exec 12.5 "Log On As" Account

Good day everyone. I am currently going through and cleaning up a lot of the services on servers that were running with "Log On As" credentials of our old server admin.

I was planning on creating a an account with domain admin permissions to be used specifically for services that would require to use a "Log On As" account on the domain.

Would this be good practice or can the below services be associated with "Network Services" or "Local System" credentials?

Backup Exec Agent Browser
Backup Exec Device & Media Service
Backup Exec DLO Administrator Service
Backup Exec Job Engine
Backup Exec Server
SQL Server (BKUPEXEC)
0
mig1980
Asked:
mig1980
  • 3
  • 3
  • 2
5 Solutions
 
Rodney BarnhardtServer AdministratorCommented:
By default, the services as well as the agents use the local system account. This is to ensure smooth operability. You can change this, and I have at certain companies I have worked at based on their individual security policies. If you create a seperate account, then I would review the below technote on exactly what permissions the account would need.

http://www.symantec.com/business/support/index?page=content&id=TECH17611
0
 
Rodney BarnhardtServer AdministratorCommented:
0
 
denbosseCommented:
Just use servicesmgr.exe in the Backup Exec installation folder to change the service accounts. There's a button for that change if I recall correctly. This utility will use best practices.  Basically only remote agent service should use local system. Sqlserver can use local system as well.
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
mig1980Author Commented:
Thank you all for the information. I will leave this open for a few more days as I plan to deploy the changes next week.
0
 
mig1980Author Commented:
One question. I was looking at using the domain "Administrator" account for these services as it seems that it requires domain admin for many of these services. Would that be good practice or should I create a separate domain account specific to backup exec?

If a separate account would be recommended, does the account only require domain admin permissions or would other permissions need to be added to it? The links above do not specifically describe any of this.
0
 
Rodney BarnhardtServer AdministratorCommented:
I have done it both ways. In smaller companies, I have used the domain administrator account for this purpose. In large companies, I have created a system account and used it due to security rules that were in place. Either way, it really needs domain admin rights per Symantec:

http://www.symantec.com/business/support/index?page=content&id=TECH23689
0
 
denbosseCommented:
I'd probably suggest to create a specific account, give it an extremely secure password and add it to the domain admins group. Makes things easier when you need to change the password for the administrator account. At least BE won't be affected in that case.
0
 
mig1980Author Commented:
Thank you very much everyone. This worked great! I ended up creating a domain account specific to Backup Exec.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Microsoft Azure 2017

Azure has a changed a lot since it was originally introduce by adding new services and features. Do you know everything you need to about Azure? This course will teach you about the Azure App Service, monitoring and application insights, DevOps, and Team Services.

  • 3
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now