Video Screencast Help

How to leverage Backup Exec's Remote Console

Created: 06 Nov 2009 • Updated: 10 Nov 2009 | 17 comments
Language Translations
CraigV's picture
+14 14 Votes
Login to vote

We've gone through a process of removing all our site reps from the Domain Administrators group. The main issue for this was a security requirement to not allow them to have too much power. No sense in having them break anything on our servers to test our DR recovery capabilities.
The big question then was what to do in order to get the site reps to check their site server backups without having them log onto the server. Enter Backup Exec's Remote Console.
This allowed us to have the site rep log onto their Backup Exec server instance without logging onto the server directly. They were then able to do what they needed to do in order to check backups, respond to any issues, and as a result, log calls based on that. That would mean they would also have rely on logging onto their instance, instead of waiting for job logs, meaning faster responses.
The Backup Exec Remote Console was set up to run off their laptop/desktop using a universal service account. Doing this meant management of 1 account that would be granted the necessary rights to the server and each instance of BEWS, instead of multiple accounts.
First off, a service account was created in Active Directory which had the necessary rights. Once done, this service account was added as a user on each Backup Exec server.
From there, the site reps were directed to install the Remote Console on their respective workstations as follows:

1. Browse to the installation directory, and launch Browser.exe from the installation location for the site (already pre-populated and shared for them) and click Next.
2. Choose "Start the Backup Exec Installation", and click Next.
3. Click Next, accept the License Agreement, and click Next again.
4. At the Symantec Backup Exec for Windows Servers Install Menu, make sure Local Install is selected, and Install Remote Administration Console Only will be the only option available under that. Click Next.
5. Leave the Destination Folder as is for the installation path, and click Next.
6. Choose Install.
7. Click Finish after deselecting the other options when the installation completes.

Not many people either know about this functionality, or use it. It has the major security advantage of not having direct logons onto your server which could open up all sorts of issues if someone pushes the incorrect button for example.
The interface is exactly the same as Backup Exec's, so there is no extra learning curve needed, and it has the same functionality as if you logged directly onto the server first.
It is a really great part of Backup Exec, which makes life a lot easier when managing your server. Furthermore, if you don't have the license for CASO, you can use this Remote Console to log onto any Backup Exec servers in your environment.
Administration just got easier...

Comments 17 CommentsJump to latest comment

Chonny's picture

Thanks - that will be useful for me, even though I do have a server Admin login, as it will save me from having to RDP to the server!

0
Login to vote
CraigV's picture

=)

Yeah, it works very well...my main problem now being to get these site reps to actually use it, instead of me still continuing to hold their hands!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

+2
Login to vote
RHKing's picture

You Rock CraigV!

Would this also work if you added them as a Guest to further restrict their capabilities?

+1
Login to vote
CraigV's picture

I personally haven't tried that, but it's worth a go. You can;t do any harm with that, and if it doesn't work, simply move them into a group with the next highest permissions on the local server...

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

+1
Login to vote
TheoGeerman's picture

Hi There, I have a question please. 

I have a user named Curt, he is a regular user in the AD, which rights should I give him in order for him to be able to bu autenticated by BE as a backup user which can stop a runing backup that must be stoped and also if he need to verify if a job has succesfully ended?

I will apreciate your help

Kind Regards, 

Theo

+1
Login to vote
akaw's picture

Hi Craige,

 

Small questions,

Whe do I install the Browser.exe? in Back exe server or in particular desktop? 

Thanks 

+1
Login to vote
CraigV's picture

...doesn't matter. You can install the RC from there. browser.exe brings up a splash screen from where you can make your selection!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

+1
Login to vote
akaw's picture

Hi,

 

There's no brower.exe in installation directory, any link to download? 

+1
Login to vote
CraigV's picture

...check in the root of the ISO/DVD...the exe there launches the installation. Used to be browser.exe, but might have changed!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

0
Login to vote
akaw's picture

thanks!!!! 

+1
Login to vote
RygarVoltron's picture

This wont work on a Windows XP machine I just found out.

+1
Login to vote
CraigV's picture

...well, which version of BE? And what is the issue?

Thanks!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

+1
Login to vote
tcarder's picture

Thank you for the good advice. This post is referenced in almost every post on this site that relates to giving access to non-domain admin users, so it must be authoritative on this topic.

I am failing to understand one part of the original post:

"The Backup Exec Remote Console was set up to run off their laptop/desktop using a universal service account."

I don't see a Windows service for Symantec/Backup Exec after installing the Remote Console on a desktop computer. Please advise. Thank you in advance for your help. I appreciate it.

=====

I found the answer to this question myself. Each time you launch the remote console on a computer, it prompts you for logon credentials for the media server (servername/username/password). The problem with this is that I want helpdesk users to be able to use this console, without giving them access to a domain admin account credentials. I wished these credentials could be saved somewhere on the local computer so that the helpdesk users are not prompted. Symantec needs to implement RBAC soon.

0
Login to vote
BackupDawg's picture

"First off, a service account was created in Active Directory which had the necessary rights. Once done, this service account was added as a user on each Backup Exec server."

C.V. - did you have to give the account in AD any special permmisions? (logon local etc)

 

cheers

 

 

BDawg

0
Login to vote
CraigV's picture

Hi,

 

Nope, it was a standard account. I made it a member of the Local Admins group on the media server only. Backup Operators group doesn't seem to have the necessary rights to do what I needed the site reps to do.

Thanks!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

0
Login to vote
BalaP's picture

Hi Craig,

 

Thanks for sharing...

 

Regards,

+1
Login to vote
CraigV's picture

...I hope it helps!

Thanks!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

0
Login to vote