Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Console Connection

Created: 24 Jan 2012 • Updated: 26 Jan 2012 | 14 comments
This issue has been solved. See solution.

Hi,

 

I have manage to install the management console for BE 2010 on an XP machine, but when I try and connect to the server using a normal user account I get the message that "Access is denied". If I give that user admin rights on the server, or domain admin rights, it works fine. Now, with earlier versions of Backup Exec, the users didn't need to have admin rights to check on backup jobs etc, and to be honest I am VERY reluctant to give them that level of access. Is there any way around this?

 

Thanks.

Comments 14 CommentsJump to latest comment

AmolB's picture

Refer to http://www.symantec.com/docs/TECH48455

Cliffyb's picture

Hi,

 

This refers to "The logon account for the Backup Exec Remote Admin Console fails to access the resources across domains", whereas this is in the same domain. I think that artical refers to an older version of BE as well as the screen shots and info within them are different.  

 

Any other thoughts?

AmolB's picture

Sorry for the above article, My bad frown

Try adding the non admin account in the "Backup Operators" group

Cliffyb's picture

Hi,

 

The user is already in the Backup Operators group. I have found an article which gives me a list of rights the user needs to have (almost Admin by the look of it) to run the console. I will give it a go tomorrow.

Thanks for your replies.

AmolB's picture

Hope the list you found includes the below policies.

 

  • Act as a part of Operating System ( Only for windows server 2000 )
  • Create a token object
  • Log on as a service
  • Logon as a batch job
  • Manage auditing and security log
  • Backup files and directories
  • Restore files and directories
ArulPrasad's picture

Create logon account for the user who tries to login to the console and check

Arul

CraigV's picture

Hi Cliffy,

 

You might want to read the article I wrote below on how to use the BE Remote Console. I've implemtned this to allow site reps to check their backup servers without needing admin rights...

 

https://www-secure.symantec.com/connect/articles/how-leverage-backup-execs-remote-console

 

THanks!

Alternative ways to access Backup Exec Technical Support:

https://www-secure.symantec.com/connect/blogs/alte...

Cliffyb's picture

Hi,

I created a new backup account and by using the "local security policy" editor, assigned it the following rights -

  • Create a token object
  • Log on as a service
  • Logon as a batch job
  • Manage auditing and security log
  • Backup files and directories
  • Restore files and directories 
  •  
  • I had already installed the console on a client PC, and used the backup account to try and log on. UnfortunatelyI got the same "Access is denied" message.
  •  
  • Anything else I can try?
  •  
  • Thanks for your help so far!
  •  
  •  
  •  
  •  
  • Cliffyb's picture

    Just a checking, is it OK to run the BE services on the server with the Administrator account, and connect from the console on a remote machine using a different account, with the rights listed in the TECH70860 article? 

     

    Thanks.

    CraigV's picture

    Yes, that's quite possible!

    Alternative ways to access Backup Exec Technical Support:

    https://www-secure.symantec.com/connect/blogs/alte...

    Cliffyb's picture

    Mmm?? Then I really don't understand why it's not working?? Have just tried to connect agani and I stil get the "Access is denied" box coming up. What would be the next thing to try?? Are there any logs I can run through? Reinstall the console? I guess I could just give them an admin account if there aren't any other options.

     

    Thanks.

    CraigV's picture

    ...try adding the user to the local server's Power Users group...

    Alternative ways to access Backup Exec Technical Support:

    https://www-secure.symantec.com/connect/blogs/alte...

    Cliffyb's picture

    Hi,

    OK, I checked the Backup Operators group (the domain group) and the account was in it. I looked on in the local Backup Operators group on the BE Server and the account wasn't in it??? Mmm, I thought if a user was put in the builtin domain group they would be a member of the builtin local group... Don't know if this is a quirk due to a Win2k Domain Controller and a 2008 Member Server? Anyway, I put the backup account in the local Backup Operators group and it started working.

    Thanks for all your help and suggestions, wouldn't have got to a solution without it!! 

    CraigV's picture

    Nope, a domain group is not necessarily made an automatic member of a local group...its got nothing to do with what OS your DC is running.

    Glad you got it working, which means you can close this off now =)

    Alternative ways to access Backup Exec Technical Support:

    https://www-secure.symantec.com/connect/blogs/alte...

    SOLUTION