Hi,

What is the bare minimum rights required to backup an exchange database? Everywhere I read, I always come across KBs saying that the account should either be Organization Admin or even worse, Domain Admin. I have a really hard time accepting this as the minimum rights as it would grant way too much power to a single account used by the backup administrator.

I am certain that would provision a new security group with just the proper required cmdlets but I can't seem to find anything regarding this.

Anyone has any insight?

Thanks,

Michel

Hi

What software are you using to perform your Exchange backups?  You shouldn't need to give individual users rights to back up Exchange, just the service account used by the backup solution - and nobody should log on with this service account.

Steve

Hi,

We are using multiple softwares, Backup Exec, Arcserve, TSM, just to name a few.

The key word you used in your statement is SHOULD. Even though people shouldn't log with the account, they still do. That is why I want to grant the bare minimum rights so the account cannot do anything else.

Thanks,

Michel

OK, then you have a problem that doesn't have a solution ... or an easy one any way.  You need to be able to control access to service accounts and restrict their usage which is a problem in most organisations that I work with.

Certainly BackupExec requires Org Management and Domain Admin membership for it's service account and I'm sure the rest are similar.  Each provider will have a document of the permissions required to back up Exchange (like Symantec and Arcserve) - these will be their minimum requirements for support so if you configure anything more restrictive then you are on your own.

Steve

Yeah I know about the documents stating the minimum requirements from either of the vendores, they all mention Organizaiton Management.

I also know that this isn't an easy probem to solve, which is why I came to the forums :)

Thanks,

Michel

Anyone has any other insight on this? I cannot accept that a backup account needs so much rights...

Thanks,

Michel