Clarification on credential requirements for SharePoint 2016 backup and restore

Problem

This document clarifies and elaborates on the credential requirements for SharePoint 2016 backup and restore as found in:

• NetBackup 7.7.3 for Microsoft SharePoint Server Administrator's Guide.
• NetBackup 8.0 for Microsoft SharePoint Server Administrator's Guide.
• Configuring Sharepoint backups with Granular Recovery Technology (GRT).

Error Message

Potential error messages if requirements are not met:

SharePoint GRT restore error #1: 12:06:05 (69.001) Granular restore has started, this may take a while....12:06:16 (69.001) ERR - Unable to connect to the SharePoint WebService12:06:16 (69.001) INF - GRE EXITING WITH STATUS = 012:06:16 (69.001) INF - GRE RESTORED 0 OF 1 FILES SUCCESSFULLY12:06:16 (69.001) INF - GRE KEPT 0 EXISTING FILES12:06:16 (69.001) INF - GRE PARTIALLY RESTORED 0 FILES
SharePoint GRT restore error #2: 13:30:39 (75.001) Granular restore has started, this may take a while....13:31:10 (75.001) ERR - error cleaning virtual view13:31:10 (75.001) INF - GRE EXITING WITH STATUS = 013:31:10 (75.001) INF - GRE RESTORED 0 OF 1 FILES SUCCESSFULLY13:31:10 (75.001) INF - GRE KEPT 0 EXISTING FILES13:31:10 (75.001) INF - GRE PARTIALLY RESTORED 0 FILES

Cause

NetBackup for SharePoint agents version 7.7.3 and onwards support backing up and restoring SharePoint 2016. To interact with SharePoint 2016, NetBackup utilizes a more standardized approach via SharePoint Server Object Model (SSOM) instead of the custom NetBackup API. Credential requirements have also changed to reflect the change.

Solution

1. On NetBackup Master Server's Administration Console:

• Go to Host Properties > Clients > double click the client name > Windows Client > SharePoint.
• Fill in the Domain\User Name and Password, then click OK.
• Repeat the steps for all SharePoint front-end and SQL back-end servers.

2. On all SharePoint front-end web servers and application servers:

• Launch services console (Start > Run... > services.msc)
• Configure the NetBackup services as follows:

Service Name	Log on As
NetBackup Client Service	Non-GRT only: Local System or AdminAC If GRT is enabled: Must be AdminAC
NetBackup Legacy Client Service	Local System or AdminAC
NetBackup Legacy Network Service	Local System or AdminAC

3. On all SQL back-end servers:

• Launch services console (Start > Run... > services.msc)
• Configure the NetBackup services as follows:

Service Name	Log on As
NetBackup Client Service	Non-GRT only: Local System or AdminAC If GRT is enabled: Must be AdminAC
NetBackup Legacy Client Service	Must be Local System
NetBackup Legacy Network Service	Must be Local System

Note: Replace AdminAC with the domain account that you create for administering SharePoint backups and restores. The account must be a member of:

• Local Administrators group on all SharePoint front-end / application servers and SQL back-end servers.
• SharePoint Farm Administrators group.
• SQL Sysadmin role.

And has the following local security privileges:

• Allow log on locally.
• Debug Programs.
• Log on as a service.
• Replace a process level token.
• The front-end server must have registry access to the back-end database servers.