Backup Exec 20.1 Administrator's Guide

Backup Exec logon accounts

A Backup Exec logon account stores the credentials of a user account that you use to access a computer. Backup Exec logon accounts enable Backup Exec to manage user names and passwords and can be used to browse computers or process jobs. Using Backup Exec logon accounts enables you to apply credential changes to the jobs that use them.

Backup Exec logon accounts are used to browse local and remote computers. Whenever the Backup Exec logon credentials are passed between the Backup Exec server and the remote computer, the credentials are encrypted.

Backup Exec logon accounts can also be associated with backup data at the device level such as shares, databases, etc. If you need to edit the credentials, you can edit the Backup Exec logon account. Any changes are applied to the selected computers that use the Backup Exec logon account.

Backup Exec logon accounts are not user accounts. When you create a Backup Exec logon account, an entry for the account is entered into the Backup Exec database; no operating system accounts are created. If your user account credentials change, you must update the Backup Exec logon account with the new information. Backup Exec does not maintain a connection with the user account.

You can view, create, edit, replace, and delete Backup Exec logon accounts.

The following types of logon accounts are included in Backup Exec:

Default Backup Exec logon account

Backup Exec System Logon Account

Restricted logon accounts

The default Backup Exec logon account enables you to browse, make selections, or restore data. The first time you start Backup Exec, you must specify a default Backup Exec logon account using the Logon Account Wizard. You can select an existing Backup Exec logon account or create a new one.

You can create multiple Backup Exec logon accounts; however, each Backup Exec user can have only one default Backup Exec logon account.

The Backup Exec System Logon Account (SLA) is created when you install Backup Exec. When the SLA is created, the user name and password match the credentials that were provided during install for the Backup Exec Services credentials. The owner of the SLA is the user that installed Backup Exec. It is a common account, by default. Common accounts are the shared accounts that all users can access.

See Creating a new Backup Exec System Logon Account.

The Backup Exec System Logon Account may have access to most or all of your data since it contains the Backup Exec Services credentials. If you want to make Backup Exec more secure, you can change the SLA to be a restricted account. You can also delete it after making another logon account the default. However, if you delete the SLA, the jobs in which it is used may fail. If the SLA is deleted, you can re-create it using the Logon Account Management dialog box.

Backup Exec logon accounts can be common or restricted. When you create a Backup Exec logon account, you can designate it as a restricted account. To use a restricted logon account, you must be the owner of the logon account or you must know the password for the logon account. The person who created the logon account is the owner. If you authorize only a few people to back up or restore data, you can make the logon account a restricted logon account.

When you use a restricted logon account to select the data for a job, the logon account information is saved with the selection list. Anyone who tries to edit the job must provide the password to the restricted logon account. Backup Exec loads the selections for that job only when the password for the restricted logon account is provided.

Some features available in the Backup Exec global settings let you set up a Logon Account. For example, Simplified Disaster Recovery or Veritas Information Map where a Logon Account must be specified. To access global settings, click the Backup Exec button > Configuration and Settings > Backup Exec Settings. By default, the Backup Exec System Logon Account is assigned for a feature. Since these settings are global to Backup Exec, the assigned Logon Account is accessible to all logged in users of Backup Exec. As a security best practice, review the Logon Accounts in the global settings that are assigned to the features. It is recommended that you create and assign Logon Accounts with only minimal privileges required for that feature and select Common as the type of account that can be shared across all users of Backup Exec.