I’m facing an Active Directory security audit, and the account used for the backup job generate a discussion.
If i’m correct the account used must me member of builtin\administrator group, and the security team do not like at all that the password is set as never expire.
i’ve already implemented that the account cannot be used for interactive login, but it is not considered “enough”
So i’m trying to echange my posture without breaking the restore functionality, and i’m evaluating several option:
The Veeam Server in in a workgroup and in a segmented network.
1) do not do application aware and use only the vmware tools.
it seem that the backup of AD is done in a correct way
PS C:\Windows\system32> repadmin /showbackup
Repadmin: running command /showbackup against full DC localhost
Loc.USN Originating DSA Org.USN Org.Time/Date Ver Attribute
======= =============== ========= ============= === =========
DC=DomainDnsZones,DC=intranet,DC=redapted,DC=com
45216937 3b3cddfc-e92d-4e3a-8fdc-3b2a6a92dbd0 37629053 2026-09-03 12:08:0522319 dSASignature
DC=ForestDnsZones,DC=intranet,DC=redapted,DC=com
45216931 3b3cddfc-e92d-4e3a-8fdc-3b2a6a92dbd0 37629052 2026-09-03 12:08:0522315 dSASignature
CN=Schema,CN=Configuration,DC=intranet,DC=redapted,DC=com
45216920 3b3cddfc-e92d-4e3a-8fdc-3b2a6a92dbd0 37629051 2026-09-03 12:08:0523713 dSASignature
CN=Configuration,DC=intranet,DC=redapted,DC=com
45216690 3b3cddfc-e92d-4e3a-8fdc-3b2a6a92dbd0 37629050 2026-09-03 12:08:0524031 dSASignature
DC=intranet,DC=redapted,DC=com
45215717 3b3cddfc-e92d-4e3a-8fdc-3b2a6a92dbd0 37629049 2026-09-03 12:08:0526033 dSASignature
the dSASignature update tell me that the processing of AD specific backup events is done
And the Veeam Explorer for AD is able to perform it’s duty.
but , if i understood correctly, that some automatic operation during a full VM restore (to enter automatically the Active DIrectory restore mode ) are not done so especially for SureBackup some issues can arise.
2) using a gMSA
This option require a Guest Integration proxy in domain right?
3) Veeam Agent
If i read correctly Veeam Agent, running in the VM context, can do everything without specifying an user thru VSS, but not the VM must reach the Veeam B&R server in some way, or a repository, all of which are in a segmented network.
i’ve understood correctly the scenario an the limitations? what you guys do in a similar situation?
Thanks in advance for any feedback