Description

Specific permissions are needed to properly Backup and Restore using the Backup Exec Agent for VMware.

Solution

The following privileges are the minimum required for the account specified in Backup Exec when backing up, restoring, browsing, or adding via vCenter or ESX hosts when using AVVI:

• Browse\backup Operation (without GRT):

  • Virtual machine > Configuration   

    • Disk Change Tracking*

    • Disk Lease

  • Virtual machine > Provisioning  

    • Allow read-only disk access

    • Allow virtual machine download

  • Virtual machine > State

    • Create snapshot

    • Remove snapshot

* Note: Apart from Disk Change Tracking, the above permissions are by default all included in the VMware Consolidated Backup user (sample) role.

•   Restore (or GRT Backup) Operation:
  • Datastore
    • Allocate Space
    • Browse Datastore
    • Remove File
    • Update Virtual Machine Files
  • Global
    • Licenses
    • Enable Method
  • Network
    • Assign Network
  • Resource
    • Assign virtual machine to resource pool
  • Virtual machine > Configuration
    • Add existing disk
    • Add new disk
    • Add or Remove device
    • Advanced
    • Change CPU count
    • Change Resource
    • Disk Change Tracking
    • Disk Lease
    • Host USB device
    • Memory
    • Modify device setting
    • Raw device
    • Reload from path
    • Remove disk
    • Rename
    • Reset guest information
    • Settings
    • Swapfile placement
    • Upgrade virtual hardware
  • Virtual machine > Interaction
    • Power Off
    • Power On
  • Virtual machine > Inventory
    • Create new
    • Create from existing
    • Register
    • Remove
    • Unregister
  • Virtual machine > Provisioning
    • Allow disk access
    • Allow read-only disk access
    • Allow virtual machine download
  • Virtual machine > State
    • Create snapshot
    • Remove snapshot
    • Revert to snapshot

These privileges must be either set on the ESX host or the vCenter depending on which is being used for the backup or restore operation. 

In a vCenter managed environment, in addition to the above permissions within ESX itself, the account will also need to be (at least) a Local Windows Administrator over the Operating System of the vCenter server.

The backup account will also need the rights listed in Article 100015385.