-
Title
Adding the Recovery Manager Service Accounts to local security policies -
Description
Will adding the service account to the below local policies have any negative impact on the application's functionality?
1. Deny Access to this computer from the network
2. Deny log on locally
3. Deny log on through Remote Desktop services
-
Resolution
The RMAD backup/restore agents work using the LocalSystem account. Depending on the operation being performed (install/uninstall backup agent, make backup, or restore from backup), dictates the account being used to connect to host with the agent.
If the "Deny Access to this computer from the network" policy is applied to this account there will be no possibility to install/uninstall/perform any operation on the host with an agent. For example, the console would not be able to connect to the backup agent on the DC.
For the install operation there would be the following error:
Agent deploy operation is failed, Cannot install Backup Agent. Details: Failed to install the agent:
Cannot determine the type of the target computer processor.
Logon failure: the user has not been granted the requested logon type at this computer.
On backup operation there will be error:
"Failed to connect to backup agent: Cannot establish the connection to the backup agent"
The other 2 policies (deny logon locally and deny logon through Remote Desktop) do not affect RMAD console operations.