Backup Exec logon accounts

A Backup Exec logon account stores the credentials of a user account that you use to access a computer. Backup Exec logon accounts enable Backup Exec to manage user names and passwords and can be used to browse computers or process jobs. Using Backup Exec logon accounts enables you to apply credential changes to the jobs that use them.

Backup Exec logon accounts are used to browse local and remote computers. Whenever the Backup Exec logon credentials are passed between the Backup Exec server and the remote computer, the credentials are encrypted.

Backup Exec logon accounts can also be associated with backup data at the device level such as shares, databases, etc. If you need to edit the credentials, you can edit the Backup Exec logon account. Any changes are applied to the selected computers that use the Backup Exec logon account.

Backup Exec logon accounts are not user accounts. When you create a Backup Exec logon account, an entry for the account is entered into the Backup Exec database; no operating system accounts are created. If your user account credentials change, you must update the Backup Exec logon account with the new information. Backup Exec does not maintain a connection with the user account.

You can view, create, edit, replace, and delete Backup Exec logon accounts.

The following types of logon accounts are included in Backup Exec:

Default Backup Exec logon account

Backup Exec System Logon Account

Restricted logon accounts

Default Backup Exec logon account

The default Backup Exec logon account enables you to browse, make selections, or restore data. The first time you start Backup Exec, you must specify a default Backup Exec logon account using the Logon Account Wizard. You can select an existing Backup Exec logon account or create a new one.

You can create multiple Backup Exec logon accounts; however, each Backup Exec user can have only one default Backup Exec logon account.

Your default Backup Exec logon account enables you to perform the following:

You can select a different Backup Exec logon account when you make selections for backup. If your default logon account does not have rights, the Logon Account Selection dialog box appears and lets you create or select a different Backup Exec logon account.

See Changing your default Backup Exec logon account.

See Requirements for using the SQL Agent.

See Requirements for accessing Exchange mailboxes.

Backup Exec System Logon Account

The Backup Exec System Logon Account (SLA) is created when you install Backup Exec. When the SLA is created, the user name and password match the credentials that were provided during install for the Backup Exec Services credentials. The owner of the SLA is the user that installed Backup Exec. It is a common account, by default. Common accounts are the shared accounts that all users can access.

See Creating a new Backup Exec System Logon Account.

The Backup Exec System Logon Account may have access to most or all of your data since it contains the Backup Exec Services credentials. If you want to make Backup Exec more secure, you can change the SLA to be a restricted account. You can also delete it after making another logon account the default. However, if you delete the SLA, the jobs in which it is used may fail. If the SLA is deleted, you can re-create it using the Logon Account Management dialog box.

The SLA is used for the following tasks and jobs:

Restricted logon accounts

Backup Exec logon accounts can be common or restricted. When you create a Backup Exec logon account, you can designate it as a restricted account. To use a restricted logon account, you must be the owner of the logon account or you must know the password for the logon account. The person who created the logon account is the owner. If you authorize only a few people to back up or restore data, you can make the logon account a restricted logon account.

The main reasons to restrict a logon account are as follows:

When you use a restricted logon account to select the data for a job, the logon account information is saved with the selection list. Anyone who tries to edit the job must provide the password to the restricted logon account. Backup Exec loads the selections for that job only when the password for the restricted logon account is provided.

Some features available in the Backup Exec global settings let you set up a Logon Account. For example, Simplified Disaster Recovery or Veritas Information Map where a Logon Account must be specified. To access global settings, click the Backup Exec button > Configuration and Settings > Backup Exec Settings. By default, the Backup Exec System Logon Account is assigned for a feature. Since these settings are global to Backup Exec, the assigned Logon Account is accessible to all logged in users of Backup Exec. As a security best practice, review the Logon Accounts in the global settings that are assigned to the features. It is recommended that you create and assign Logon Accounts with only minimal privileges required for that feature and select Common as the type of account that can be shared across all users of Backup Exec.

More Information

Creating a Backup Exec logon account

Editing a Backup Exec logon account

Changing the password for a Backup Exec logon account

Replacing a Backup Exec logon account

Deleting a Backup Exec logon account

Copying logon account information to another Backup Exec server