I'm currently working with Windows Server Backup and am trying to run a scheduled backup with an unprivileged account.
I want to create a full backup of the server
exchange.dom.example.com
.I created a new domain user "Backup", which I want to use for this task.
I created a DFS storage location called
\\dom.example.com\Backup\Exchange
where I want to write my backup to.It is pointing to an SMB share on the server
storage0.dom.example.com
named\\storage0.dom.example.com\Exchange
I gave the user "Backup" full access permissions to the SMB share
\\storage0.dom.example.com\Exchange
.
Now, this is where the confusion starts. I added "Backup" to the "Backup-Operators" group on a domain controller, but Server Backup would not let me create the backup job. So I created the job with my own user account and tried to change the scheduled task later on. When I then try to switch the user to "Backup", it tells me "Backup" is not allowed to log onto the system.
So, I added "Backup" to the local "Backup-Operators" group. Now I can create the task just fine. But when it runs, it will fail with error code 2155348039
, telling me it wasn't able to write to the target location.
When I add "Backup" to the "Administrators" group, everything runs perfect. So I must assume this is a permissions related issue. But what other permissions do I have to set?
I also double-checked the error with Process Monitor. An ACCESS_DENIED
error is captured from wbengine.exe
while trying to write to the DFS location \\dom.example.com\Backup\Exchange\TempFile.tmp
.
I've also tried to simply set the backup up without DFS at all (by writing directly to the SMB share), that leads to the same issue.
I've yet also started a command prompt as "Backup" on exchange.dom.example.com
and pushd
my way into \\storage0.dom.example.com\Exchange
. This is the only place I can not write to. I can write to any subfolder just fine. Just not into the Exchange
.