I'm currently working with Windows Server Backup and am trying to run a scheduled backup with an unprivileged account.
I want to create a full backup of the server
I created a new domain user "Backup", which I want to use for this task.
I created a DFS storage location called
\\dom.example.com\Backup\Exchangewhere I want to write my backup to.
It is pointing to an SMB share on the server
I gave the user "Backup" full access permissions to the SMB share
Now, this is where the confusion starts. I added "Backup" to the "Backup-Operators" group on a domain controller, but Server Backup would not let me create the backup job. So I created the job with my own user account and tried to change the scheduled task later on. When I then try to switch the user to "Backup", it tells me "Backup" is not allowed to log onto the system.
So, I added "Backup" to the local "Backup-Operators" group. Now I can create the task just fine. But when it runs, it will fail with error code
2155348039, telling me it wasn't able to write to the target location.
When I add "Backup" to the "Administrators" group, everything runs perfect. So I must assume this is a permissions related issue. But what other permissions do I have to set?
I also double-checked the error with Process Monitor. An
ACCESS_DENIED error is captured from
wbengine.exe while trying to write to the DFS location
I've also tried to simply set the backup up without DFS at all (by writing directly to the SMB share), that leads to the same issue.
I've yet also started a command prompt as "Backup" on
pushd my way into
\\storage0.dom.example.com\Exchange. This is the only place I can not write to. I can write to any subfolder just fine. Just not into the