We are doing daily a Windows Server 2008 R2 Backup on a shared folder of a dedicated machine scheduled in the Windows Task Scheduler.

To access a shared folder (a Win7 machine) as backup destination we are forced to use local domain admin account for the scheduled task. The problem is that the local domain admin account password changes periodically and the backup stops working till they we update the password on the scheduler.

What is the most straightforward way to avoid this?



Dedicated account, definitely. Personally, (assuming the limited scope of the question), I'd create a local account on the 2008 R2 machine that has read/write access to the Win7 backup share. Set the local account's password to never expire and "user cannot change password".

I'd also make the share a hidden share on the Win7 machine.

On the 2008 R2 server I'd make the local account part of that server's Backup Operators group, and run the scheduled task as that local account on the 2008 server.

All that said, if the scope of your backups is greater or it requires more advanced permissions such as domain admin rights (for multiple server simplicity, agent installs, whatever), then my recommendation is a dedicated Domain Admin account called something like svc_backups or similar that is easily identifiable and dedicated only for that purpose. The account should also be "locked down" to only being allowed to log on to the servers that need it for backup/agent/media purposes.

  • that has read/write access to the Win7 backup share: this is probably my limit, where can I learn more on how to do it? – abenci Jun 7 '13 at 8:44
  • How to give the dedicated account access? You use the share and ntfs level permissions on the Win7 box to add the dedicated account. If you aren't sure how to do that part, you might need to ask a new question with screenshots to help us walk you through it. – TheCleaner Jun 7 '13 at 13:02
  • I made a svc_backup user, member of Backup Operators and Domain Users groups. I added it - with read/write access - to the backup share. The scheduled task runs but the Windows Server Backup was not executed... – abenci Jun 10 '13 at 6:59
  • What does the scheduled task log show? What if you manually run the task while logged in as the user that the task runs as? Does anything happen? What does the task do? Is it a batch file? Can you run the task without the scheduler and see what happens? – TheCleaner Jun 10 '13 at 13:06
  • Logging as svc_backup user and opening the Windows Server Backup application I get: The Windows Server Backup engine is not accessible on the computer you want to manage backup on. Make sure you are a member of the Administrators or Backup Operators group on that computer. If you are a Backup Operator, ensure that the DCOM security settings on the remote computer are set to ... – abenci Jun 11 '13 at 9:23

Setting the local admin password to not expire would probably be your best bet. Or, a dedicated account that only has access to what it needs.

  • I agree but the security level decreases... – abenci Jun 7 '13 at 8:43
  • Well, you were looking for the straightforward way. Then, you can simply change the password manually and at the scheduler at the same time. There's not many other ways around it. – Nathan C Jun 7 '13 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.