none
Backing Up Redirected Folders

    Pregunta

  • Hello,

    I am working on a server 2003 std with Backup exec. This server has folder redirection to synch user's desktop and MyDocuments. As an administrator, I cannot access these folders because they are set to allow only the users' permissions. I need to back the up however but I think that if I use the Admin credentials to back up, the backup will not be able to access the data in the redirected folder.

    I was thinking of creting a backup user and taking ownership of these folders and manually setting the permission. Is this correct or this there a bettwer way to back up redirected folder in 2003?

    Naki


    Naki K. / Falcon IT Services

    jueves, 29 de marzo de 2012 14:04

Respuestas


  • Hi Naki,

    Thanks for the posting.

    If we need to use Domain Admin to access and backup the redirected folders on the server, we cannot enable the "Grant the user exclusive rights to <folder name>" option.

    If this option is selected, it sets the NTFS security descriptor for the %username% folder to Full Control for the user and local system only; this means that administrators and other users do not have access rights to the folder.

    I suggest we read the articles below regarding the Configuration of Folder Redirection.

    Enabling the administrator to have access to redirected folders

    http://support.microsoft.com/kb/288991
     
    How to Configure Folder Redirection

    http://technet.microsoft.com/en-us/library/cc782799(v=ws.10).aspx
     
    Please feel free to let us know if you have any further question or concern.

    Regards

    Kevin


    TechNet Community Support

    • Marcado como respuesta Naki K. _ viernes, 30 de marzo de 2012 19:01
    viernes, 30 de marzo de 2012 5:47

Todas las respuestas

  • I wouldnt set users exclusive rights to folders. Configure Backup Exec to use a domain admin account when running backups.

    MCTS - Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. http://mariusene.wordpress.com/

    jueves, 29 de marzo de 2012 14:32
  • I have set exclusive rights. So does the domain\administrator have access? Why can't I see the contents of these folders on the server even if I log in as domain\administrator?

    Naki K. / Falcon IT Services

    jueves, 29 de marzo de 2012 18:38
  • You have just answered your question. You've set exclusive rights to users folder. Exclusive means that not even an enterprise admin could open them. Go to the redirectig GPO and uncheck the exclusive rights for users option. Then give Domain Admins full permissions the folder where redirected docs are. make sure they are inhereted by child objects. If you can't give permissions on those folders change the ownership to Administrators or Domain Admins. Make sure the Backup Exec service account has domain admin priviledges. Some say that Backup operators is enough but I would like to be sure so go with Domain Admins permissions. 

    MCTS - Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. http://mariusene.wordpress.com/

    jueves, 29 de marzo de 2012 18:54
  • Please let me rephrase my question. I think that in haste I did not clearly convey my question and I left out some important points.

    1. I have folder redirection set with exclusive rights. This cannot change due to security concerns.

    2. I need to back up the folders. The backup software will use credentials to read and copy the files in the folders.

    3. Only a Backup Account created for the specific purpose can have access to the user's folders for the purpose of backing up. Auditing will be turned  on because the information should only be accessed by the backup account during backup interval times.

    My question is: Do I need to manually take ownership of the folders and their child folders and set permission for the backup account or is there a better, easier way of accomplishing this task.

    Naki


    Naki K. / Falcon IT Services

    viernes, 30 de marzo de 2012 2:02

  • Hi Naki,

    Thanks for the posting.

    If we need to use Domain Admin to access and backup the redirected folders on the server, we cannot enable the "Grant the user exclusive rights to <folder name>" option.

    If this option is selected, it sets the NTFS security descriptor for the %username% folder to Full Control for the user and local system only; this means that administrators and other users do not have access rights to the folder.

    I suggest we read the articles below regarding the Configuration of Folder Redirection.

    Enabling the administrator to have access to redirected folders

    http://support.microsoft.com/kb/288991
     
    How to Configure Folder Redirection

    http://technet.microsoft.com/en-us/library/cc782799(v=ws.10).aspx
     
    Please feel free to let us know if you have any further question or concern.

    Regards

    Kevin


    TechNet Community Support

    • Marcado como respuesta Naki K. _ viernes, 30 de marzo de 2012 19:01
    viernes, 30 de marzo de 2012 5:47
  • Thank you Kevin. This is just was I was looking for. I will run the backup service as local system and that should take care of the problem. Thank you as well Marius for your contribution.

    Naki K. / Falcon IT Services


    • Editado Naki K. _ viernes, 30 de marzo de 2012 19:03
    viernes, 30 de marzo de 2012 19:03
  • I hope it works with the local system because I am not sure. I thought exclusive ment only the users had access.Please let us know if it worked.

    MCTS - Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. http://mariusene.wordpress.com/

    sábado, 31 de marzo de 2012 5:36