Brick Level Permissions and Why

[dlstewart6759]

Greetings all.

According to the documentation for client agent for Exchange, the domain account used to configure Brick Level backups requires it to be in the Administrators, Domain Admins and Backup Operators groups.

Our security folks see this as an excess amount of security offered up to this account. Does anyone know any work around to these permissions without granting all the above rights? Perhaps some permissions local to the Exchange server instead of domain wide.

CA doesn't offer any alternate information on their web site, and I'm not sure I want to wait on the phone to ask this question. So, any technical answers by you fine folks will be apprecitated.

Dave

 

[mtnathan]

These levels of permissions are needed for doing the brick level because the way brick level backup is done depends on that.

It is almost like a normal user logging into a system, creating an exchange profile and logging into the exchange server, impersonate the accounts whose mailboxes you want to backup, and then package and transfer them for backup mailbox\folder by mailbox\folder.

These are the typical requirements of any Exchange service account type user / mailbox

For eg. check the following sites, and check the prerequisites given by them for AV scanning accounts.

http://www.pandasoftware.com/support/card.aspx?id=269&idIdioma=2&pagina=8

Page 88 -

http://www.f-secure.com/download-purchase/manuals/docs/manual/av_exch/enu/fsavmse601-admin-guide.pdf

You might be able to trim the permissions for this account at this point of time, but problems might crop up with changes in the environment.