This document details the permissions required to run UltraBac software.
If any of the required permissions aren't allowed you will get an error similar to the following:
Unable to acquire backup/restore permissions.
Access denied Errors
You may not have the required permission to run this program.
To run the UltraBac Management Console, or to run backup jobs with UltraBac, the
following permissions are required:
SE_BACKUP_NAME, "Backup Files and Directories"
SE_CHANGE_NOTIFY_NAME, "Bypass Traverse Checking"
SE_INCREASE_QUOTA_NAME, "Increase Quotas"
SE_RESTORE_NAME, "Restore Files and Directories"
SE_SHUTDOWN_NAME, "Shut down the system" (for some reason required for registry backups)
The following permissions are optional, but recommended:
SE_TCB_NAME, "Act as Part of the Operating System"
SE_INC_BASE_PRIORITY_NAME, "Increase Scheduling Priority"
SE_SECURITY_NAME,"Manage auditing and security log"
SE_TAKE_OWNERSHIP_NAME, "Take ownership of files or other objects"
These settings can be viewed on a local computer by going to the run line and typing "secpol.msc". From the domain level you would go to the run line and type "Dompol.msc".
To refresh the permissions on a windows 2000 machine, you must either reboot, or run the following commands:
SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE
SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE
On a 2008r2/2008/2003/XP host, use this command:
gpupdate /force
For more information on the SECEDIT command, please see the following Microsoft KB article: http://technet.microsoft.com/en-us/library/bb490997.aspx
For more information on the GPUPDATE command, please see the following Microsoft KB article: http://technet.microsoft.com/en-us/library/bb490983.aspx
We also have a utility that automates this. To give the necessary privileges to domain\admin on \\SERVER you would use the following utilities:
ftp://ftp.ultrabac.com/pub/utils/bupriv/bupriv.zip
This also requires the ntrights.exe from the NT Resource kit.
Once you have ntrights.exe, bupriv.ini and forbupriv.cmd in a temp folder, run the following command:
forbupriv domain\admin \\server
To use this command you must have a file called bupriv.ini in the same directory as this command file. You must also specify at least one command line option.
Example: forbupriv DOMAINNAME\USERNAME
To add the privileges to another machine in the network you must specify 2 options at the command line.
Example: forbuipriv DOMAINNAME\USERNAME \\COMPUTERNAME
Once this has been run you will need to refresh the permissions.
See UltraBac User Manual: Installing UltraBac