Specifying credentials for Acronis services

The following Acronis Backup & Recovery 11.5 components run as services: Acronis Backup & Recovery 11.5 agents, Acronis Backup & Recovery 11.5 Management Server, and Acronis Backup & Recovery 11.5 Storage Node. When installing any of these components, you need to specify the account under which the component's service will run.

All Acronis Backup & Recovery 11.5 agents installed on a machine use the common Acronis Managed Machine Service, also referred to as the agent service.

For each service, you can choose to create a new user account or specify an existing account of a local or domain user; for example: .\LocalUser or DomainName\DomainUser

By default, the setup program will create a new dedicated account for each of the services.

When to consider an existing account?

New accounts fit most cases. Consider existing accounts in the following cases:

• The machine is a domain controller in an Active Directory domain.

  You must specify existing accounts (or the same account) for each service. For security reasons, the setup program does not automatically create new accounts on a domain controller.

• You are installing an agent on a failover cluster node.

  When installing an agent on a failover cluster node, such as a Hyper-V cluster node or a cluster node of Microsoft Exchange Server, specify an existing account of a domain user for the agent service. The account must have administrative privileges on each of the cluster nodes. With this account the agent will be able to access the clustered resources on any of the nodes. Alternatively, you can choose to create a new account for the agent. Then, when creating centralized backup plans or recovery tasks, you will need to specify credentials for the domain account with the necessary privileges.

• You want the management server to use an existing Microsoft SQL server.

  Specify an existing account for the management server service if the management server and the SQL server are installed on different machines and you want to use Windows Authentication for the SQL server. For more details, see “Specifying Microsoft SQL servers”.

Privileges for accounts

Both existing and newly created accounts are given the following privileges:

• The accounts for the agent service and the storage node service are included in the Backup Operators group.

  New accounts for the agent service and the storage node service are also included in the Administrators group. If you specify an existing account for the storage node service, we recommend that this account be a member of the Administrators group. Otherwise, the service may lack access to some Windows resources. For security reasons, the setup program does not automatically include existing accounts in the Administrators group.

• The account for the management server service is included in the Acronis Centralized Admins group.
• All three accounts are assigned the Log on as a service user right.
• All three accounts are granted the Full Control permission on the folder %AllUsersProfile%\Application Data\Acronis and on its subfolders.
• Each of the three accounts is granted the Full Control permission on certain registry keys in the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Acronis.
• The account for the agent service is assigned the Adjust memory quotas for a process, Replace a process level token and Modify firmware environment values user rights.

Tips for further usage

• The new accounts for the agent service, the management server service, and the storage node service have the names Acronis Agent User, AMS User, and ASN User, respectively.
• If the machine is part of an Active Directory domain, make sure that the domain's security policies do not prevent the accounts described in this section (whether existing or newly created) from having the above listed user rights.
• After the installation, avoid specifying a different account for a component's service. Otherwise, the component may stop working. If you must specify a different account, make sure that the new account is granted the above listed privileges.