Backup Exec service account?

[porkchopexpress]

I'm about to inherit some servers with backup exec 11D installed and wondered about the service account, does the service account have to be a domain admin or can a domain user account be configured to perform the task?

Thanks.

 

[steveot]

Domain Admin all or nothing.
Would you take the risk of mad employees end user restoring and overwriting your data or restoring to a removable drive an d leaving.

 

[porkchopexpress]

I was thinking more of a way of configuring a domain user account to have the rights to backup a server e.g member of backup operators, logon as a service and so on without the user having to be a member of the domain admins group.
It seems to be a very powerful account and when you consider how many remotely exploitable security flaws there have been with some backup software agents (services that run with DA rights) recently it seems like a security issue.

If this is the standard way then i'll stick with it i was just wondering if there was a more secure configuration.

Cheers.

 

[porkchopexpress]

Another quick question if you don't mind. I notice that you can use liveupdate on the backup servers which is a big improvement over CA, i can't see it on the servers that have remote agents installed how do i make sure the agent is upto date with patches or is that handled by the server that deployed the agent?

Thanks.