Search <book_title>...

Enterprise Vault™ Installing and Configuring

Last Published: 2024-09-02

Product(s): Enterprise Vault (15.1)

Creating the Vault Service account

The Vault Service account is used by Enterprise Vault processes to access the Windows server operating system. The account is shared by all the Enterprise Vault computers in the Enterprise Vault directory. If you are managing multiple Enterprise Vault sites, you can use the same Vault Service account for more than one Enterprise Vault site.

The Vault Service account must be a member of the local Administrators group on each Enterprise Vault computer. The account must be a domain-based Windows security account that belongs to the local Administrators group on all servers in the Enterprise Vault directory. The account password must not be blank. If you create more than one Enterprise Vault site in the same Enterprise Vault directory you must use the same Vault Service account for all sites.

We recommend that you do not make this account a Domain Administrator. It is better to assign required permissions explicitly. This section describes the basic permissions that you need to set for this account. Different types of archiving require additional permissions for the Vault Service account. For details of these, see the section on the type of archiving that you are implementing.

If possible, create the account so that it is in the same domain as the Enterprise Vault computers. If it is necessary for the Vault Service account and the Enterprise Vault computers to be in different domains, create the account so that it is in a domain that is trusted by the Enterprise Vault computers' domain.

Ensure that the Microsoft Message Queue security has been set up to grant the Administrators group access to the Enterprise Vault queues.

You must be logged in to the Vault Service account when you install Enterprise Vault and when you run the Enterprise Vault Configuration wizard.

Some pages of the Configuration wizard require you to specify the locations for SQL Server database files. You can specify the locations explicitly, by entering the path from the perspective of the SQL Server computer. The wizard also provides Browse buttons to let you browse the SQL Server computer to select the locations. However, folder browsing is only available if the Vault Service account has access to the administrative shares on the SQL Server computer. Note that some wizards in the Administration Console provide similar Browse buttons. To use those Browse buttons, the account that you use to run the Administration Console also requires access to the SQL Server's administrative shares.

Unless you assign the SQL system administrator (sysadmin) role to the Vault Service account, you must perform some additional steps before you run the Enterprise Vault Configuration wizard for the first time.

See About assigning permissions and roles in SQL databases.

During configuration, you are asked to provide the name and password of the Vault Service account. Enterprise Vault automatically grants the account the following advanced user rights:

Log On As a Service
Debug programs
Replace a process-level token

Note that you may need to wait for Active Directory replication to complete. The account cannot be used until the replication is complete.

To create the Vault Service account

On the domain controller, start Active Directory Users and Computers.
In the left-hand pane of Active Directory Users and Computers, double-click the Domain container.
Double-click the Users container.
On the Action menu, click New and then User. The New Object - User screen is displayed.
Complete the New Object - User screen and click Next. The next screen asks for password details.
Enter a password and confirm it. You must set a password; the Vault Service account password cannot be blank.
Note:
If you ever change the password of the Vault Service account, and you have installed an Enterprise Vault add-on, you may also need to change the user account credentials of the Vault Service account in the add-on. See the documentation that accompanies the add-on for more information.
Select the Password never expires check box.
Leave the remaining check boxes clear:
- User must change password at logon
- User cannot change password
- Account is disabled
Click Next to move to the summary screen.
Click Finish to create the new user.

To add the new Vault Service account to the local Administrators group

Log on to the Enterprise Vault computer as Administrator.
In Control Panel, open Administrative Tools and start the Computer Management console.
Expand System Tools and then Local Users and Groups.
Select Groups, and then double-click the Administrators group in the right-hand pane.
Use Add to add the Vault Service account to this group.
Click OK.
Repeat these steps on each computer which will have Enterprise Vault installed.

To make the Vault Service account non-interactive

For enhanced security, if you wish to make your Vault Service account non-interactive, include the Vault Service account in the Deny log on Locally and Deny log on through Remote Desktop Services lists on the Enterprise Vault servers and standalone Enterprise Vault Administration Console servers using security policies.

Once the Vault Service account has been set to non-interactive, use the existing Enterprise Vault roles-based administration (RBA) roles by assigning users to their relevant roles.

For example, to run Enterprise Vault Policy Manager (EVPM), use the Exchange Administrator role; for the EVSVR utility, use the Storage Administrator role; for VQA, use the Power Administrator role, and so on.

Critical tasks such as upgrading Enterprise Vault, which require Vault Service account credentials, must be carried out by temporarily granting interactive privileges to the Vault Service account.

Note:

If you face issues with temporary folder security checks, see https://www.veritas.com/content/support/en_US/article.100014060.

Before performing EVSVR operations involving users assigned the Storage Administrator RBA role, ensure that Read and Write permissions are re-applied to the existing partitions for those users.