Although TSM can only back up an entire machine's filestore when running under an administrative account, it can be run under a non-administrative account in one of two ways.
2. Under a normal user account (32-bit XP only)
Give the relevant account
Read & Execute,
Writerights on the TSM installation folder (default
C:\Program Files\Tivoli\TSM\baclient\) so that errors can be logged in the error log file
dsmerror.log. Note that by default, users do not have the
Writepermission set on this folder.
Add the following option to the
dsm.optconfiguration file in the TSM installation folder:
- This will allow the user account only to back up files in directories and on drives to which they have access rights. Other files, system objects (e.g. the registry) etc. cannot be backed up. NT file attributes will not be backed up with files and thus will be lost when the files are restored.
3. To run a TSM backup from an account belonging to the Backup Operators group (XP, 2003, Vista, 7, 2008, 2008R2, 8)
- Of the two possible methods of backing up Windows from a non-administrative account, this is the only one that will work in Windows Vista or higher (except that it does not work in Vista Home, which lacks the Backup Operators administrative group). Please see additionally Backing up Windows Vista and higher as a non-administrative user on this topic.
- Add the account to the Backup Operators group.
Ensure that the account has Write rights on the TSM Installation folder
Ensure that the Backup Operators group has the following rights (via
[Local Security Policy]>
[User Rights Assignment]):
Back up files and directories Restore files and directories Manage auditing and security logs
Note that by default, this group does not have the last of these rights (Manage auditing and security logs), and so it should explicitly be given this.
- This account should now be able to back up all files local to the machine. However, some Windows system objects such as Active Directory still require administrative privileges to perform backups.
Note that as a consequence of running TSM as a non-administrative user, you will be prompted for the TSM password irrespective of the setting of the
Generate in the configuration file. This is because the account will not have rights to access the encrypted TSM password in the Registry.
The README notes from Tivoli on this subject are reproduced in the following document on access rights.