Acronis 12.5 and vSphere 6.5 permissions required to create VM
Hi,
Is there an updated document that describes the permissions required to create a vSphere 6.5 VM during a recovery process from Acronis 12.5?
We tried this document (44184) but we still get SOAP error, access denied trying to restore. As soon as we give the service account Administrator permissions in vSphere it works.
thanks
Pete
Vasily, thanks for the quick reply.
I'll give this a test and reply back with the result.
Thank you very much!
Vasily,
The changes to permission were made and still it does not work. There is something else we are missing.
Let me know if you have any other ideas.
thanks
Pete
Hi,
The problem could also be related to the way you're applying permissions for account in vSphere, for example it may be granted with permissions on Datacenter level, while lack permissions on vCenter (higher level). To confirm that this is not the case, try to apply the account permissions on vCenter level with "Propagate to child objects" option enabled (right click on vCenter->Add permissions... -> add your service account with proper custom role). If this doesn't help then the problem will require further investigation with our support team involved. The exact vSphere permission which is causing the failure could be searched for in the vCenter/ESXi host logs.
P.S. The main difficulty with vSphere permissions is that they are quite often changed between updates of vSphere (even within the same version) + they depend on specifics of the operation you perform (for example depends on VM configuration and additional parameters of it), so in some cases it requires to dig through the logs to understand which permission is additionally required. As soon as we discover such new permissions we add them to our documentation.
Thank you.
Vasily, you are correct. It was a versioning issue. We are on 6.5.
I don't actually manage our vSphere environment but the coworker who does is an experienced VMWare-certified engineer and he figured it out. Below are the steps required in vSphere management console to address it.
- Virtual Machine /Configuration/Select All
- Virtual Machine/State was replaced by Snapshot Management
- Virtual Machine/Snapshot Management – Select Create Snapshot and Remove Snapshot
It works now with these changes so it's something you may want to submit to test and update your documentation for vSphere 6.5.
Thanks
Pete
Hi Pete,
Thank you for the provided additional details. I've also created a custom role and assinged it a dedicated service account on vCenter level in order to try several combination of permissions. The permissions listed in documentation were sufficient to perform recovery, and in particular permissions from Virtual Machine->Configuration section. Even though my account originally lacked some of them - they were listed on the log file (even though these permissions were not really required for this particular recovery into new VM operation) under corresponding warning message:
Have you checked the log file to see if there are permissions-related messages inside?
Here's what I have configured for my custom role for the permissions you mentioned (Virtual Machine->Configuration) - it's all set in accordance with the table from documentation:
Account using this role is given permissions on vCenter level with "Propagate to child objects" option enabled. I'm using vCenter 6.5 + vSphere cluster containing 2xESXi hosts (6.5 and 6.0 versions) as target for recovery. I have also tried to enable/disable "Virtual Machine->Snapshot Management->Create/remove snapshot" permissions inside the role, but it didn't affect recovery into new VM.
In other words I'm unable to find what exactly needs to be changed in the documentation unfortunately, as it seems Ok from my side and I can't identify the exact permission which might be missing in your scenario :(
Thank you.