Run Backup as different Windows user - FEATURE REMOVED?
Long time user of every version of TI for 8-10 years. Just installed TI 2016, and creating the first backup job. Can't find the option to "run backup as different Windows user". Where is it? It used to be the last option in the "Advanced" tab under "Backup Options".
I've been using this feature for years in previous versions of TI. I have a Windows userid on every PC who's ONLY purpose is to manage backups. All backup drives / folders have security permissions such that only this special "Backup" userid has write access. Therefore a virus like cryptolocker can't mess with my backups because my normal userid (the one that might get a virus) can't mess with the backups, it only has read access.
Can anybody help?
Running from a different account wouldn't b able to do a library backup. That wouldn't work. Plus you would probably have to run it manually.
Since it runs a service could you change the service login? Just a thought.
Sorry I've been slow to reply.
Pat L: Thanks for the note that v2016 runs as a service. My backups work fine!
As it turns out, it's OK that the feature "run backup as different Windows user" has been removed. With v2016 running as a service, it already has full (system?) access to my backup folder. So it's able to write the TIB file. And my "normal" userid still only has READ access to, so I'm safe from a cryptolocker or similar exploit.
Unfortunately, the Acronis support engineer didn't seem to know this (and/or was too poor of a communicator to express it). Frustrating.
But huge thanks to the help on this forum!
Cyrptolocker is active again. We should use all possible prevention methods, good article - http://www.tripwire.com/state-of-security/security-data-protection/cyber-security/22-ransomware-prevention-tips/
More about Cryptolocker virus - http://nabzsoftware.com/types-of-threats/cryptolocker
In the past I also used this feature to backup into a folder on my PC that belonged to another user. The idea was to restrict access to that folder so that maybe a ransomware cannot access it. How would I do this now with TIH running as a service?
If ransomware has already infiltrated your system, chances are, all of your local data and anything attached to it are toast. I can only recommend keeping additional backups offline (Acronis Cloud, a USB drive that you disconnect after backups are done, or use an SMB share that does not have direct access except for when the backup is running).
Well this might be true and I will of course have additional backup options, but my questions is still not answered...
Well this might be true and I will of course have additional backup options, but my questions is still not answered...
I think Pat answered it...
The option is not available in 2016, as now ATI runs as a service. So you would create an admin account called "Backup", install and set up ACronis from that account and you should be fine.
The online dashboard is also pretty nifty, although it has its quirks. It allows you to remotely trigger backups provided the computer is turned on and not sleeping.
Also, and unfortunately, local system permissions won't save you from ransomware. If there is write access to a folder, chances are it can be modified by ransomware anyway - most people stay logged in with an admin account and therefore elevation of credentials is always possible on a folder where that account may not have specific write access. There are a gagillion different types of malware - all equally nasty and just as capable of destroying your OS and/or personal data as long as there is physical access to the system and/or data. Several forms of malware are more than capable of changing ownership and/or permissions on files and folders if it is installed or run with an admin account or can find a way to elevate itself to do so.
If you want backup and data protection, also take offline backups (recovery media booted outside of Windows) and disconnect them once the backup is done and before Windows ever boots back up - leave them disconnected from the computer and only connect them again when you go to backup up with offline media the next time. Multiple backups (to include Cloud backup or other offsite locations... at least off computer) are the only way to be truly protected by ransomware and other forms of malware. Physical security is the best chance of backup integrity, yet one area that most people rarely consider because of the inconvenience factor.