AD Group Mapping and Least-Privilege Recovery
Contoso uses NetWorker 19.8 with authc integrated to AD. AD groups are NW-Admins, NW-BackupOps, NW-Recovery, and NW-Audit. NMC runs on a separate Windows host. After adding a user to NW-BackupOps, the user can authenticate to NMC but sees no policies and cannot open the monitoring view. A user in NW-Admins can delete devices and change retention. A consultant must recover only D:\Legal for client legal-fs01, and must not browse any other client. The built-in administrator account is still enabled with the installation password. NMC roles were assigned by adding users directly to the Console Administrators group; no NetWorker user groups were created. AD group nesting is used: NW-BackupOps contains regional subgroups.
1. Explain why the NW-BackupOps user sees no policies despite successful NMC login, and what you would configure.
Read the worked answer
NMC authentication and NetWorker authorization are separate. The user can authenticate to NMC because of AD/authc and the NMC role, but sees no policies because the mapped NetWorker user group lacks the privilege required to view or modify policies. Create NetWorker user groups for each AD group and map them through authc external roles. Grant only the needed privileges, such as Monitor NetWorker for monitoring and Configure NetWorker only for administrators. Check nested groups: authc may not expand nesting by default, so add the direct regional group or configure group expansion. Verify with nsradmin and the authc logs.
2. Map the four AD groups to least-privilege NetWorker privileges and NMC roles. Justify each.
Read the worked answer
NW-Admins: NetWorker administrators with Configure NetWorker, Operate NetWorker, Operate Devices and Jukeboxes, and Monitor; NMC Console Administrator. NW-BackupOps: Operate NetWorker, Operate Devices and Jukeboxes, Backup Local Data, and Monitor; NMC Console User. NW-Recovery: Recover Local Data, Recover Remote Data, and Monitor; NMC Console User. NW-Audit: Monitor NetWorker only; NMC Console User with read-only monitoring. No group except NW-Admins gets Configure, which separates device deletion and retention changes from daily operations and recovery. This is least privilege while keeping duties separated.
3. How would you grant the consultant recovery-only access to legal-fs01, and how would you harden the default administrator account?
Read the worked answer
Create a dedicated NetWorker user group with only Recover Remote Data and add the consultant's AD account or group. Set legal-fs01's Remote Access field to the consultant's host or user so only that client's data is accessible. Do not add the consultant to NW-Recovery or NW-Admins; assign NMC Console User rather than Console Administrator. For hardening, disable or rename the built-in administrator, set a strong unique password or vault it, enforce AD authentication, restrict NMC/authc access by firewall, enable audit logging, and review user groups regularly. Test that the consultant can recover legal-fs01 but cannot browse another client.