Where do I find detains on account requirements.

Hi all,

I am currently trying to set up DP (Version 10) at my site. We have a 2019 Hypervisor with a 2019 VM that runs Data Protector. The plan is to push a media agent to the Hypervisor (where the FC tape library is) to allow connections.

The problem I am having is I cannot find a set of permissions for a service account that will work. I have even gone so far as to give it my domain admin accounts but still get failure messages about "account not found", "does not have access" etc. I have looked in the documentation I can find and all it seems to say is "enter account detains in the format..." But nothing what accesses I need to assign the account - indeed I don't even know if I need a local account - a domain account or some sort of hybrid. 

I'm not asking anyone to "do my homework" just hope that someone can point me to the associated documentation. I mean - if someone does happen to know then I'll not say no but I am happy to read myself.

Thanks in advance


  • Have not worked on DP in awhile but if I recall it is expecting a specific format in user account.    Its DP specific not AD specific. something like admin|admin|01    or similar.

    Try checking previous set users.

  • Suggested Answer

    Hi Kevin,

    When you're adding any user using the omniusers command, the related "Web Username" will automatically get generated based on the other inputs (user, group and client).

    • By default, all the users have web service access.
    • The users can access dashboard or REST APIs using their web user name.
    • The web user name is in the format: <name>|<domain>|<client>.

    The password must comply to the following:

    • Must be minimum 8 characters and a maximum of 20 characters
    • Includes at least one upper case letter, one lower case letter, and one numeral
    • Includes at least one of these special characters: an asterisk ( * ), a dot ( . ), an hyphen ( - ), or an underscore ( _ )
    • Does not include spaces 

    You can use -pass with omniusers right away or you could also set the password from the GUI's Users context afterwards. Once in the GUI, you can also add more users there (instead of using omniusers). With "omniusers -list" you can easyly list all configured users and the format of the output will look like this:

    Name: TESTNAME
    Group: TESTGROUP
    Client: pue01dp10.swinfra.net
    Web Username: testname|testgroup|pue01dp10.swinfra.net

    Hopefully this helps as a start. Let us know.


    Koen Verbelen
    Micro Focus Customer Care Specialist
    If this answered your question, please mark it as "Suggest as Answer" or "Verify as Answer".
    If you found this post useful, please give it a "Like".

  • Suggested Answer


    From an older DP installation guide we can see:

    Installing a Windows Cell Manager

    Reverse DNS lookup for host name resolution is required for all Data Protector components in the Data Protector cell.

    The user account used for the installation must:

    Have administrative (Administrator) privileges on the selected target system.

    Have network access user rights set in the Windows local security policy.

    The Data Protector Inet service by default runs under the Windows local user account SYSTEM. However, if for various reasons the Inet service runs under a Windows domain user account, you must additionally grant it the following Windows operating system Security Policy privileges:

    Impersonate a client after authentication

    Replace a process level token

    So basically you must use domain administrator user