Hello, running Duplicati as windows service on Windows 11 Pro machines with this install command:
.\Duplicati.WindowsService.exe install-only --server-datafolder="C:\ProgramData\Duplicati\database" --webservice-interface="{ip}" --webservice-sslcertificatefile="C:\ProgramData\Duplicati\Cert4Duplicati.pfx" --webservice-sslcertificatepassword="{pfw.pw}" --webservice-allowed-hostnames="backup.example.com;{machine}.{tailnet-domain}" --log-file="C:\ProgramData\Duplicati\logs.txt" --log-level=Error --windows-eventlog=true --windows-eventlog-level=Information
The back-up service needed to be working without the user logging into their account, hence using the windows service installation path. Also, Duplicati needed to backup folders of different windows users crossing the single user context, hence going with SYSTEM. This was set-up in the duplicati 1.x days years ago.
In the newer duplicati versions, I gathered that automatic database encryption will be applied and - in this case - stored in the SYSTEM’s windows credential manager. It seems very hard for an admin user to retrieve the credential saved by the SYSTEM as there is no normal interface access.
If the database is encrypted, I would like to backup the secret.
What would be the recommended upgrade path going forward in this situation? (xOR)
- Should I just add the
-disable-db-encryption=trueto the service’s launch command? - Should I create a special windows user with admin rights and update all related folder’s security setting to allow the read/write operations required for backup, then log into that account as windows user and extract the password from its Windows credential manager and save it as backup?
- Should I change topology and pick a main user, and run the service under their account and simply update folders rights across user account boundaries? (Though frowned upon years ago, nowadays machines in this context have become less shared and perception might have changed, so perhaps it has become acceptable.)
- {Other existing upgrade paths.}
- Please let me know how you would handle this. (Not limited to options 1 to 3.)
- Please warn me if there are other changes since 2.2.0.3 that require attention and threaten duplicati uptime. (FYI: Backup are saved to other hard drive and synced by other tool.)