Lock Down Restore Capabilities

[chad_small]

So TSM will allow anyone who has access to the command-line or GUI to restore data they have permission. I need a way to lock down restore functionality to only the TSM admins. So I'm thinking it's going to come down to the file permissions not allowing the GUI or command-line to be executed unless by the TSM backup group. If you have had to do something similar to this, what steps did you take?

 

[bbeaulieu]

That's a good question. How do large companies with server groups, backup groups, application groups all get along with TSM?

 

[chad_small]

The only way I've found is by using the session initiation setting on the TSM server. This would only allow the TSM server to initiate session so theoretically only even a restore should fail unless initiated from the TSM server.