Acronis User Scripts

Acronis defaults to using the Local System for logon for the Acronis Managed Machine Service. The Local System account has issues that pop up randomly, so it will save you hours of headaches by avoiding it. It’s poorly documented, but Acronis recommends using either a new account at install, or creating an account and assigning it permissions. If you deploy via the EXE, it does not give the option to create a new user. I have created/manipulated 3 scripts that will create an Acronis user with a random password and store it to a custom field, assign necessary rights, and lastly, change the logon service to the new user. I cannot take full credit, I have pieced things together from various sources to get these to work :). The 2nd script uses Param, and it can’t have anything before it in the script, not even variables, so I didn’t combine them into a super script.

You may recognize this one from the local admin with random password script. Requires a custom asset field called “AcronisPass”

Import-Module $env:SyncroModule

add-type -AssemblyName System.Web

$minLength = 15 ## characters
$maxLength = 24 ## characters
$length = Get-Random -Minimum $minLength -Maximum $maxLength
$nonAlphaChars = 5
$Password = [System.Web.Security.Membership]::GeneratePassword($length, $nonAlphaChars)
$Username = "AcronisUser"

Set-Asset-Field -Name "AcronisPass" -Value $Password
write-host "Set the custom field value to $Password"

$group = "Administrators"
$KeyPath = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"

$adsi = [ADSI]"WinNT://$env:COMPUTERNAME"
$existing = $adsi.Children | where {$_.SchemaClassName -eq 'user' -and $_.Name -eq $Username }

if ($existing -eq $null) {

    Write-Host "Creating new local user $Username."
    & NET USER $Username $Password /add /y /expires:never
    
    Write-Host "Adding local user $Username to $group."
    & NET LOCALGROUP $group $Username /add

}
else {
    Write-Host "Setting password for existing local user $Username."
    $existing.SetPassword($Password)
}

Write-Host "Ensuring password for $Username never expires."
& WMIC USERACCOUNT WHERE "Name='$Username'" SET PasswordExpires=FALSE

Write-Host "Hiding $Username from login screen."
$path = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList'
New-Item $path -Force | New-ItemProperty -Name $Username -Value 0 -PropertyType DWord -Force

This assigns the proper rights to the user account. 7 lines from the bottom is the only line that is changed. You can change it to RemoveRight to remove the rights.

<#
    .Synopsis
		Add and Remove User Right(s) for defined user(s) and computer(s).
	
	.DESCRIPTION
		Add and Remove User Rights via Powershell.
	
	.PARAMETER AddRight
		You want to Add a user right.
	
	.Parameter ComputerName
		Defines the name of the computer where the user right should be granted. This can be multiple values, comma seperated.
		Default is the local computer on which the script is run.
	
	.PARAMETER RemoveRight
		You want to Remove a user right.
	
	.Parameter Username
		Defines the Username under which the service should run. This can be multiple values, comma seperated.
		Use the form: domain\Username.
		Default is the user under which the script is run.
	
	.PARAMETER UserRight
		Defines the User Right you want to set. This can be multiple values, comma seperated.
		Name of the right you want to add to: SeServiceLogonRight
		There is no default for this argument
		
		All of the Options you can use:
			Replace a process level token (SeAssignPrimaryTokenPrivilege)
			Generate security audits (SeAuditPrivilege)
			Back up files and directories (SeBackupPrivilege)
			Log on as a batch job (SeBatchLogonRight)
			Bypass traverse checking (SeChangeNotifyPrivilege)
			Create global objects (SeCreateGlobalPrivilege)
			Create a pagefile (SeCreatePagefilePrivilege)
			Create permanent shared objects (SeCreatePermanentPrivilege)
			Create symbolic links (SeCreateSymbolicLinkPrivilege)
			Create a token object (SeCreateTokenPrivilege)
			Debug programs (SeDebugPrivilege)
			Obtain an impersonation token for another user in the same session (SeDelegateSessionUserImpersonatePrivilege)
			Deny log on as a batch job (SeDenyBatchLogonRight)
			Deny log on locally (SeDenyInteractiveLogonRight)
			Deny access to this computer from the network (SeDenyNetworkLogonRight)
			Deny log on through Remote Desktop Services (SeDenyRemoteInteractiveLogonRight)
			Deny log on as a service (SeDenyServiceLogonRight)
			Enable computer and user accounts to be trusted for delegation (SeEnableDelegationPrivilege)
			Impersonate a client after authentication (SeImpersonatePrivilege)
			Increase scheduling priority (SeIncreaseBasePriorityPrivilege)
			Adjust memory quotas for a process (SeIncreaseQuotaPrivilege)
			Increase a process working set (SeIncreaseWorkingSetPrivilege)
			Allow log on locally (SeInteractiveLogonRight)
			Load and unload device drivers (SeLoadDriverPrivilege)
			Lock pages in memory (SeLockMemoryPrivilege)
			Add workstations to domain (SeMachineAccountPrivilege)
			Perform volume maintenance tasks (SeManageVolumePrivilege)
			Access this computer from the network (SeNetworkLogonRight)
			Profile single process (SeProfileSingleProcessPrivilege)
			Modify an object label (SeRelabelPrivilege)
			Allow log on through Remote Desktop Services (SeRemoteInteractiveLogonRight)
			Force shutdown from a remote system (SeRemoteShutdownPrivilege)
			Restore files and directories (SeRestorePrivilege)
			Manage auditing and security log (SeSecurityPrivilege)
			Log on as a service (SeServiceLogonRight)
			Shut down the system (SeShutdownPrivilege)
			Synchronize directory service data (SeSyncAgentPrivilege)
			Modify firmware environment values (SeSystemEnvironmentPrivilege)
			Profile system performance (SeSystemProfilePrivilege)
			Change the system time (SeSystemtimePrivilege)
			Take ownership of files or other objects (SeTakeOwnershipPrivilege)
			Act as part of the operating system (SeTcbPrivilege)
			Change the time zone (SeTimeZonePrivilege)
			Access Credential Manager as a trusted caller (SeTrustedCredManAccessPrivilege)
			Remove computer from docking station (SeUndockPrivilege)
	
	.Example
		Usage:
		Single Users
			Add User Right "Log on as a service" for CONTOSO\User:
			.\Set-UserRights.ps1 -AddRight -Username CONTOSO\User -UserRight SeServiceLogonRight
			
			Add User Right "Log on as a batch job" for CONTOSO\User:
			.\Set-UserRights.ps1 -AddRight -Username CONTOSO\User -UserRight SeBatchLogonRight

			Remove User Right "Log on as a batch job" for CONTOSO\User:
			.\Set-UserRights.ps1 -RemoveRight -Username CONTOSO\User -UserRight SeBatchLogonRight
			
			Add User Right "Allow log on locally" for current user:
			.\Set-UserRights.ps1 -AddRight -UserRight SeInteractiveLogonRight

			Remove User Right "Allow log on locally" for current user:
			.\Set-UserRights.ps1 -RemoveRight -UserRight SeInteractiveLogonRight
		
		Multiple Users / Services / Computers
			Add User Right "Log on as a service" and "Log on as a batch job" for CONTOSO\User and run on, local machine and SQL.contoso.com:
			.\Set-UserRights.ps1 -AddRight -UserRight SeServiceLogonRight, SeBatchLogonRight -ComputerName $env:COMPUTERNAME, SQL.contoso.com -UserName CONTOSO\User1, CONTOSO\User2
	
	.Notes
		Original Creator: Bill Loytty (weloytty)
		Based on this script found here: https://github.com/weloytty/QuirkyPSFunctions/blob/ab4b02f9cc05505eee97d2f744f4c9c798143af1/Source/Users/Grant-LogOnAsService.ps1
		I modified to my own needs: https://github.com/blakedrumm/SCOM-Scripts-and-SQL/blob/master/Powershell/General%20Functions/Set-UserRights.ps1
		
		My blog post: https://blakedrumm.com/blog/set-and-check-user-rights-assignment/
		
		Author: Blake Drumm (blakedrumm@microsoft.com)
		First Created on: January 5th, 2022
		Last Modified on: October 12th, 2022
#>
param
(
	[Parameter(Position = 0,
			   HelpMessage = 'You want to Add a user right.')]
	[Alias('add')]
	[switch]$AddRight,
	[Parameter(Position = 1)]
	[Alias('computer')]
	[array]$ComputerName,
	[Parameter(Position = 2,
			   HelpMessage = 'You want to Remove a user right.')]
	[switch]$RemoveRight,
	[Parameter(Position = 3)]
	[Alias('user')]
	[array]$Username,
	[Parameter(Mandatory = $false,
			   Position = 4)]
	[ValidateSet('SeNetworkLogonRight', 'SeBackupPrivilege', 'SeChangeNotifyPrivilege', 'SeSystemtimePrivilege', 'SeCreatePagefilePrivilege', 'SeDebugPrivilege', 'SeRemoteShutdownPrivilege', 'SeAuditPrivilege', 'SeIncreaseQuotaPrivilege', 'SeIncreaseBasePriorityPrivilege', 'SeLoadDriverPrivilege', 'SeBatchLogonRight', 'SeServiceLogonRight', 'SeInteractiveLogonRight', 'SeSecurityPrivilege', 'SeSystemEnvironmentPrivilege', 'SeProfileSingleProcessPrivilege', 'SeSystemProfilePrivilege', 'SeAssignPrimaryTokenPrivilege', 'SeRestorePrivilege', 'SeShutdownPrivilege', 'SeTakeOwnershipPrivilege', 'SeDenyNetworkLogonRight', 'SeDenyInteractiveLogonRight', 'SeUndockPrivilege', 'SeManageVolumePrivilege', 'SeRemoteInteractiveLogonRight', 'SeImpersonatePrivilege', 'SeCreateGlobalPrivilege', 'SeIncreaseWorkingSetPrivilege', 'SeTimeZonePrivilege', 'SeCreateSymbolicLinkPrivilege', 'SeDelegateSessionUserImpersonatePrivilege', 'SeMachineAccountPrivilege', 'SeTrustedCredManAccessPrivilege', 'SeTcbPrivilege', 'SeCreateTokenPrivilege', 'SeCreatePermanentPrivilege', 'SeDenyBatchLogonRight', 'SeDenyServiceLogonRight', 'SeDenyRemoteInteractiveLogonRight', 'SeEnableDelegationPrivilege', 'SeLockMemoryPrivilege', 'SeRelabelPrivilege', 'SeSyncAgentPrivilege', IgnoreCase = $true)]
	[Alias('right')]
	[array]$UserRight
)
BEGIN
{
	
	Write-Output '==================================================================='
	Write-Output '==========================  Start of Script ======================='
	Write-Output '==================================================================='
	
	$checkingpermission = "Checking for elevated permissions..."
	$scriptout += $checkingpermission
	Write-Output $checkingpermission
	if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
	{
		$currentPath = $myinvocation.mycommand.definition
		$nopermission = "Insufficient permissions to run this script. Attempting to open the PowerShell script ($currentPath) as administrator."
		$scriptout += $nopermission
		Write-Warning $nopermission
		# We are not running "as Administrator" - so relaunch as administrator
		# ($MyInvocation.Line -split '\.ps1[\s\''\"]\s*', 2)[-1]
		Start-Process powershell.exe "-File", ('"{0}"' -f $MyInvocation.MyCommand.Path) -Verb RunAs
		break
	}
	else
	{
		$permissiongranted = " Currently running as administrator - proceeding with script execution..."
		Write-Output $permissiongranted
	}
	
	Function Time-Stamp
	{
		$TimeStamp = Get-Date -UFormat "%B %d, %Y @ %r"
		return "$TimeStamp - "
	}
}
PROCESS
{
	function Inner-SetUserRights
	{
		param
		(
			[Parameter(Position = 0,
					   HelpMessage = 'You want to Add a user right.')]
			[Alias('add')]
			[switch]$AddRight,
			[Parameter(Position = 1)]
			[Alias('computer')]
			[array]$ComputerName,
			[Parameter(Position = 2,
					   HelpMessage = 'You want to Remove a user right.')]
			[switch]$RemoveRight,
			[Parameter(Position = 3)]
			[Alias('user')]
			[array]$Username,
			[Parameter(Mandatory = $false,
					   Position = 4)]
			[Alias('right')]
			[array]$UserRight
		)
		if (!$UserRight)
		{
			Write-Warning "Inner Function: Unable to continue because you did not supply the '-UserRight' parameter."
			break
		}
		if (!$AddRight -and !$RemoveRight)
		{
			Write-Warning "Inner Function: Unable to continue because you did not supply the '-AddRight' or '-RemoveRight' switches."
			break
		}
		elseif ($AddRight -and $RemoveRight)
		{
			Write-Warning "Inner Function: Unable to continue because you used both the '-AddRight' and '-RemoveRight' switches. Run again with just one of these present, either Add or Remove."
			break
		}
		elseif ($AddRight)
		{
			Write-Verbose "Inner Function: Detected -AddRight switch in execution."
			$ActionType = 'Adding'
		}
		elseif ($RemoveRight)
		{
			Write-Verbose "Inner Function: Detected -RemoveRight switch in execution."
			$ActionType = 'Removing'
		}
		else
		{
			Write-Warning "Something is wrong, detected logic is broken before executing main function. Exiting."
			break
		}
		Function Time-Stamp
		{
			$TimeStamp = Get-Date -UFormat "%B %d, %Y @ %r"
			return "$TimeStamp - "
		}
		$tempPath = [System.IO.Path]::GetTempPath()
		$import = Join-Path -Path $tempPath -ChildPath "import.inf"
		if (Test-Path $import) { Remove-Item -Path $import -Force }
		$export = Join-Path -Path $tempPath -ChildPath "export.inf"
		if (Test-Path $export) { Remove-Item -Path $export -Force }
		$secedt = Join-Path -Path $tempPath -ChildPath "secedt.sdb"
		if (Test-Path $secedt) { Remove-Item -Path $secedt -Force }
		$Error.Clear()
		try
		{
			foreach ($right in $UserRight)
			{
				$UserLogonRight = switch ($right)
				{
					"SeBatchLogonRight"				    { "Log on as a batch job (SeBatchLogonRight)" }
					"SeDenyBatchLogonRight"			    { "Deny log on as a batch job (SeDenyBatchLogonRight)" }
					"SeDenyInteractiveLogonRight"	    { "Deny log on locally (SeDenyInteractiveLogonRight)" }
					"SeDenyNetworkLogonRight"		    { "Deny access to this computer from the network (SeDenyNetworkLogonRight)" }
					"SeDenyRemoteInteractiveLogonRight" { "Deny log on through Remote Desktop Services (SeDenyRemoteInteractiveLogonRight)" }
					"SeDenyServiceLogonRight"		    { "Deny log on as a service (SeDenyServiceLogonRight)" }
					"SeInteractiveLogonRight"		    { "Allow log on locally (SeInteractiveLogonRight)" }
					"SeNetworkLogonRight"			    { "Access this computer from the network (SeNetworkLogonRight)" }
					"SeRemoteInteractiveLogonRight"	    { "Allow log on through Remote Desktop Services (SeRemoteInteractiveLogonRight)" }
					"SeServiceLogonRight"			    { "Log on as a service (SeServiceLogonRight)" }
					Default 							{ "($right)" }
				}
				Write-Output ("$(Time-Stamp)$ActionType `"$UserLogonRight`" right for user account: '$Username' on host: '$env:COMPUTERNAME'")
				if ($Username -match "^S-.*-.*-.*$|^S-.*-.*-.*-.*-.*-.*$|^S-.*-.*-.*-.*-.*$|^S-.*-.*-.*-.*$")
				{
					$sid = $Username
				}
				else
				{
					$sid = ((New-Object System.Security.Principal.NTAccount($Username)).Translate([System.Security.Principal.SecurityIdentifier])).Value
				}
				secedit /export /cfg $export | Out-Null
				#Change the below to any right you would like
				$sids = (Select-String $export -Pattern "$right").Line
				if ($ActionType -eq 'Adding')
				{
					# If right has no value it needs to be added
					if ($sids -eq $null)
					{
						$sids = "$right = *$sid"
						$sidList = $sids
					}
					else
					{
						$sidList = "$sids,*$sid"
					}
				}
				elseif ($ActionType -eq 'Removing')
				{
					$sidList = "$($sids.Replace("*$sid", '').Replace("$Username", '').Replace(",,", ',').Replace("= ,", '= '))"
				}
				Write-Verbose $sidlist
				foreach ($line in @("[Unicode]", "Unicode=yes", "[System Access]", "[Event Audit]", "[Registry Values]", "[Version]", "signature=`"`$CHICAGO$`"", "Revision=1", "[Profile Description]", "Description=$ActionType `"$UserLogonRight`" right for user account: $Username", "[Privilege Rights]", "$sidList"))
				{
					Add-Content $import $line
				}
			}
			
			secedit /import /db $secedt /cfg $import | Out-Null
			secedit /configure /db $secedt | Out-Null
			gpupdate /force | Out-Null
			Write-Verbose "The script will not delete the following paths due to running in verbose mode, please remove these files manually if needed:"
			Write-Verbose "`$import : $import"
			Write-Verbose "`$export : $export"
			Write-Verbose "`$secedt : $secedt"
			
			if ($VerbosePreference.value__ -eq 0)
			{
				Remove-Item -Path $import -Force | Out-Null
				Remove-Item -Path $export -Force | Out-Null
				Remove-Item -Path $secedt -Force | Out-Null
			}
		}
		catch
		{
			Write-Output ("$(Time-Stamp)Failure occurred while granting `"$right`" to user account: '$Username' on host: '$env:COMPUTERNAME'")
			Write-Output "Error Details: $error"
		}
	}
	$InnerSetUserRightFunctionScript = "function Inner-SetUserRights { ${function:Inner-SetUserRights} }"
	function Set-UserRights
	{
		param
		(
			[Parameter(Position = 0,
					   HelpMessage = 'You want to Add a user right.')]
			[Alias('add')]
			[switch]$AddRight,
			[Parameter(Position = 1)]
			[Alias('computer')]
			[array]$ComputerName,
			[Parameter(Position = 2,
					   HelpMessage = 'You want to Remove a user right.')]
			[switch]$RemoveRight,
			[Parameter(Position = 3)]
			[Alias('user')]
			[array]$Username,
			[Parameter(Mandatory = $false,
					   Position = 4)]
			[ValidateSet('SeNetworkLogonRight', 'SeBackupPrivilege', 'SeChangeNotifyPrivilege', 'SeSystemtimePrivilege', 'SeCreatePagefilePrivilege', 'SeDebugPrivilege', 'SeRemoteShutdownPrivilege', 'SeAuditPrivilege', 'SeIncreaseQuotaPrivilege', 'SeIncreaseBasePriorityPrivilege', 'SeLoadDriverPrivilege', 'SeBatchLogonRight', 'SeServiceLogonRight', 'SeInteractiveLogonRight', 'SeSecurityPrivilege', 'SeSystemEnvironmentPrivilege', 'SeProfileSingleProcessPrivilege', 'SeSystemProfilePrivilege', 'SeAssignPrimaryTokenPrivilege', 'SeRestorePrivilege', 'SeShutdownPrivilege', 'SeTakeOwnershipPrivilege', 'SeDenyNetworkLogonRight', 'SeDenyInteractiveLogonRight', 'SeUndockPrivilege', 'SeManageVolumePrivilege', 'SeRemoteInteractiveLogonRight', 'SeImpersonatePrivilege', 'SeCreateGlobalPrivilege', 'SeIncreaseWorkingSetPrivilege', 'SeTimeZonePrivilege', 'SeCreateSymbolicLinkPrivilege', 'SeDelegateSessionUserImpersonatePrivilege', 'SeMachineAccountPrivilege', 'SeTrustedCredManAccessPrivilege', 'SeTcbPrivilege', 'SeCreateTokenPrivilege', 'SeCreatePermanentPrivilege', 'SeDenyBatchLogonRight', 'SeDenyServiceLogonRight', 'SeDenyRemoteInteractiveLogonRight', 'SeEnableDelegationPrivilege', 'SeLockMemoryPrivilege', 'SeRelabelPrivilege', 'SeSyncAgentPrivilege', IgnoreCase = $true)]
			[Alias('right')]
			[array]$UserRight
		)
		if (!$Username)
		{
			$Username = "$env:USERDOMAIN`\$env:USERNAME"
		}
		if (!$UserRight)
		{
			Write-Warning "Main Function: Unable to continue because you did not supply the '-UserRight' parameter."
			break
		}
		if (!$AddRight -and !$RemoveRight)
		{
			Write-Warning "Main Function: Unable to continue because you did not supply the '-AddRight' or '-RemoveRight' switches."
			break
		}
		elseif ($AddRight -and $RemoveRight)
		{
			Write-Warning "Main Function: Unable to continue because you used both the '-AddRight' and '-RemoveRight' switches. Run again with just one of these present, either Add or Remove."
			break
		}
		elseif ($AddRight)
		{
			Write-Verbose "Main Function: Detected -AddRight switch in execution."
			$ActionType = 'Adding'
		}
		elseif ($RemoveRight)
		{
			Write-Verbose "Main Function: Detected -RemoveRight switch in execution."
			$ActionType = 'Removing'
		}
		if (!$ComputerName)
		{
			$ComputerName = $env:ComputerName
		}
		foreach ($user in $Username)
		{
			foreach ($right in $UserRight)
			{
				foreach ($computer in $ComputerName)
				{
					if ($computer -match $env:COMPUTERNAME)
					{
						Inner-SetUserRights -UserRight $right -Username $user -AddRight:$AddRight -RemoveRight:$RemoveRight
					}
					else
					{
						Invoke-Command -ComputerName $Computer -Script {
							param ($script,
								[string]$Username,
								[Parameter(Mandatory = $true)]
								[array]$UserRight,
								$AddRight,
								$RemoveRight,
								$VerbosePreference)
							. ([ScriptBlock]::Create($script))
							$VerbosePreference = $VerbosePreference
							$Error.Clear()
							try
							{
								if ($VerbosePreference -eq 0)
								{
									Inner-SetUserRights -Username $Username -UserRight $UserRight -AddRight:$AddRight -RemoveRight:$RemoveRight
								}
								else
								{
									Inner-SetUserRights -Username $Username -UserRight $UserRight -AddRight:$AddRight -RemoveRight:$RemoveRight -Verbose
								}
							}
							catch
							{
								$info = [PSCustomObject]@{
									Exception = $Error.Exception.Message
									Reason    = $Error.CategoryInfo.Reason
									Target    = $Error.CategoryInfo.TargetName
									Script    = $Error.InvocationInfo.ScriptName
									Line	  = $Error.InvocationInfo.ScriptLineNumber
									Column    = $Error.InvocationInfo.OffsetInLine
									Date	  = Get-Date
									User	  = $env:username
								}
								Write-Warning "$info"
							}
							
						} -ArgumentList $InnerSetUserRightFunctionScript, $user, $right, $AddRight, $RemoveRight, $VerbosePreference
					}
				}
			}
		}
		
	}
	if ($ComputerName -or $Username -or $UserRight -or $RemoveRight)
	{
		foreach ($user in $Username)
		{
			Set-UserRights -ComputerName $ComputerName -Username $user -UserRight $UserRight -AddRight:$AddRight -RemoveRight:$RemoveRight
		}
	}
	else
	{
		
	 <# Edit line 438 to modify the default command run when this script is executed.
	   Example: 
	        Set-UserRights -AddRight -UserRight SeServiceLogonRight, SeBatchLogonRight -ComputerName $env:COMPUTERNAME, SQL.contoso.com -UserName CONTOSO\User1, CONTOSO\User2
	        or
	        Set-UserRights -AddRight -UserRight SeBatchLogonRight -Username S-1-5-11
	        or
	        Set-UserRights -RemoveRight -UserRight SeBatchLogonRight -Username CONTOSO\User2
	        or
	        Set-UserRights -RemoveRight -UserRight SeServiceLogonRight, SeBatchLogonRight -Username CONTOSO\User1
	   #>
		Set-UserRights -AddRight -UserRight SeServiceLogonRight, SeIncreaseQuotaPrivilege, SeAssignPrimaryTokenPrivilege, SeSystemEnvironmentPrivilege -Username AcronisUser
	}
}
END
{
	Write-Output "$(Time-Stamp)Script Completed!"
}

This sets the AMMS logon to the Acronis user. You need a platform variable of $Password set to the AcronisPass custom field.

# Enter the name of the user account
$UserName = ".\AcronisUser"
# Enter the name of the service to set; i.e. EventLog
$Service = "MMS"
$svc_Obj= Get-WmiObject Win32_Service -filter "name='$Service'"

# Stop the service
$StopStatus = $svc_Obj.StopService() 
If ($StopStatus.ReturnValue -eq "0") {
Write-host "The service '$Service' Stopped successfully" -f Green
} Else {
Write-host "Failed to Stop the service '$Service'. Error code: $($StopStatus.ReturnValue)" -f Red
Exit 1
}
 
Start-Sleep -Seconds 10

# Set the service credentials
$svc_Obj.change($null,$null,$null,$null,$null,$null,$UserName,$Password,$null,$null,$null)

# Start the service
$StartStatus = $svc_Obj.StartService() 
If ($StartStatus.ReturnValue -eq "0")  {
Write-host "The service '$Service' Started successfully" -f Green
} Else {
Write-host "Failed to Start the service '$Service'. Error code: $($StartStatus.ReturnValue)" -f Red
Exit 1
}

More documentation on the logon service
Acronis Cyber Protect Cloud: Windows Services and Processes | Knowledge Base - One of the few places that list the AMMS and shows to either use the Acronis Agent User or create a new one.

Acronis Cyber Protect Cloud, Acronis Cyber Backup: required managed machine service user rights | Knowledge Base - Required user rights

Acronis Backup & Recovery 10 Fails to Create a Backup Plan | Knowledge Base - Older documentation for another product, but have seen this issue.

Acronis Backup: Do Not Run Acronis Managed Machine Service under the Local System Account | Knowledge Base - Another product, but same service and it states not to use the Local System account because it doesn’t have the proper network permissions.

1 Like

Thank you Jimmie!

I wonder if anyone knows what the parameter for “what to install” for Syncro’s Acronis installation script is. For example, I don’t want the Cyber Protect Monitor to be installed on clients workstation so they should not be able to run or stop backups on their end.

Maybe this, not install the Tray Monitor. Acronis Cyber Protect Cloud: RMM unattended installation | Knowledge Base

1 Like

Yup! That worked. Not sure how I missed that documentation…

Thank you so much!

Very easy. Their documentation is all over the place. I find stuff for older products that apply to the newest product but isn’t in both areas. If you notice in that article, they don’t list all the switches nor a link to all the switches.