Running backups with nobody signed in

Normally the background agent runs under your Windows account, from the moment you sign in. A PC that waits at the sign-in screen overnight needs more. Service mode installs a Windows service that runs the schedules machine-wide, with nobody signed in. It is part of Pro.

Turn it on#

1. Open Settings ▸ Schedule & power.
2. Under Unattended, turn on Run scheduled backups even when nobody is signed in.
3. Approve the Windows administrator prompt. Waiting for the administrator prompt… becomes Service running.

Setup offers the same as a tick box, Run scheduled backups even when nobody is signed in, unticked by default.

Schedule and power settings page

While service mode is on, Settings says Connected to the machine-wide service. Jobs and settings shown here are the service's.

What changes#

Only your Windows account, and the PC's administrators, can reach the agent. An administrator gets in only from a program run as administrator. On another Windows account on the same PC, GBM AI says This PC's backups are managed by another account: Only the Windows account that turned it on, and the PC's administrators, can open it: sign in to Windows as that account to see its backups. Home then shows only that card, and the icon in the notification area says the same, with Back up now, New backup…, Restore files… and Ask Genie… greyed out.

What comes along#

Switching carries everything across: your jobs, settings, schedules, run history, and the encrypted stores that hold job passwords, saved network credentials and S3 profiles. They are sealed for the PC, so a job to a NAS or a bucket runs before anyone signs in, with the credentials you saved. Switching back hands them back to your account, with any change you made meanwhile.

The service runs as Windows' own system account (Local System), not as you. A share that let you in with your Windows sign-in, and has no saved credential in GBM AI, refuses the service. Save its user and password under Settings ▸ Network & credentials before you switch service mode on, or run the service as an account the share lets in (below).

Run the service as another account#

Some shares let in only a domain account: a server's shares, a NAS joined to the domain, DFS folders. The service can run as that account instead of Local System.

1. Under Settings ▸ Schedule & power ▸ Unattended, next to Runs as, click Change….
2. Choose This account. Type the account as Windows writes it: CONTOSO\backup for a domain account, .\backup for an account on this PC, or backup@contoso.com. Type its password.
3. Click Test. GBM AI signs the account in and checks that it is in this PC's Administrators group: Signs in. CONTOSO\backup is an administrator on this PC.
4. Click Use this account and approve the Windows administrator prompt. The service restarts as that account: The backup service now runs as CONTOSO\backup.

The account must be in the PC's Administrators group, directly or through a domain group: the service reads every user's files and takes the snapshots that open files need. GBM AI gives the account Windows' Log on as a service right, as the Services console does. The password goes from the window to Windows only, sealed for the elevated step with a one-time key; GBM AI does not keep it. A backup that is running when you switch stops, and runs again at its next time.

On a domain whose Group Policy sets Log on as a service, add the account to that policy too: Windows replaces the right GBM AI gives at the next policy refresh, and the service then cannot start after the next restart.

To go back, click Change…, choose Local System (recommended) and Use Local System.

When the account's password changes#

Windows then cannot start the service, and GBM AI says The backup service can't sign in as CONTOSO\backup, in the window and on the icon in the notification area. Neither starts the service again on its own: each try would be a failed sign-in, and a few in a row lock the account out of the domain. Click Enter the new password, test it and click Use this account, or click Use Local System.

Turn it off#

Turn the same switch off and approve the prompt. The service is removed, and scheduled backups run through your signed-in agent again: The service was removed. Scheduled backups run through your signed-in agent.

Troubleshooting#

• E-SVC-002: The service change was cancelled at the administrator prompt. Try again and approve it.
• E-SVC-003: The Windows service could not be installed or removed. Look in service-setup.log, in %ProgramData%\GBM AI\logs, and try again.
• E-SVC-004: The account name or password is wrong. Check the name and its current password.
• E-SVC-005: Windows doesn't let this account sign in. The message says why: disabled, locked out, expired, a password that must be changed, or not allowed on this PC.
• E-SVC-006: The account isn't an administrator on this PC. Add it to the PC's Administrators group, or choose another account.
• E-SVC-007: The account's domain doesn't answer. Check that the PC reaches the domain (network, VPN), then try again.
• E-SVC-008: The backup service couldn't sign in as its account. Right after a switch, GBM AI puts the service back on Local System so backups go on: check the account and try again. Later, when its password changed, click Enter the new password or Use Local System.
• The backup service isn't running: click Start the service and approve the prompt. See The background agent is not running.
• Restart under Settings ▸ Advanced ▸ Background agent is hidden in service mode, because Windows runs the service.

Related articles#

• Schedule & power settings
• Needs administrator
• Keeping the PC awake for a backup
• Backing up to a NAS or network share