Why do my backup policies fail when a database's guest user is disabled?
I've spent most of today bashing my head against this, and didn't come up with anything. I tried:


Messing with msdb roles on the CMS
Messing with msdb roles on the target servers
Messing with server roles on the CMS and target servers
Petitioning the gods of old
Trying something convoluted involving credentials and proxies


In the end, nothing worked. I believe this is possible on SQL Server 2014, which has a "CONNECT ALL DATABASES" server-level permission, but 2012 has no equivalent that isn't also a much larger security risk than I'm willing to accept.

I decided to bite the bullet and add the account as a user on every database. Here's what I did:

exec sp_MSforeachdb 'if ''?'' in (''master'',''msdb'',''tempdb'') return; use [?]; CREATE USER [domain\account] FOR LOGIN [domain\account];'


Executing this script against the CMS added the user to every database on every instance except for master, msdb, and tempdb. I left model in so that when we create databases in the future, they'll already have the user added.

If anyone has a better way that doesn't involve mapping to every database, feel free to share, but at this point I'm not convinced it can be done (short of making the account sysadmin, which I doubt would make it into production).