Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a daily backup which is scheduled through the Task Scheduler. It failed with a strange error code last night, but I was able to search and find a blog post with how to avoid the error in the future. However, one of his recommendations was to run the backups as the Administrator user of the domain. Since all of the files being backed up are local to this system, should I continue to have the backups run as SYSTEM? Or is it actually better to run it as a different user? I have been running these backups for well over a year now and have only had a handful of failures, but ironically when it does fail, the error code means it was a permissions issue (or so I read, this code seems to be undocumented by Microsoft).

Thanks in advance for any insight into this.

Might as well post the error code here too, in case anyone would like to share their insight on this as well, but I rarely ever get this error, so I don't care too much about it: 4294967294

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You should run your backups as a "Backup" user, which has permission to read the files it should back up, and permission to write to the storage device where backups are being stored, and nothing else.

Running backups as SYSTEM or a domain administrator means that if the backup account gets compromised or an exploit is found in the backup system, your entire system is vulnerable. Running with a restricted user means only the storage area of your backups can be damaged (which should have write and read permissions, but NOT execute permissions. There is no reason to execute a program from a backup storage device, and this will prevent a compromised backup account from creating an executable there and then running it).

(This may require creating a new user and manually assigning permissions.)

share|improve this answer
    
I was afraid of hearing those words... we were still a very small company when I first set up the server so I never really cared much about security. But now we're a part of something much bigger and I find myself concerned with making sure everything I enforce from here on out is secure. Doesn't bode well for a lazy guy like me haha –  Alexander Miles Sep 28 '12 at 15:32
    
Oh, but it does! You see, cleaning up after an intrusion is a huge hassle, generally requiring the server to be wiped and rebuilt from scratch. Proper security is the lazy man's way to avoid that. ;) –  Darth Android Sep 28 '12 at 15:53
    
I see your security and I raise you a disk image. Something tells me that might not work like I think it should though. –  Alexander Miles Sep 28 '12 at 16:04
    
That's the easy part. Then you have to apply updates, find out which (if any) of the backups were tampered with, restore configurations, restore backups, notify customers if there's customer data on the machine... Security really is the laziest option :P –  Darth Android Sep 28 '12 at 16:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.