2

On my Windows 7, I created a user, BackupUser5, and added him to the "Backup Operators" group. By design:

Members of this group can back up and restore files on a computer, regardless of any permissions that protect those files. This is because the right to perform a backup takes precedence over all file permissions. Members of this group cannot change security settings.

I ran Windows "Backup and Restore" in elevated mode (elevated with BackupUser5 permissions). Then, I pressed the "Back up now" button (as shown below). Windows asked for credentials, and I entered the credentials for BackupUser5. Here's the results:

enter image description here

As shown above, I got an access denied message. I don't know why? (Of course, if I use an admin credential, I won't get the error. The question is, why a "Backup Operators" member can't do that.)

3
  • @TheCleaner: The privilege (right) Log on as a batch job is given to Administrators, Backup Operators, and Performance Log Users. While this implicitly gives the right to my BackupUser5 user, I explicitly gave it this right, logged off, logged on back again, and repeated the procedure, to no avail :( Jun 11, 2013 at 22:17
  • Try not running elevated, that might require admin privs that backup operators dont have...
    – Keltari
    Jun 12, 2013 at 19:59
  • @Keltari: Sorry, it didn't work either... Jun 12, 2013 at 20:15

4 Answers 4

1

If you're absolutely looking for an incremental solution, this answer might not be of much help, but if you can settle for a system image, the wbadmin command-line tool will do: http://technet.microsoft.com/en-us/library/cc742083.aspx

For some reason, the GUI version requires full admin privileges, but the command-line doesn't. Just make sure to run an elevated prompt (Run as admin... on cmd.exe, even though it's only to get Backup operators priviledges). So far though, I haven't been able to do a system image restore with those privileges (admin still required), but I haven't tried much. You can't mount the backup image (.vhd) either, but can open it with third party tools (I use 7-zip, there are probably several others) to recover files.

0
  • Run SysInternals' Process Explorer
  • Select the process that is running the backup
  • RIght-click and select Properties
  • On the Security tab, confirm that the SeBackupPrivilege is listed.

You should also run gpresult /h and confirm that the "Logon as a batch job" right is actually assigned to Backup Operators, and Deny Logon as batch job is not.

1
  • The backup process sdclt.exe has the SeBackupPrivilege. The command gpresult /h out.html lists group memberships for the current user (which includes Backup Operators), but it does not reveal the user rights assigned to him. I'm pretty sure he has the "Logon as a batch job" right, and is not denied logon as batch job. To confirm, I simply ran whoami /priv from an elevated command prompt, which lists all privileges assigned to the user. Jun 12, 2013 at 16:54
0

I haven't vetted it out, but I believe UAC is preventing it from running. I think you'd need to have the account as an admin in order to run it properly, even if UAC is disabled (but you can try disabling UAC and see if it suddenly works). The Backup Operators group would hold users that have the right to backup files and circumvent file security, but it won't necessarily give them rights to run scheduled tasks or programs with elevated permissions. The idea being that if you put someone in the Backup Operators group on a remote PC you can run a backup job remotely that would connect to that PC and have the right to backup its files.

(However, the question itself is a better fit for superuser.com so I'm voting to migrate it there, even if my "answer" is found to be right)

1
  • Thanks. I'd like to test your idea, but I need a bit of help. Can you guide me on how to run a backup job remotely? Should I follow the steps in this MS Knowledge Base article? Jun 12, 2013 at 16:58
0

There's two unrelated things going on here.

Normally NTFS permissions would prevent other users from reading your files. In order for someone to be able to read files in your profile, you would have to modify the "Access Control List" (ACL) to grant them read permission:

enter image description here

But that would mean that in order to backup all files on a computer, the user running the backup would need to be given Read permission:

  • to every file
  • in every folder
  • in every profile

That's just a pain; and not something you want to actually do.

Enter the Backup privilege

Fortunately Windows NT created a way for certain users to be able to bypass all those NTFS ACL security checks, reading files they don't have permission to read, so they can back them up.

It's a special "privilege" called SeBackupPrivilege

SE_BACKUP_NAME

Required to perform backup operations. This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file. Any access request other than read is still evaluated with the ACL. This privilege is required by the RegSaveKey and RegSaveKeyEx functions. The following access rights are granted if this privilege is held:

  • READ_CONTROL
  • ACCESS_SYSTEM_SECURITY
  • FILE_GENERIC_READ
  • FILE_TRAVERSE

User Right: Back up files and directories.

If you have this privilege, then you bypass all NTFS security checks if you attempt to open a file in "backup mode". When the backup software attempts to open a file, it includes the FILE_FLAG_BACKUP_SEMANTICS flag:

FILE_FLAG_BACKUP_SEMANTICS

The file is being opened or created for a backup or restore operation. The system ensures that the calling process overrides file security checks when the process has SE_BACKUP_NAME and SE_RESTORE_NAME privileges.

Granting the Back up files and directories privilege

Privileges are granted to users, or groups. Windows ships with a group that already has the SeBackupPrivilege (aka "Backup files and directories") privilege enabled:

  • Group name: Backup Operators
  • SID: S-1-5-32-551
  • Description: A built-in group. By default, the group has no members. Backup Operators can back up and restore all files on a computer, regardless of the permissions that protect those files. Backup Operators also can log on to the computer and shut it down.

You can see this privilege assigned to this group by running secpol.msc, and browsing to:

  • Security Settings
    • Local Policies
    • User Rights Assignments
      • Back up files and directories enter image description here

The privilege is powerful enough that you don't want to grant it willy-nilly to users; which is why it's only granted to the one Backup Operators group.

And so now if you're running backup software, you just make sure that the software is running as a user with the SeBackupPrivilege (i.e. is a member of the Backup Operators) group. And then your backup software can do it's job backing up files.

But you still have to run it

Most backup software you simply run. Or you can run it on a scheduled task.

But Windows Backup is not just a program you run; it's a service. And in order to start, stop, or configure services you (generally) have to be a member of the Administrators group.

That's what's stopping you here. You're looking at one particular backup software, that happened to decide to install itself as a service, and happened to decide that you need to be an Administrator to configure.

And backup operators do not have ACL permissions to start/stop services.

That's what's tripping you up.

  • Backup Operators can only bypass NTFS ACL checks
  • they cannot start/stop/configure services

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .