There's two unrelated things going on here.
Normally NTFS permissions would prevent other users from reading your files. In order for someone to be able to read files in your profile, you would have to modify the "Access Control List" (ACL) to grant them read permission:
But that would mean that in order to backup all files on a computer, the user running the backup would need to be given Read
permission:
- to every file
- in every folder
- in every profile
That's just a pain; and not something you want to actually do.
Enter the Backup privilege
Fortunately Windows NT created a way for certain users to be able to bypass all those NTFS ACL security checks, reading files they don't have permission to read, so they can back them up.
It's a special "privilege" called SeBackupPrivilege
SE_BACKUP_NAME
Required to perform backup operations. This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file. Any access request other than read is still evaluated with the ACL. This privilege is required by the RegSaveKey and RegSaveKeyEx functions. The following access rights are granted if this privilege is held:
- READ_CONTROL
- ACCESS_SYSTEM_SECURITY
- FILE_GENERIC_READ
- FILE_TRAVERSE
User Right: Back up files and directories.
If you have this privilege, then you bypass all NTFS security checks if you attempt to open a file in "backup mode". When the backup software attempts to open a file, it includes the FILE_FLAG_BACKUP_SEMANTICS
flag:
FILE_FLAG_BACKUP_SEMANTICS
The file is being opened or created for a backup or restore operation. The system ensures that the calling process overrides file security checks when the process has SE_BACKUP_NAME and SE_RESTORE_NAME privileges.
Granting the Back up files and directories privilege
Privileges are granted to users, or groups. Windows ships with a group that already has the SeBackupPrivilege
(aka "Backup files and directories") privilege enabled:
- Group name: Backup Operators
- SID:
S-1-5-32-551
- Description: A built-in group. By default, the group has no members. Backup Operators can back up and restore all files on a computer, regardless of the permissions that protect those files. Backup Operators also can log on to the computer and shut it down.
You can see this privilege assigned to this group by running secpol.msc
, and browsing to:
- Security Settings
- Local Policies
- User Rights Assignments
- Back up files and directories
The privilege is powerful enough that you don't want to grant it willy-nilly to users; which is why it's only granted to the one Backup Operators group.
And so now if you're running backup software, you just make sure that the software is running as a user with the SeBackupPrivilege
(i.e. is a member of the Backup Operators) group. And then your backup software can do it's job backing up files.
But you still have to run it
Most backup software you simply run. Or you can run it on a scheduled task.
But Windows Backup is not just a program you run; it's a service. And in order to start, stop, or configure services you (generally) have to be a member of the Administrators group.
That's what's stopping you here. You're looking at one particular backup software, that happened to decide to install itself as a service, and happened to decide that you need to be an Administrator to configure.
And backup operators do not have ACL permissions to start/stop services.
That's what's tripping you up.
- Backup Operators can only bypass NTFS ACL checks
- they cannot start/stop/configure services
Log on as a batch job
is given toAdministrators
,Backup Operators
, andPerformance Log Users
. While this implicitly gives the right to myBackupUser5
user, I explicitly gave it this right, logged off, logged on back again, and repeated the procedure, to no avail :(