Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've searched around for this, and all I can find is the usual "i'm an admin but need to elevate" kind of questions. This isn't quite the same.

I have a D drive on a file server (2008 r2 and same problem setting it up on 2012 too) with a folder which is shared out to users. Everyone has access to the entire shared drive over the network, apart from a few folders which only specific groups can access.

I set this up so that those specific sub folders stop inheriting permissions and just give full access to the groups in question (nothing to do with admins). I have a domain user which is a member of the backup operators group and all the local backup operators groups on every machine in the domain (set via GPO). This user is used to run a file sync program in order to sync the fileshare to a NAS every night for backup. This software also runs on the machine in question and not remotely.

I gave the user the ability to logon interactively so I can setup the software under that account and test that the backup works before I create a scheduled task for it.

The problem initially was that the software failed to access the more protected folders - which as far as I was aware wasn't possible with backup operators. So instead I added the backup operators group explicitly to those folder permissions with full access - the same error. So using explorer I went to find the folders in question - and note I'm not running as an admin, however despite this windows asked me to elevate.

Now this is the question - why on earth does a non admin account require an admin token to access a folder it has full permissions to (via it's group backup operators)? This is not in a system folder, or system drive, it's just a normal drive, under a bunch of normal folders with some slightly tighter restrictions on them.

I really don't get why UAC is even needed in this instance - it's got nothing to do with administrators!

Thanks

EDIT:

Permissions on folders as requested by the comment:

C:\Windows\system32>icacls "d:\share\support\tech documents"
d:\share\support\tech documents
QUT\access tech docs:(OI)(CI)(F)
QUT\Domain Admins:(OI)(CI)(F)
BUILTIN\Backup Operators:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files


C:\Windows\system32>icacls "d:\share\support"
d:\share\support BUILTIN\Administrators:(F)
Everyone:(I)(OI)(CI)(M)
BUILTIN\Backup Operators:(I)(OI)(CI)(F)
QUT\Enterprise Admins:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(F)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(F)
QUT\Domain Admins:(I)(OI)(CI)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(OI)(CI)(RX)
BUILTIN\Users:(I)(CI)(S,AD)
BUILTIN\Users:(I)(CI)(S,WD)

Successfully processed 1 files; Failed processing 0 files

The folder above the one in question is simply inheriting permissions, the tech documents one has inheritance disabled and explicit permissions set.

share|improve this question
    
More information about the permissions on the folder is required. Lets start with what groups( Users, Administrator, ... ) have access to this folder. Check the permissions of the parent folders also. –  Ramhound Jun 20 '13 at 19:03
    
I've just updated the original question with the permissions. –  icehot Jun 20 '13 at 19:26

1 Answer 1

up vote 1 down vote accepted

Some quick experimentation has confirmed my initial suspicion that Backup Operators is treated in the same way as Administrators, i.e., a user in the Backup Operators group is considered an administrator and given a split token. This means you need to elevate to take advantage of being a member of the Backup Operators group, in exactly the same way you need to elevate to take advantage of being a member of the Administrators group.

This makes sense, because malicious code running with backup operator privilege can easily leverage that privilege to give itself unlimited access.

The MSDN article "Teach Your Apps To Play Nicely With Windows Vista User Account Control" includes a list of all the groups and privileges that will cause a split token to be created.

share|improve this answer
1  
Thanks, that makes sense, it makes testing more tricky though, as there is no "runas backup operator" ;) –  icehot Jun 21 '13 at 6:38
    
If you don't actually need backup/restore privilege, I suggest you create a new group ("My Backup Operators") and give that group access to the folder(s) in question. If you do need backup/restore privilege, perhaps just make the relevant accounts administrators? –  Harry Johnston Jun 24 '13 at 22:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.