I have three ordinary user accounts on Windows 10, and one admin account. I want to back up the three ordinary users' files to an external drive -- but I want the backup to run as the admin. (That way, I think, if a user gets crypto-locking malware, the malware won't have write permissions on the user's backup.)

In Windows 7, I'd run Windows Backup as admin. In Windows 10, it looks like I have to log in as each user and turn on File History Backup. Which user account will that backup process run as?

  • Your thought process on Cryptolocker not having permissions is incorrect. – Ramhound Aug 8 '16 at 14:54
  • @Ramhound, that's true by default, but as an administrator, he could create a folder on the external that was exclusive to certain local users or groups. It may be wise to format the external using NTFS, so you get the extended permission abilities therein. Unless I'm losing my mind. I'm going to try this on a thumb drive right now. – MagnaVis Aug 8 '16 at 15:03

The backup process (File History Service or fhsvc) for the File History itself runs as NT AUTHORITY\SYSTEM but to actually copy the files to the file history drive, that process impersonates the user.

This way a single backup process can copy files for many users while honouring the file permissions for each user.

So your standard user needs write permissions for the file history location, otherwise files can not be copied there. That also means something like CryptoLocker has write access to your File History.

Like using different user accounts is a good idea, Windows File History does currently not protect against CryptoLocker.

I wrote a post about how I deal with this problem: Protect your local file backup from Ransomware

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.