0

On Windows pro versions, there is a "Backup Operators" group allowing to access every files for backup purposes.

On Windows 10 family I don't see this group (with the commande net localgroup).
I want to create a user dedicated to automated backups. But without this group the user can't backup files located in other's users home (which is the desired behaviour, even if the backup user is administrator).

There is probably a way to achieve this goal, because commercial backup softwares do it.
Anyone has an idea?

  • Have you given the backup user permission on the other user's home? – harrymc May 13 '18 at 19:57
3
+150

The simplest way to accomplish what you want is to make the backup process run as an administrator. Administrators have full access to all users' profile folders, but they must run elevated for this access control entry to apply.

If you can't run the backup elevated, make the backup user an administrator, log on as it, and try to navigate into other users' profile folders. Windows Explorer will inform you that access is denied, but it will give you a button that permanently grants the current user access to that folder. After that's done, the backup user will be able to access that other user's profile even without elevation.

Information on how to replicate the effect of the Backup Operators group follows below the line.


Much of what makes the Backup Operators group special is that, by default, it is granted a handful of privileges:

  • SeBackupPrivilege, "back up files and directories"
  • SeRestorePrivilege, "restore files and directories"
  • SeShutdownPrivilege, "shut down the system"
  • SeBatchLogonRight, "log on as a batch job"

Privileges can be assigned using the User Rights Assignment section of the Local Security Policy tool, secpol.msc. That tool might not exist on non-Pro editions of Windows, though. To adjust privileges on other editions, you can use the NTRights utility from the Windows Server 2003 Resource Kit. Despite the name, that kit can be installed on any modern version of Windows. You can use NTRights to grant a privilege by opening an administrative command prompt and running a command like this:

ntrights -u YourBackupUser +r SeSomePrivilege

Replace YourBackupUser with the SAM account name of the user/group who should be able to back up and restore — the SAM account names are listed in the output of net user or net localgroup (ignore the asterisk before the group name). Replace SeSomePrivilege with the ID of the privilege to grant. If you want to revoke a privilege later, run the same command but with -r instead of +r.

Note, though, that only specially written software will be able to take advantage of these privileges. Even when granted, privileges must be enabled per process before they take effect, then the program must call special read/write APIs that bypass security checks. These privileges are also insufficient for creating shadow copies; to do that, a process must be running as a member of the Administrators group — even membership in the real Backup Operators group isn't enough for that.

1

(Sorry, I don't have enough rep to make this a comment to @Ben N's response.)

Yes, adding SeBackupPrivilege, etc to a regular account is sufficient to use the FILE_FLAG_BACKUP_SEMANTICS flag to CreateFile and to use the BackupRead API call.

BUT it's not sufficient to take a VSS snapshot (something that a backup program would like to do).

To take a VSS snapshot, the user must either be

  • Local System, or
  • Local Service / Network Service (Server 2003 or later), or
  • A member of the local Administrators group, or
  • A member of the local Backup Operators group, or
  • Have the program whitelisted in the registry in a certain way (although this didn't work in my testing).
  • Nice catch! I suspect that fiddling with the DCOM configuration might allow the user to use the Volume Shadow Copy Service - I'll do some testing and update my answer if I find anything useful. – Ben N Jul 19 '18 at 1:41
  • Hmm, it looks like even being an elevated member of Backup Operators is insufficient to create shadow copies. Trying this code on a Pro machine as a backup operator doesn't produce an initialization error like by a normal user, but the $s1 response object indicates an access-denied error (ReturnValue 1) and no shadow copy is created. I did some Registry shenanigans to create the real Backup Operators group on a Home edition and got the same effect there. – Ben N Jul 19 '18 at 23:15
  • (The downvote isn't mine, FWIW.) – Ben N Jul 19 '18 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.