1

How do I verify the if the domain user has backup (SeBackupPrivilege) and restore privilege(SerestorePrivilege)? I tried added the domain user to backup operators group. But Whoami /priv command output shows that the domain user doesn't have the backup and restore privilege.

2
  • Have you tried to view the properties of the user?
    – Ramhound
    Nov 19, 2021 at 1:16
  • NO.. There is a no properties for the privileges.
    – sureshbabu
    Nov 19, 2021 at 17:57

1 Answer 1

1

You may use the sysinternals tool AccessChk.

You can list all rights of a user account by using the command :

accesschk.exe "domain\user" -a *

Here is an example output for an administrator on Windows 10:

C:\Temp\AccessChk>accesschk.exe "domain\user" -a *

Accesschk v6.15 - Reports effective permissions for securable objects
Copyright (C) 2006-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

Error enumerating account for the Netmon Users group:
The system cannot find the file specified.
        SeSecurityPrivilege
        SeBackupPrivilege
        SeRestorePrivilege
        SeSystemtimePrivilege
        SeShutdownPrivilege
        SeRemoteShutdownPrivilege
        SeTakeOwnershipPrivilege
        SeDebugPrivilege
        SeSystemEnvironmentPrivilege
        SeSystemProfilePrivilege
        SeProfileSingleProcessPrivilege
        SeIncreaseBasePriorityPrivilege
        SeLoadDriverPrivilege
        SeCreatePagefilePrivilege
        SeIncreaseQuotaPrivilege
        SeUndockPrivilege
        SeManageVolumePrivilege
        SeImpersonatePrivilege
        SeCreateGlobalPrivilege
        SeTimeZonePrivilege
        SeCreateSymbolicLinkPrivilege
        SeChangeNotifyPrivilege
        SeDelegateSessionUserImpersonatePrivilege
        SeInteractiveLogonRight
        SeNetworkLogonRight
        SeBatchLogonRight
        SeRemoteInteractiveLogonRight
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.