Backup mode is a way to read and write files ignoring any permissions problems.
It uses the
SeBackupPrivilege (reading) and
SeRestorePrivilege (writing) in order to read/write any and all files, disregarding any ACEs that would prevent you from reading or writing a file.
Normally when trying to copy or access a file, Windows performs a check to make sure you have permission to read or write to location, but with
SeBackupPrivilege (granted to the Backup Operators and Administrators groups by default), and
SeRestorePrivilege (also granted to the Backup Operators and Administrators groups by default), these checks are bypassed.
On domain controllers, the mentioned user rights are also available to the Server Operators group.
From the documentation for
This user right determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This user right is effective only when an application attempts access through the NTFS backup application programming interface (API) through a backup tool such as NTBACKUP.EXE. Otherwise, standard file and directory permissions apply.
This user right is similar to granting the following permissions to the user or group you have selected on all files and folders on the system:
- Traverse Folder/Execute File
- List Folder/Read Data
- Read Attributes
- Read Extended Attributes
- Read Permissions
From the documentation on
This security setting determines which users can bypass file, directory, registry, and other persistent object permissions when they restore backed up files and directories, and it determines which users can set valid security principals as the owner of an object.
Granting this user right to an account is similar to granting the account the following permissions to all files and folders on the system:
- Traverse folder / execute file
To check if your account has these privileges, you can run the command
whoami /priv at a command prompt.