Thursday, July 19, 2018

SeBackupPrivilege may not be enough to use the Volume Shadow Copy Service

A new answer to a Super User question I addressed a while back informed me of something I had missed. I thought that the backup-related abilities of the Backup Operators group were all from the backup and restore privileges granted to it, but apparently use of the Volume Shadow Copy Service requires real membership in that group (or in Administrators). It looks like this might be enforced by the security in the DCOM configuration - only SYSTEM, Administrators, and Backup Operators are granted launch or activation permissions on the application. Users (even administrators) are not allowed by default to edit the ACL on that application, so altering it will be tricky. I will continue to investigate.

No comments:

Post a Comment