I've been tasked with creating an automatic backup system that will backup a users home drive to their respective network drive that we have on a file server. After much hassle of actually getting this to work, I finally found a good solution using robocopy. The only problem is that it requires the user to be in the local Backup Operators group in order perform the operation. I read a little bit about the Restricted Users in GPOs, so I using restricted users, I added the "Domain Users" group to every computers local Backup Operators group. It is performing the functionality that that I need it to do with robocopy, but I'm a little new at Windows/AD administration and I'm not an expert per se. What (if any) security risks have I opened by adding the "Domain Users" group to every machine's Backup Operators group?

Thanks for any help or advice, it's greatly appreciated.


This is definitely too broad. Backup Operators has a lot of access to your host. Domain users is everyone on your domain. So now anyone in your domain can access most files on all your hosts. Not a good security posture.

It would be better to create a global group say "Robocopy Users" and add the domain users (JohnC, MaryK) who need to use robocopy to make the backups and then add that global group to the Backup Operators group using the Restricted Users GPO.

  • Well the problem I have is EVERYONE needs to be able to make backups. The only way I've been able to get Robocopy to backup their Documents folder is if THAT user is in the Backup Operators group of their local machine, otherwise Robocopy gives me an access denied message (even to their own home folder! It doesn't make sense...). Anyone else have any more ideas that would be more secure? – Safado Dec 3 '10 at 21:52

Just an idea but if you're backing up from local machines to a file server, you could make that file share have Administrators and Creator Owner with full access then give Authenticated Users ability to create folders. This would allow them to create the folder which they would be able the owner of, so they would have full access to that folder and only that folder.

  • That's very similar to how I have it now. Everyone has Read access to the \share folder and then full control of their own \share\user.name folder. – Safado Dec 3 '10 at 21:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.