5

We have a Windows backup package which presents Virtual Machine backedup filesystems as iSCSI mounts. Helpdesk users need to perform restore operations, which is done by copying files from the mounted point in time filesystem back to the production system. There are various files which the helpdesk people don't have access to, and therefore can't restore. Our security people will not let the helpdesk have increased access.

I think a possible solution is for the helpdesk to use Windows backup/restore privilege to copy the files, but I am not aware of any way for them to browse, select the file and then move it to the target. Is there some sort of Windows Explorer type program which can be set to use the backup API? I can't find anything, having performed rather extensive internet searches.

  • Are you basically asking, "How can I grant helpdesk staff access to files after they've been restored by my backup software?" And these are files they don't have permission to? – Twisty Impersonator May 30 '17 at 19:03
4

You have to use Robocopy with a /MIR switch as it will preserve all the NTFS permissions.

https://blogs.technet.microsoft.com/filecab/2008/07/31/robocopy-mir-switch-mirroring-file-permissions/

Robocopy is easily scriptable with PowerShell and has some nice GUI now.

https://gallery.technet.microsoft.com/scriptcenter/PowerShell-Robocopy-GUI-08c9cacb

https://technet.microsoft.com/en-us/library/2006.11.utilityspotlight.aspx

  • They don't need to: script is configured by one who has rights, and runs under admin's escalated privileges. – BaronSamedi1958 May 30 '17 at 9:14
  • That needs to be explained in your answer, preferably with an overview of how that would be done. – Twisty Impersonator May 30 '17 at 12:19
  • 1
    While RoboCopy can be used (it can be invoked to use backup/restore privileges) it's not really suitable for Helpdesk staff, we really need them to be able to browse the filesystem as with Explorer, but using their restore privilege. – user417387 May 30 '17 at 14:15
-1

Your helpdesk staff does not need to be granted NTFS permissions directly to the data being restored. Instead, they need to be members of the built-in Backup Operators group. According to TechNet:

Members of this group can back up and restore files on a computer, regardless of any permissions that protect those files. This is because the right to perform a backup takes precedence over all file permissions. Members of this group cannot change security settings.

Membership in this group grants the user the following user right assignments:

  • Access this computer from the network
  • Allow logon locally
  • Back up files and directories
  • Bypass traverse checking
  • Log on as a batch job
  • Restore files and directories
  • Shut down the system

In other words, it's not necessary to grant the helpdesk staff NTFS permissions to the data. However, if they don't have permission to the data, once it's restored to disk they won't be able to access it, unless the backup software allows them to restore it to a location where they have rights to change the NTFS permissions of the restored data. Membership in the Backup Operators group is not sufficient to grant them permission to change NTFS permissions.

If your IT department is unwilling to make the helpdesk staff members of the Backup Operators group, then consider the helpdesk relieved of the responsibility to restore data, as these user rights are required to perform a file restore without having a lot more (i.e. Administrator) permissions.

  • That would be what we expect using "normal" backup/recovery software, but this software presents backups of VMs as mounted filesystmes for files to be copied out of manually. This means that the NTFS/ReFS permissions do come in to it, so we need a way round this. – user417387 May 30 '17 at 14:13
  • I completely understand that NTFS permissions are involved. That's why the backup operators group exists. As I quoted above "Members of this group can back up and restore files on a computer, regardless of any permissions that protect those files" This is the only "way around" permissions that Windows provides. – Twisty Impersonator May 30 '17 at 14:17
  • To be clear - The backup software that we're using just mounts an iSCSI target of the point in time of the filesystem that the restore is required from. You are then expected to manually copy the file(s) you require using Windows Explorer/the command line. You therefore can't invoke the restore privilege because Explorer won't let you do this. This is why I need a way to copy the files which does invoke restore privilege. – user417387 Jun 7 '17 at 12:28
  • Got it. That would be good to clarify in your question. – Twisty Impersonator Jun 7 '17 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.