Why can't robocopy copy all files even when in Backup Operators group - Storage

This is a discussion on Why can't robocopy copy all files even when in Backup Operators group - Storage ; When backing up Windows file servers with a backup program such as BackupExec I take advantage of the Backup Operators group. By running BackupExec with a service account which is a member of this group I am able to back ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: Why can't robocopy copy all files even when in Backup Operators group

  1. Why can't robocopy copy all files even when in Backup Operators group

    When backing up Windows file servers with a backup program such as BackupExec I take advantage of the Backup Operators group. By running BackupExec with a service account which is a member of this group I am able to back up all data regardless of the permissions that have been set

    When I try to do the same using a copy program such as Robocopy this does not work, and I typically get an ERROR 5 Access is denied for those folders or files for which the account I am using with Robocopy does not have rights, even though it is a member of the Backup Operators group

    It seems Windows knows BackupExec is a kosher backup program and will let it in, but does not consider robocopy a valid backup program and so rejects it's requests

    Does anyone have any ideas how to overcome this without having to go over the entire server with a utility such as XCACLS to add in extra permissions?

  2. Re: Why can't robocopy copy all files even when in Backup Operators group

    BackupExec (and any other backup program) rely on using the backup API's and
    flags in the various file control Win32 APIs which require the backup
    operators privileges to work and override the other ACLs on the
    files/directories. Copy/XCopy/RoboCopy do not use the backup API set/flags
    (i.e. use standard APIs and flags) and so do not get the privileges.

    For more info about the API's and flags, check out MSDN (CreateFile is a
    good place to start).

    Pat

    "Richard-Twickenham" wrote in
    message news:0C4B526C-1E0C-4F1B-B271-7B032ED8ADEB@microsoft.com...
    > When backing up Windows file servers with a backup program such as
    > BackupExec I take advantage of the Backup Operators group. By running
    > BackupExec with a service account which is a member of this group I am
    > able to back up all data regardless of the permissions that have been set.
    >
    > When I try to do the same using a copy program such as Robocopy this does
    > not work, and I typically get an ERROR 5 Access is denied for those
    > folders or files for which the account I am using with Robocopy does not
    > have rights, even though it is a member of the Backup Operators group.
    >
    > It seems Windows knows BackupExec is a kosher backup program and will let
    > it in, but does not consider robocopy a valid backup program and so
    > rejects it's requests.
    >
    > Does anyone have any ideas how to overcome this without having to go over
    > the entire server with a utility such as XCACLS to add in extra
    > permissions?




  3. Re: Why can't robocopy copy all files even when in Backup Operators group


    Robocopy needs to "log on as a service" it should be granted "Adminstrator
    Rights" to log on as a service for any areas that you want to backup. In
    some cases this would be the equivalent of a Domain Admin with rights to log
    on as a service.
    Hope this helps.


    "Richard-Twickenham" wrote in
    message news:0C4B526C-1E0C-4F1B-B271-7B032ED8ADEB@microsoft.com...
    > When backing up Windows file servers with a backup program such as

    BackupExec I take advantage of the Backup Operators group. By running
    BackupExec with a service account which is a member of this group I am able
    to back up all data regardless of the permissions that have been set.
    >
    > When I try to do the same using a copy program such as Robocopy this does

    not work, and I typically get an ERROR 5 Access is denied for those folders
    or files for which the account I am using with Robocopy does not have
    rights, even though it is a member of the Backup Operators group.
    >
    > It seems Windows knows BackupExec is a kosher backup program and will let

    it in, but does not consider robocopy a valid backup program and so rejects
    it's requests.
    >
    > Does anyone have any ideas how to overcome this without having to go over

    the entire server with a utility such as XCACLS to add in extra permissions?



+ Reply to Thread