Backup Operators expose a fast path to domain compromise

At a glance

What this is: This is an analysis of why the Active Directory Backup Operators group can create domain compromise even though it is not a Domain Admin group.

Why it matters: It matters because IAM, PAM, and directory-security teams often underestimate local backup rights until they become a credential-exposure and persistence path across Tier 0 systems.

👉 Read Semperis' analysis of Backup Operators rights and domain compromise risk

Context

Backup Operators is a privileged Active Directory group, but its risk is often underestimated because the rights look local rather than domain-wide. On a domain controller, SeBackupPrivilege and SeRestorePrivilege can bypass NTFS permissions and expose directory data, registry hives, and protected files that underpin identity security.

For IAM and PAM teams, the issue is not whether the group is named admin. The issue is whether an identity can reach domain secrets, overwrite system files, or sidestep normal audit paths. That is a governance problem across human admin accounts, service identities, and any delegated account that inherits backup-style rights.

This is why backup-related privileges need to be treated as tiering and lifecycle issues, not just operational convenience. The article’s starting position is typical: teams usually notice the group only after they have already granted it somewhere that matters.

Key questions

Q: What breaks when Backup Operators is left with standing membership?

A: Standing membership turns a backup role into a persistent privilege surface. If an attacker or insider reaches that account, they may read protected files, copy shadow volumes, and access domain data that bypasses normal NTFS controls. The failure is not just access, but the absence of an expiry boundary around highly sensitive rights.

Q: Why do Backup Operators privileges increase domain compromise risk?

A: Because on a domain controller the group can reach the files that hold directory secrets, not just perform routine backup tasks. Once ntds.dit and related hives are copied, attackers can work offline to extract hashes and keys. That makes the role a credential-exposure problem, not a simple server-admin convenience.

Q: How do security teams know whether backup rights are being abused?

A: Look for a privilege assignment event, followed by snapshot or copy tooling, followed by reads against protected files or shadow-copy paths. The strongest signal is a successful read that should not be possible through NTFS alone. If those events line up on a domain controller, assume the backup right is being used as an attack path.

Q: Who is accountable when backup privileges expose domain secrets?

A: Accountability usually sits with the identity owner, the server owner, and the team that approved the exception. Backup rights must be reviewed like Tier 0 access because they can reach the same sensitive material as more obvious admin roles. Governance fails when no one owns the expiry, review, and logon constraints for the account.

Technical breakdown

SeBackupPrivilege and SeRestorePrivilege in Active Directory

SeBackupPrivilege allows a principal to read files while bypassing NTFS access control lists, and SeRestorePrivilege allows writing or overwriting files while bypassing the same controls. On a member server this is sensitive, but on a domain controller the impact expands because the account can reach ntds.dit, registry hives, and other protected assets that hold identity material. The key point is that the operating system still records access context, but normal file permissions no longer provide the boundary defenders assume they do.

Practical implication: treat any account with these rights as Tier 0-adjacent and restrict where it can log on.

Shadow copy abuse as a directory-exfiltration path

Shadow copies let an attacker or insider access live system files without needing to stop services or unlock files directly. That matters because ntds.dit and the SYSTEM hive can be copied out of a snapshot and analysed offline, revealing password hashes, Kerberos material, and other privileged secrets. This bypasses many controls that focus only on replication rights or traditional DCSync activity, because the data is taken from disk rather than through directory replication.

Practical implication: monitor snapshot tooling and read access to shadow copy paths, not only replication events.

How restore rights become persistence rights

Restore rights are not just about recovery. They can be used to overwrite protected binaries, replace service executables, or modify startup and recovery paths so malicious code runs as SYSTEM. That turns a backup-oriented permission set into a persistence mechanism. In practical terms, the same identity that can recover a server can also alter what boots, what loads, and which task or service executes next, which is why the blast radius extends beyond data theft.

Practical implication: audit writes to protected paths and service targets with the same urgency as credential exposure.

Threat narrative

Attacker objective: The objective is to turn a non-Domain Admin foothold into domain-wide credential access and long-lived control.

1. Entry occurs when an attacker gains access to a Backup Operators account or another principal with SeBackupPrivilege on a server or domain controller.
2. Escalation occurs when the attacker uses shadow copy tooling or restore rights to copy ntds.dit and protected registry hives, bypassing normal NTFS checks.
3. Impact occurs when offline extraction yields domain hashes, Kerberos keys, and privileged secrets that can support broader domain takeover or persistence.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Backup privilege is a Tier 0 governance issue, not a helper role. The article makes clear that SeBackupPrivilege and SeRestorePrivilege can expose the same crown-jewel material defenders associate with Domain Admin compromise. That means the governance assumption of “local rights are local impact” fails on domain controllers and other sensitive servers. Practitioners should classify backup-capable identities by blast radius, not by group name.

Identity blast radius: Backup Operators can create a direct path from file access to offline credential extraction. Once ntds.dit and the SYSTEM hive leave the live system, conventional replication-focused monitoring loses relevance and the attacker can work outside the detection window. The implication is that privilege reviews need to account for what data an identity can physically copy, not only what directory objects it can manage.

Standing backup rights are a lifecycle problem because they outlive the purpose they were granted for. The article shows how broad membership, vendor-required exceptions, and weak tiering turn a narrow operational role into a persistent attack surface. That is a failure of access lifecycle discipline, not just a misconfigured group. Teams should treat every exception as an entitlement with an expiry question attached.

Detection must be built around file truth, not just identity truth. The most useful signals in the article are privilege assignment, snapshot tooling, and successful reads against protected files. This is a reminder that directory security programmes need correlated telemetry across logon, process creation, and file access. Practitioners should assume that a backup-capable identity is dangerous until the data path proves otherwise.

From our research:

• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, including 46% confirmed and 26% suspected.
• For a broader view of the control gap, review 52 NHI Breaches Analysis for recurring patterns in identity-led compromise.

What this signals

Identity blast radius: backup-capable accounts force IAM teams to think in terms of what data an identity can copy, not just what permissions it appears to hold. When SeBackupPrivilege can reach directory databases or protected files, the practical boundary is the data path, not the role label. Teams should align tiering, logon restrictions, and file auditing to that reality.

With 72% of organisations reporting or suspecting an NHI breach in our research, the lesson extends beyond Active Directory: any privileged non-human account that can bypass normal file or object controls should be treated as a governance exception, not a routine operational convenience.

The next control question is whether your review process can distinguish harmless backup operations from abuse patterns that create offline credential extraction. That means correlating privilege assignment, process telemetry, and protected-file access across the full identity lifecycle, then applying OWASP Non-Human Identity Top 10 thinking to the accounts most likely to be ignored.

For practitioners

• Keep Backup Operators empty by default Remove standing membership wherever possible and require explicit exception approval for any account that needs backup-related rights. Tie each exception to a named system, a named owner, and a fixed review date.
• Restrict backup-capable accounts to specific servers Block interactive use on domain controllers and deny local and remote desktop logon where the role does not truly require it. Limit these identities to approved backup hosts and verify that tiering rules prevent lateral movement into Tier 0.
• Audit protected-file reads and snapshot tooling Correlate 4672, 4688, 4663, and any VSS-related process telemetry around ntds.dit, the SYSTEM hive, SAM, and backup repositories. Alert on diskshadow.exe, vssadmin.exe, wbadmin.exe, ntdsutil.exe, and esentutl.exe outside normal backup windows.
• Treat restore rights as persistence risk Review where SeRestorePrivilege can overwrite service binaries, boot paths, or scheduled task targets. Pair that review with file integrity monitoring on protected locations so restore-capable accounts cannot silently plant executable changes.
• Use isolated backup infrastructure and gMSAs where possible Move backup processing onto dedicated systems, reduce direct server access, and prefer managed service identities for backup workflows. That lowers the chance that a backup role can reach application secrets, certificate material, or privileged local files on production servers.

Key takeaways

• Backup Operators is dangerous because its rights can bypass file permissions and expose domain secrets even without Domain Admin access.
• The article’s core evidence is the direct path from shadow copy abuse to offline extraction of ntds.dit and the SYSTEM hive.
• The control that matters most is strict tiering with empty membership, constrained logon, and high-fidelity file and process monitoring.

Key terms

• SeBackupPrivilege: A Windows privilege that allows a principal to read files while bypassing normal NTFS access checks. In identity governance terms, it is dangerous because it expands what the account can extract, not just what it can administer, and on domain controllers it can expose high-value identity data.
• SeRestorePrivilege: A Windows privilege that allows a principal to write or overwrite files even when ordinary access controls would block the change. It matters because restore capability can become persistence capability when an identity can replace binaries, alter service paths, or modify protected targets.
• Shadow Copy Abuse: The misuse of Volume Shadow Copy snapshots to access live system files that are otherwise locked or protected. For defenders, it is a common way to bypass file locks, copy directory databases, and extract credentials offline without relying on replication activity.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Semperis' full article covers the operational detail this post intentionally leaves for the source:

• Step-by-step audit checks for SeBackupPrivilege abuse on domain controllers and member servers.
• Specific Windows event combinations for detecting shadow copy activity and protected-file reads.
• Process names and command-line patterns that help separate legitimate backup work from abuse.
• Practical guidance for tiering, emptying the group, and constraining backup identities to approved systems.

👉 The full Semperis article covers audit checks, shadow copy detection, and the controls that shrink Backup Operators blast radius.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.