Topic starter
30/07/2026 10:51 pm
TL;DR: Backup Operators can read and overwrite protected files, copy ntds.dit through shadow copies, and extract domain secrets without Domain Admin rights, according to Semperis. The governance problem is that local backup privileges become domain-wide exposure when tiering, logon restrictions, and file-level monitoring are weak.
Editorial analysis by NHI Mgmt Group, based on content published by Semperis: “AD Group Risks: Hidden Dangers in Backup Operators”.
Key questions
Q: What breaks when Active Directory backups are not dedicated and isolated?
A: When Active Directory backups are not dedicated and isolated, attackers can use the same environment to plant backdoors, persist malware, or compromise the restore path.
Q: Why do Backup Operators privileges increase domain compromise risk?
A: Because on a domain controller the group can reach the files that hold directory secrets, not just perform routine backup tasks.
Q: What are the signs that backup privilege abuse is happening?
A: Look for privileged logons followed by access to ntds.dit, SYSTEM, SAM, or shadow-copy paths, especially when tools such as diskshadow, vssadmin, wbadmin, ntdsutil, or esentutl appear outside normal backup windows.
Practitioner guidance
- Empty the Backup Operators group Remove standing membership wherever possible and treat every exception as a high-risk, time-bound approval tied to a specific operational need.
- Restrict where backup accounts can log on Block interactive logon on domain controllers and use Deny log on locally plus Deny log on through Remote Desktop Services for backup-privileged identities.
- Audit access to directory and hive files Place SACLs on ntds.dit, SYSTEM, SAM, and backup repositories so you can correlate privileged logons with successful reads of protected material.
Bottom line: Backup Operators can become a direct route to domain compromise because backup and restore rights can bypass normal file protections.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:58 pm
Backup privilege abuse is a Tier 0 governance problem, not a low-value local rights issue. The article shows that SeBackupPrivilege and SeRestorePrivilege can bypass NTFS protections and expose directory secrets on systems that were never meant to be treated as ordinary endpoints. That means the governance boundary is not the group name but the blast radius of the files it can reach. Practitioners should classify these accounts by the data they can expose, not by whether they carry a Domain Admin label.
A question worth separating out:
Q: How should teams respond when Backup Operators access a domain controller?
A: Treat the session as high risk until you can prove it was a legitimate backup workflow. Correlate logon type, file access, process creation, and host context, then validate whether the account should have been on that system at all and whether any protected files were exposed.
👉 Read our full editorial: Backup Operators expose a fast path to domain compromise