0

If I'm in the Backup Operators group, is it possible for me to escalate the privilege to Administrators?

I'm talking about both Domain computers and non-Domain computers.

P.S I've tried to do net user whatever /ad and I got access denied error, not sure whether Backup Operators users can do bad things

1

So to resume your query, you want to know if the Backup Operators group (local and domain) can escalate privileges to the Administrators group. Based on my research (source) and after reproducing the steps bellow in my lab (2012 R2), my answer is YES.

Steps:

  1. Ensure to be member of the Backup Operators group
  2. Open an interactive session on a domain controller. If server is not virtual, physical access to the rack will be required. If server is virtual, proper access to the virtualization control center (like VMware vCenter) will be required
  3. Once logged in, dig into C:\Windows\SYSVOL\domain\Policies{xxx}\MACHINE\Microsoft\Windows NT\SecEdit\ folder and look for a file named "GptTmpl.inf" which looks like the following image:

backup operator GPO

  1. Make a copy of this file and add the SID of the desired account as shown below. To obtain the SID of an account by PowerShell, use the following command : [wmi] "win32_userAccount.Domain='',Name=''"

modified sid gpo

  1. Backup the file
  2. Restore the file and redirect it to the real SYSVOL location, overwriting the existing GPO
  3. Wait for GPO to refresh or force GPO refresh (gpupdate /force)

For your information, a member of the Backup operators group can: - Can back up and restore files regardless of the permissions that protect those files

  • Can back up system state
  • Can interactively logon (RDP excluded) on all servers (including DC)
  • Can logon to shutdown a server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.