Home / server / Questions / 405746
Accepted
Earls
Asked: 2012-07-08 15:34:12 +0800 CST

Backup Permissions for an Active Directory Profile Directory

  • 772

I have Folder Redirection turned on so the profiles are on a Windows shared folder on a File and Print Server... \folders\Profiles

I want to back up the entire Profiles directory, but as Domain Admin I don't seem to have the privileges to "select all and copy" the entire directory structure. The user profile subfolders (Appdata, Documents, Desktop, Pictures, etc.) throw access denied errors...

I tried to grant Domain Admins full privileges to the Profiles directory and thought the subfolders would inherit the privileges, but I get access denied errors just trying to set the permissions...

How can I assign a user to the Profiles directory so that I can copy the entire directory tree to back it up?

backup active-directory permissions user-profile

2 Answers

  1. Windows has a special backup privilege that allows applications to read anything, regardless of permissions. If you want to perform a backup, you want to use an application that makes use of the backup privilege.

    Most if not all full-blown backup applications use the backup privilege, but there is a much easier way: run robocopy with the parameter /b.

    • 2
  2. Best Answer

    Download PSTools from SysInternals.

    Unzip PSTools.zip and from the PSTools directory, run the command:

    psexec -i -s cmd.exe

    A new command prompt window will open, running as the user SYSTEM.

    Now run this command:

    icacls "D:\Profiles\*" /grant "domain admins":(OI)(CI)F /T

    Done.

    • 0