1

I am trying to enumerate a directory on a remote file server. I want to use backup-semantics in order to not require administrator credentials.

On the test server, I have created a share:

  1. Share permissions: everyone full control
  2. NTFS permissions: only SYSTEM (I removed all others)

I am currently using this code:

static void accessWithBackupSemantics() {

        NetResource netResource = new NetResource() {
            Scope = ResourceScope.GlobalNetwork,
            ResourceType = ResourceType.Disk,
            DisplayType = ResourceDisplayType.Share,
            Usage = ResourceUsage.Connectable,
            RemoteName = @"\\target-srv\TargetShare"
        };

        // open "net use" connection
        int netResult = Native.WNetAddConnection2(netResource, 
                                                  @"***password***",
                                                  @"DOMAIN\backup_op_user", 
                                                  0);
        if (netResult == 0 || netResult == 1219) {

            // enable privileges 
            // (this is taken from AplhaFS)
            using (new PrivilegeEnabler(Privilege.Backup)) {

                try {

                    // try open remote directory
                    SafeFileHandle fsHandle = Native.CreateFile(
                        @"\\target-srv\TargetShare",
                        EFileAccess.GenericRead,
                        EFileShare.Read | EFileShare.Write,
                        IntPtr.Zero,
                        ECreationDisposition.OpenExisting,
                        EFileAttributes.BackupSemantics,
                        IntPtr.Zero);

                    Console.WriteLine("Handle is valid: " + !fsHandle.IsInvalid);
                }
                catch (Exception ex) {}
                finally {
                    Native.WNetCancelConnection2(netResource.RemoteName, 0, true);
                }
            }
        }
    }

This works if I specify "DOMAIN\Administrator" in the username, but does not work (the error is 5 - access denied) if I try to use a domain account that is a member of the local "Backup Operators" on target-srv server.

I have also examined the security event log on target-srv, for every connection created with WNetAddConnection2 a "Special Logon" event is written. The details of this event include the list of privileges that the logon account was given. In both cases (when I connect with administrator or with backup_op_user) - seBackupPrivilege is indeed listed. I tried to give extra privileges to the "Backup Operators" so the list has all the privileges that the Administrator has - but it made no change.

Questions:

  1. What is the right way to use Backup-Semantics over the network?
  2. How come it works with Administrator and not with a member of "Backup Operators" - are there additional implicit permissions for the Admin?

I have seen many examples of local use of Backup-Semantics, but not one that can be used over the network - please don't reply with links to examples of local usage.

7
  • Is the machine joined to a domain? If not, UAC will block all use of administrator privileges over the network, except for the built-in Administrator account. Feb 28, 2017 at 22:11
  • I'll be surprised if this is possible. Mar 1, 2017 at 3:14
  • @HarryJohnston - Yes the machine is in a domain
    – Roman
    Mar 1, 2017 at 8:13
  • @CareyGregory - How do Backup products work then? Do you claim a backup system always has a locally installed agent? Plus: it does work for the Administrator - without the backupSemantics flag even the Administrator has no access.
    – Roman
    Mar 1, 2017 at 8:14
  • 1
    @CareyGregory, backup privilege does work over the network, although IIRC you need to have it at both ends. I have a few tools that depend on this, though I'm always using an administrator account rather than a Backup Operators account. Roman, does it work if you configure the service to run as backup_op_user rather than explicitly specifying the credentials when you establish the network connection? (You will need to make sure that the user is in Backup Operators on both the local and remote machines.) Mar 1, 2017 at 22:28

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.