> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth/backup-operators.md).

# Backup Operators

## Backup Operators In-Depth

Backup operators are granted the `SeBackupPrivilege` and `SeRestorePrivilege` privileges. These privileges allow members **arbitrary reads and writes of files regardless of (D)ACLs**. A commonly used tools for manipulating such files is [SeBackupPrivilege](https://github.com/giuliano108/SeBackupPrivilege) by giuliano108 and Microsoft's [diskshadow](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow). You can find out more in the [SeBackupPrivilege](/breakpoint/windows/windows-privilege-escalation/privileges-in-depth/sebackupprivilege.md) section.

An important note is that the Backup Operators group may also **logon locally to the Domain Controllers**. Given that this user has pretty much arbitrary reads and writes means they can easily copy sensitive files that may only exist on the DC... *hint hint, nudge nudge*... `NTDS.dit`, a DC-specific file that contains all users and computer objects NTLM hashes.

{% hint style="info" %}
The `SeInteractiveLogonRight` for DCs is given to the Domain Administrators, Enterprise Administrators, local Administrators, [Server Operators](/breakpoint/windows/windows-privilege-escalation/accounts-and-and-groups-in-depth/server-operators.md), and Backup Operators.
{% endhint %}

## Backing up the Backup Operators

Sure this is scary, but there are simple measures you can take to prevent your Backup Operators from becoming Domain Admins. If you don't need your operators locally logging into DCs you can...

1. **Deny log on locally**
2. **Deny log on through RDP**