0
I backup my Windows system partition using Macrium Reflect 6's backup schedule. The software adds an entry to Windows Task Scheduler and the backup usually runs without trouble. Since the backup location is a folder on an always mounted hard drive -- F:\Files
--, I risk backup corruption if my computer gets infected (ie ransomware) before I can copy the files to an external drive. To deal with this, here is what I've done:
- I use the PC as a standard (non-administrator) account
- I've right-clicked the backup folder, gone to Properties >> Security >> Edit permissions, and clicked "Deny" under the "Write" permission for users belonging to the
Users
group.
My intent is to make it impossible for non-admin users -- and hence most malware -- to overwrite or corrupt the backup files. The restriction took effect as I expected: for instance I now need to enter an administrator password if I wish to write a file to F:\Files
. The problem is that the backup job now fails. In Macrium UI, here is the error I see:
Backup aborted! - None of the specified locations could be written to
I'm surprised by this error because I think the task is set to run as the Admin account; when I setup the backup job in Macrium I was explicitly asked which user account should be used, and to enter that user's password so I chose Admin
. As a result I expected the software to have no problem writing to the backup folder even after I revoked write permissions from non-admins. If I open up Task Scheduler and look at the task details, here is what is shown under Security options:
As you can see, the task is run as Admin
. The author of the task (not shown in the screenshot) is also Admin
. The action of the task is:
C:\...\Reflect.exe
-e -w "F:\Files\Schedule.xml" -inc -g {some long token here}
Am I overlooking something or is this a bug with my backup software? The last run result in Task Scheduler shows simply (0x1)
Upon further investigation, I discovered that if I log in as Admin
and try to write a file to the restricted folder, I can't. Denying Write perm for the Users
group also denied it for the Admin
account. This is probably why my backup job is failing. The image below shows the Effective Permissions for Admin
after I deny write permissions to the Users
group.
I also discovered that although blocked accounts could not save a new file to the folder, they could still delete the files already present. So I was still vulnerable to malware deleting these files. I needed more restrictive permissions. I also need to find a way to deny perms for all non-admin users, but allow it for admins.
Here is what I did
Instead of denying permission for the entire Users
group, I decided to try denying permission for only the account I use day-to-day.
From the folder Properties screen (right click the folder and select Properties):
- click
Advanced
- click
Change Permissions
- click
Add
- type the account username I want to restrict
- click
Check Names
: the fully qualified username (eg:MyPC\John
) should auto-populate the textarea - click
OK
- A popup that allows to set permissions granularly for the selected users should open. Here is what I did with mine:
Most importantly, I denied all Write, Delete, Change permissions and Take ownership permissions. Now things seem to be working as intended. With my day-to-day account I can neither write, nor delete files in the backup folder. However as Admin
I can do both. A manual backup just completed successfully as well so things seem to be OK. I'll know tomorrow whether the scheduled task runs without trouble.
This is still not the fix I'm looking for
What I'd like is for all non-admin users to be restricted. My solution blocks just one non-admin -- MyPC\John
-- but if another non-admin profile were created (or maybe even if my username changed?) the restrictions would be bypassed. I'm looking for something closer to the protection on C:\Program Files
directory: I'm always blocked from making changes there if I'm not an admin.
1Provide the path your trying to write to. – Ramhound – 2017-06-23T23:29:39.223
@Ramhound
F:\Files
– BeetleJuice – 2017-06-23T23:34:34.653Are you running Macrium Reflect as Admin? Right click on the program executable and select properties, Select compatibility Tab and tick the "run this program as an administrator" hit ok to save changes, see if this solves your issue. – Moab – 2017-06-24T00:42:26.160
@Moab The backup is run as a Task Scheduler task, not from the Macrium UI. Macrium is not even running when the task is launched. It is the task that starts the Macrium process, and the task is set to execute that process as
Admin
– BeetleJuice – 2017-06-24T00:45:57.647I would still do as suggested, Taskscheduler sill runs the MR executable. – Moab – 2017-06-24T00:52:14.083
@Moab I'm sorry but your suggestion didn't work because even the Admin account did not have permission to write to the folder, so the backup failed anyway. – BeetleJuice – 2017-06-24T01:48:25.987
Change permissions on the folder it is trying to write to. – Moab – 2017-06-24T02:05:17.083
Yes you're right @Moab; I've already done that though (take another look at my question); that's how I ran into my original problem while trying to restrict write access. So the question is "how should I set permissions?" The answer I wrote up provides one solution that works. – BeetleJuice – 2017-06-24T02:27:39.840
@Beetlejuice - The answer you wrote up was deleted. Most users can't even see it. The reason it was deleted is because, you provided the solution, then indicated "it wasn't what you were looking for". Answers are answers, if you find yourself asking new questions in your self-answer, don't add those questions. – Ramhound – 2017-06-24T09:30:18.387