Windows – backup mode in Robocopy

backupfile-transferrobocopywindows

I am trying to copy a large database backup file over network.

The traditional program copy or xcopy failed with different binary resulted. Also tried robocopy without parameter, and resulted a failure. Just did another attempt with robocopy using /zb parameter (restart and backup mode). It took much longer but resulted in a success.

My question is, is backup mode really designed to copy large / backup file? Have searched through net and couldn't find a clear answer. Would appreciate if any experienced user could give me a hint or better solution.

Best Answer

Backup mode is a way to read and write files ignoring any permissions problems.

It uses the SeBackupPrivilege (reading) and SeRestorePrivilege (writing) in order to read/write any and all files, disregarding any ACEs that would prevent you from reading or writing a file.

Normally when trying to copy or access a file, Windows performs a check to make sure you have permission to read or write to location, but with SeBackupPrivilege (granted to the Backup Operators and Administrators groups by default), and SeRestorePrivilege (also granted to the Backup Operators and Administrators groups by default), these checks are bypassed.

On domain controllers, the mentioned user rights are also available to the Server Operators group.

From the documentation for SeBackupPrivilege

This user right determines which users can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This user right is effective only when an application attempts access through the NTFS backup application programming interface (API) through a backup tool such as NTBACKUP.EXE. Otherwise, standard file and directory permissions apply.

This user right is similar to granting the following permissions to the user or group you have selected on all files and folders on the system:

  • Traverse Folder/Execute File
  • List Folder/Read Data
  • Read Attributes
  • Read Extended Attributes
  • Read Permissions

From the documentation on SeRestorePrivilege:

This security setting determines which users can bypass file, directory, registry, and other persistent object permissions when they restore backed up files and directories, and it determines which users can set valid security principals as the owner of an object.

Granting this user right to an account is similar to granting the account the following permissions to all files and folders on the system:

  • Traverse folder / execute file
  • Write

To check if your account has these privileges, you can run the command whoami /priv at a command prompt.

Related Question