# Ensure 'Back up files and directories' is set to 'Administrators'

Necessity: The 'Back up files and directories' user right (`SeBackupPrivilege`) allows users to bypass standard file and directory permissions to read any file on the system. If an attacker compromises an account with this right, they can access and exfiltrate sensitive system data, such as password hashes from the SAM database, credentials, or proprietary information, leading to privilege escalation and widespread data breaches. Restricting this privilege is crucial for protecting system integrity and confidentiality.

Auditing and Remediation: The audit script inspects the Local Security Policy to identify and list all accounts currently assigned the `SeBackupPrivilege`. The remediation script directly modifies this policy, removing existing assignments and setting the privilege exclusively for the accounts specified in the input argument.

Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is to assign this right solely to the 'Administrators' group. This adheres to the principle of least privilege. While the 'Backup Operators' group also has this right by default, limiting it to 'Administrators' significantly reduces the attack surface. Any compromise of a non-administrator account (including dedicated backup service accounts) will not grant the attacker the ability to bypass file system access controls. The risk associated with this privilege is sufficiently high that the strictest configuration is the only recommended baseline.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators']` |
| **Moderate** | `['Administrators']` |
| **Strict** | `['Administrators']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to audit the 'Back up files and directories' user right. The script must query the Local Security Policy for the `SeBackupPrivilege`. It should identify all accounts and groups assigned this right, convert their Security Identifiers (SIDs) to recognizable names, and output a single, comma-separated string of these names (e.g., 'Administrators,Backup Operators'). The output must not contain any labels or extra text.

## Remediation Script Working

Develop a PowerShell remediation script that configures the 'Back up files and directories' user right. The script must accept a single, positional command-line argument: a comma-separated string of account names (e.g., 'Administrators'). It will convert these names to SIDs, apply the change using the Local Security Policy engine, and then output `$true` for success or `$false` for failure. The script should not produce any other output.

