# Ensure 'Back up files and directories' is set to 'Administrators'

Necessity: The 'Back up files and directories' user right (SeBackupPrivilege) allows a user to bypass normal file and directory permissions to back up system data. If granted to an unauthorized account, it could be exploited to read any file on the system, including sensitive operating system files, credentials, or confidential data, leading to privilege escalation and massive data exfiltration. Restricting this right is critical to protect data integrity and confidentiality. Auditing and Remediation: The audit script inspects the local security policy to identify which principals (users or groups) are currently assigned this powerful right. The remediation script modifies this policy, using native Windows tools to enforce the desired assignment, ensuring only authorized accounts can perform backup operations. Recommended State Rationale: Basic: ['Administrators'] - This state enforces the default and most common configuration, ensuring that only members of the built-in Administrators group can perform system-wide backups. Moderate: ['Administrators,Backup Operators'] - This state aligns with the principle of least privilege for operational environments. It allows dedicated backup service accounts or personnel, who are members of the 'Backup Operators' group, to perform their duties without requiring full administrative privileges, thus reducing the risk associated with using highly privileged accounts for routine tasks. Strict: ['Administrators'] - In a highly secure environment, the principle of minimizing the attack surface dictates that this right should be restricted to the absolute minimum number of accounts. This state removes the 'Backup Operators' group, ensuring that only full administrators can exercise this right, which is the most restrictive and secure configuration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Administrators']` |
| **Moderate** | `['Administrators,Backup Operators']` |
| **Strict** | `['Administrators']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the 'Back up files and directories' user right assignment (SeBackupPrivilege). The script must convert the returned Security Identifiers (SIDs) to their corresponding account names and output only a single string containing the comma-separated list of names.

## Remediation Script Working

PowerShell script that sets the 'Back up files and directories' user right assignment (SeBackupPrivilege). The script must accept a single, positional command-line argument: a comma-separated string of user or group names (e.g., 'Administrators,Backup Operators'). It must apply this setting using a temporary security template and the secedit command-line tool, returning $true on success and $false on failure.

