Service Authorization Settings

Starting with version 8.5, the SQL Backup Master Windows service requires the calling user to be a member of the local Administrators group before it will perform backup-related operations. This article explains why, who needs to read it, and how to configure the new behavior for your environment.

What changed

SQL Backup Master is split into two components: a Windows service that runs as LocalSystem and performs backup work, and one or more client applications (the main UI, the desktop tray notification app, and PowerShell cmdlets) that talk to the service over a local named pipe. In earlier versions, any authenticated local user could call any operation on that pipe. That included operations that modify backup jobs – and because backup jobs can run custom pre- and post-backup PowerShell or batch scripts as LocalSystem, this represented a local privilege escalation path on shared machines.

The service now enforces an authorization check on every operation. By default, only members of the local BUILTIN\Administrators group are permitted to invoke service operations. Members of DOMAIN\Domain Admins are also permitted on domain-joined machines because that group is nested into local Administrators by default Active Directory policy.

Who needs to read this

You probably need to take action if the following applies to your installation:

• You run the SQL Backup Master PowerShell cmdlets in scheduled tasks or scripts under a non-administrator service account.

The desktop tray notification app does not require an administrator account. It is designed to work for any authenticated user through a small set of permitted operations that expose only job status summaries and a single-job "run now" trigger – no job configuration, scripts, stored credentials, or destination details. It continues to work at user logon, without elevation and without any configuration changes.

If your operators log into Windows as administrators and launch SQL Backup Master from the shortcuts the installer creates (the most common case), no action is required. If you're seeing authorization errors even though you are an administrator, read the next section.

Administrator membership is not the same as elevation (UAC)

Under Windows User Account Control (UAC), being a member of the Administrators group does not by itself mean your programs run with administrator rights. Unless a program is explicitly elevated, Windows starts it with a filtered token in which the Administrators membership is disabled. The SQL Backup Master service authorizes the calling process, so a client launched without elevation is denied even when the logged-on user is an administrator – typically surfacing as the error "Administrator privileges are required to invoke this operation".

If you encounter that error while logged in as an administrator, check how SQL Backup Master is being launched:

• The desktop and Start Menu shortcuts created by the installer elevate automatically – launching from them shows a single UAC prompt and then runs elevated. Shortcuts created by other means do not: in particular, taskbar pins and manually-created shortcuts don't inherit the Run as administrator property. Re-create such shortcuts from the installer's Start Menu entry, or open the shortcut's Properties → Shortcut → Advanced and enable Run as administrator.
• Launching SQLBackupMaster.exe directly from the install directory starts it without elevation. Use right-click → Run as administrator, or launch via an elevated shortcut.
• Newer releases of SQL Backup Master detect this situation at startup and offer to restart the application as administrator automatically.

Where the settings live

Authorization is configured in the service's App.config file, located in the SQL Backup Master install directory:

C:\Program Files\Key Metric Software\SQL Backup Master\SQLBackupMaster.Service.exe.config
                                    

Two keys under <appSettings> control the policy:

<appSettings>
    <add key="ServiceAuthorization.RequireAdmin" value="true" />
    <add key="ServiceAuthorization.AdditionalGroups" value="" />
</appSettings>
                                    

Editing this file requires administrator rights (because the install directory is under %ProgramFiles%), and changes only take effect after restarting the SQL Backup Master Windows service.

Option 1 (recommended): Run client tools as administrator

For most installations, the simplest and most secure choice is to ensure the SQL Backup Master client applications run under an administrator identity:

• The SQL Backup Master installer creates the main UI's desktop and Start Menu shortcuts with the Run as administrator property set. Launching the UI from either shortcut will trigger a single UAC elevation prompt and run the rest of the session elevated – no manual action required.
• The tray notification app needs no attention here: as described above, it is limited to non-sensitive status operations and works under any account, elevated or not.
• PowerShell cmdlet invocations should run in elevated PowerShell sessions or as scheduled tasks configured with the Run with highest privileges option set.

No configuration changes are required for this option. Leave both settings at their defaults.

Option 2: Authorize a specific Windows group

If you have an established Windows group for backup operators – either the built-in Backup Operators group, or a custom domain group such as CONTOSO\SQL Backup Admins – you can grant that group access without making its members full Administrators.

Add the group name to the AdditionalGroups setting:

<add key="ServiceAuthorization.AdditionalGroups" value="BUILTIN\Backup Operators" />
                                    

Multiple groups can be listed, separated by semicolons:

<add key="ServiceAuthorization.AdditionalGroups" value="BUILTIN\Backup Operators;CONTOSO\SQL Backup Admins" />
                                    

Group names must include their scope prefix (BUILTIN\, NT AUTHORITY\, or YOURDOMAIN\). Local groups created on the SQL Backup Master host itself use the machine name as the prefix – for example, SBM-HOST\SqlBackupOps.

Two cautions when choosing a group. First, the UAC token filtering described above applies to several built-in privileged groups – including Backup Operators – exactly as it does to Administrators: a process launched without elevation is denied even when its user belongs to the group. Groups you create yourself (local or domain) are not filtered and work with non-elevated clients, which makes a custom group the right choice for the scenarios this option exists for – scheduled cmdlets running under a non-administrator service account, or backup operators who use the client tools without being made full administrators. Second, on non-English editions of Windows the built-in group names are localized, and the name must be entered exactly as your Windows displays it (check net localgroup or Computer Management) – for example, German editions use VORDEFINIERT\Sicherungs-Operatoren for BUILTIN\Backup Operators. A group name that doesn't resolve on the host is silently ignored by the authorization check.

Restart the SQL Backup Master service after editing the file. Members of the named group will then be permitted to invoke service operations alongside members of Administrators.

If members of the group will use the main SQL Backup Master application (rather than just the PowerShell cmdlets), note that the installer's shortcuts launch the main UI elevated, which a non-administrator account cannot satisfy – see Launching the main UI as a non-administrator under Option 3 below; the same shortcut adjustment applies here.

Note on what this grants. Members of any listed group can trigger backup jobs, which means they indirectly cause the service's pre- and post-backup scripts to run as LocalSystem. They cannot, however, modify the scripts themselves – those operations remain Administrator-only by design. Choose groups whose members you trust to legitimately run backup jobs at the times of their choosing.

Option 3 (not recommended): Disable the authorization check

As a last resort – for example, if you operate SQL Backup Master in an environment with strong external access controls and the operational cost of Options 1 and 2 is prohibitive – you can revert to the previous behavior in which any authenticated local user can call any service operation:

<add key="ServiceAuthorization.RequireAdmin" value="false" />
                                    

This re-opens the local privilege escalation surface described above. Any local user able to log onto the SQL Backup Master host – including, in default configurations, the Guest account – can configure malicious pre-backup scripts and have them executed as LocalSystem. We recommend this setting only on hosts where every interactive user is already trusted at the same level as LocalSystem, and we recommend pairing it with compensating controls (limited logon access, host firewall, intrusion detection).

When this setting is disabled, the service writes a warning to the Windows Event Log on every startup so that the change remains visible to administrators reviewing the host.

Launching the main UI as a non-administrator under this option. The SQL Backup Master installer configures the desktop and Start Menu shortcuts to launch the main UI elevated by default. With RequireAdmin set to false, the service itself will accept calls from any authenticated user – but the standard shortcuts will still trigger a UAC elevation prompt, which a non-administrator account cannot satisfy. To run the main UI as a non-administrator under this option, either create a new shortcut pointing directly at SQLBackupMaster.exe in the install directory (leaving the Run as administrator property unset), or open the properties of an existing shortcut, click Advanced, and clear the Run as administrator checkbox. The PowerShell cmdlets do not have this constraint – once RequireAdmin is disabled, they will run normally under any logged-on account. (The tray notification app works under any account regardless of this setting, as described earlier.)

Verifying your configuration

After changing either setting, restart the SQL Backup Master Windows service and review the Windows Event Log (Applications and Services Logs → SQL Backup Master) for entries from the Service Authorization source.

• If RequireAdmin is disabled, you will see a warning at every service startup explaining that any authenticated user may invoke operations.
• If a non-authorized caller attempts an operation, you will see a warning describing the caller's identity and the operation that was denied. This is useful for diagnosing tray-app or cmdlet failures after upgrade.

From a non-administrator command prompt, you can quickly verify that a denial occurs by attempting to list backup jobs through the PowerShell cmdlets – the call should fail with a fault indicating that administrator privileges are required.

Returning to defaults

To restore the recommended secure defaults at any time, set the configuration back to:

<appSettings>
    <add key="ServiceAuthorization.RequireAdmin" value="true" />
    <add key="ServiceAuthorization.AdditionalGroups" value="" />
</appSettings>
                                    

Restart the SQL Backup Master Windows service for the change to take effect.

Security notes

The default configuration protects against:

• A non-administrator local user invoking service operations to modify backup jobs, install malicious pre-backup scripts, and obtain code execution as LocalSystem.
• A non-administrator local user reading sensitive job data – including stored OAuth tokens, destination configurations, and connection strings – through the service's read operations.
• User-mode malware running under a non-administrator account from using the service as a privilege-escalation primitive.

The default configuration does not protect against:

• An already-administrator local user. The service trusts administrators to configure backup jobs and scripts; an administrator is, by definition, able to perform actions equivalent to those the service performs.
• Compromise of the install directory's file permissions. If a non-administrator user has been granted write access to %ProgramFiles%\Key Metric Software\SQL Backup Master\, all bets are off.
• Network-level threats. SQL Backup Master's service endpoint is local-only; this article addresses local authorization. For network-facing concerns (SQL Server connectivity, cloud destination credentials), see the relevant per-feature documentation.

Getting help

If after reading this article you're unsure which option fits your environment, or if you're seeing authorization-related warnings in the Event Log that you can't account for, please reach out to SQL Backup Master support with a description of how SQL Backup Master is deployed in your environment (who logs in, which client tools they use, and whether any automation invokes the service). We'll help you pick the right configuration.