SeBackupPrivilege

SeBackupPrivilege is a Windows backup right that, when enabled in the calling process and used through a backup-aware operation, can permit retrieval of file content despite ordinary ACL checks; RegSaveKey requires the privilege to be enabled. Windows policy assigns backup rights to Administrators and Backup Operators on common workstation/server configurations, but effective assignments vary and the group has no default members. The shown NetExec SMB -x operation additionally requires administrator credentials for remote command execution; that prerequisite is separate from SeBackupPrivilege. SAM and SYSTEM hive processing can expose local SAM credential material (ATT&CK T1003.002). The SECURITY/Impacket path also processes cached credentials and LSA secrets (T1003.004), while the preserved NTDS.dit path is a distinct domain-controller procedure (T1003.003). SMB connectivity, target-side file access, and an enabled backup privilege in the execution token must each be established. The mixed scope still needs dependency-aware follow-up.