SyncBack Elevation: Manage Admin Rights & UAC in Backups

Author: Kostas Tsakiridis, 2BrightSparks Pte. Ltd.

Microsoft introduced a big change with Windows Vista regarding how administrators can exercise their administrative privileges. Before Windows Vista’s introduction, administrators would perform any task without the need to request additional authorization to do so. This meant that any application they ran would automatically inherit administrative privileges, which sometimes could prove fatal if the application was compromised (e.g. malware).

All this has changed with Windows Vista. Administrators, and any application they are executing, are limited to a standard user’s privileges until the administrators themselves authorize the application to run with administrative privileges. This action is called elevation and it is done via an alert pop-up dialog by the Windows operating system itself (called the User Account Control, UAC, prompt) which requests from the administrator to authorize the action. This ensures that applications that are most likely to make changes to the device, and that are entrusted by the users, are being allowed to run elevated.

Some of the actions requiring elevation are the following:

• Installing and uninstalling applications, device drivers and Windows Updates.
• Adding, removing user accounts, or changing a user’s account type.
• Changing system wide settings such as Windows Firewall.
• Viewing or altering system, program files folders/files or another user’s folders/files.

On the other hand, if a standard user wants to perform an administrative task, Windows will prompt the user for the credentials of an administrator account in order to carry on with the task. Failing to do so will stop the task from proceeding further.

How about SyncBack?

SyncBackPro and SyncBackSE require elevation when run by an administrator, meaning if the user is an administrator, then a UAC prompt will be displayed by Windows when run. Elevation allows SyncBackPro and SyncBackSE to perform tasks it otherwise could not, e.g. copy open/locked files with the use of Windows Volume Shadow-copy Service (VSS). Running SyncBack elevated has its drawbacks as well, for example SyncBackPro/SE cannot "see" mapped network drives defined by the user due to process isolation. To reduce the possibility of non-elevated applications communicating with elevated ones, the operating system will isolate these processes from each other.

Another feature of SyncBack which may get affected by elevation, or the lack of it, is profile scheduling which is discussed in detail in our Windows Task Scheduler article.

SyncBackPro and SyncBackSE can be launched without elevation by running the Non Elevated version of the application. A standard user installer also allows Windows users to install SyncBack only for themselves, so they no longer need to be an Administrator to install SyncBack. When SyncBack is installed only for the current user then it will not run elevated.

And finally, as far as SyncBackFree is concerned, it does not run elevated.

V12: Locked File Copying Without Elevation

One of the main reasons to run SyncBack elevated is to copy locked files using the Volume Shadow Copy Service (VSS). However, running elevated causes issues such as the inability to see mapped network drives.

SyncBack V12 resolves this trade-off. SyncBackPro and SyncBackSE can now copy locked files even when running unelevated, by using the Scheduler Monitor service. Because the Scheduler Monitor runs as a Windows service with the necessary privileges, it can perform VSS operations on behalf of the unelevated SyncBack process. This means you no longer need to choose between accessing mapped network drives and copying locked files — you can do both.

This feature requires the Scheduler Monitor Service to be installed and running, which means SyncBack must have been installed using the Administrator installer (for All Users).

Some more technical details can be read in our Administrator Privileges and SyncBack KB Article.

Later versions of Windows 11 also introduced Administrator Protection.