Check the SQL Server Service Account
Identify which account SQL Server runs under
Before granting any permissions, you need to identify which Windows account the SQL Server service uses. This is the account that needs write access to your backup folder.
- Press
Win + Rto open the Run dialog - Type
services.mscand press Enter - Find SQL Server (MSSQLSERVER) for default instance, or SQL Server (YourInstanceName) for named instances
- Right-click on it and select Properties
- Open the Log On tab
- Note the account type shown
You will see one of the following account types:
Create a dedicated backup folder such as C:\QBMBackups\ for your database backups. This keeps backups organized and makes permission management easier.
If Log On is "Local System Account"
Grant write permissions to the SYSTEM account
SYSTEM (NT AUTHORITY\SYSTEM)
- Right-click on
C:\QBMBackupsfolder → Properties - Go to Security tab → Click Edit
- Click Add → Type
SYSTEM - Click Check Names → Click OK
- Select Full Control → Click Apply
icacls "C:\QBMBackups" /grant "NT AUTHORITY\SYSTEM:(OI)(CI)F"
If Log On is "Network Service"
Grant write permissions to the Network Service account
NT AUTHORITY\NETWORK SERVICE
- Right-click on
C:\QBMBackupsfolder → Properties - Go to Security tab → Click Edit
- Click Add → Type
NETWORK SERVICE - Click Check Names → Click OK
- Select Full Control → Click Apply
icacls "C:\QBMBackups" /grant "NT AUTHORITY\NETWORK SERVICE:(OI)(CI)F"
If Log On is "Local Service"
Grant write permissions to the Local Service account
NT AUTHORITY\LOCAL SERVICE
icacls "C:\QBMBackups" /grant "NT AUTHORITY\LOCAL SERVICE:(OI)(CI)F"
You can also use the GUI method described in Step 2, but enter LOCAL SERVICE instead of SYSTEM when adding the account.
If Log On is "This Account" (Specific User)
Grant write permissions to the exact account shown in service properties
This configuration is common in more secure enterprise environments. The SQL Server service runs under a dedicated domain or local user account.
DOMAIN\SqlSvc or .\SqlSvcUser)
- Create your backup folder (e.g.,
C:\QBMBackups\) - Right-click on the folder → Properties → Security
- Click Add and enter the exact account name you saw under Log On
- Grant Full Control (or at minimum: Modify permission for writing files)
icacls "C:\QBMBackups" /grant "DOMAIN\SqlSvc:(OI)(CI)F"
Replace DOMAIN\SqlSvc in the command with the actual account name you found in the SQL Server service Log On tab.
SQL Server Agent Scheduled Backups
Additional considerations for automated backup jobs
If you're using SQL Server Agent to run scheduled backup jobs, you may also need to check the SQL Server Agent service account.
- Open
services.msc - Find SQL Server Agent (MSSQLSERVER) or SQL Server Agent (YourInstanceName)
- Check the Log On tab
- Grant the same folder permissions to this account if it differs from the SQL Server service account
Even though SQL Server Agent triggers the backup job, the actual BACKUP DATABASE command runs under the SQL Server service account. So the SQL Server service account is the one that needs write access to the backup folder.
BACKUP DATABASE [YourDatabase]
TO DISK = 'C:\QBMBackups\YourDatabase.bak'
WITH COMPRESSION, INIT;
Network Share Backup Considerations
Backing up to a network location (UNC path)
If you want to write backups directly to a network share (e.g., \\NAS\Backups\), additional configuration is required.
If SQL Server runs as Network Service or Local System, it accesses network shares using the computer account (e.g., DOMAIN\SERVERNAME$). You must grant the computer account write access on the network share.
- Use a domain service account: Configure SQL Server to run under a domain user account that has write access to the network share
- Grant computer account access: Add
DOMAIN\SERVERNAME$to the share permissions with write access - Backup locally, then copy: Backup to a local folder first, then use a scheduled task to copy files to the network share
For reliability, backup to a local folder first (e.g., C:\QBMBackups\), then use a separate process to copy or sync files to network storage or cloud backup.