Fix "Access Denied" When Restoring a SQL Server Backup

~10 min read
QBM v2024+
Last updated: January 2025
Key Rule to Remember

SQL Server restores files using the SQL Server service account, not your Windows user account. Permissions must be granted to the account shown in the SQL Server service's "Log On" settings.

1

Check the SQL Server Service Account

Identify which account SQL Server runs under

Before granting any permissions, you need to identify which Windows account the SQL Server service uses. This is the account that needs access to your backup file.

How to Check
  1. Press Win + R to open the Run dialog
  2. Type services.msc and press Enter
  3. Find SQL Server (MSSQLSERVER) for default instance, or SQL Server (YourInstanceName) for named instances
  4. Right-click on it and select Properties
  5. Open the Log On tab
  6. Note the account type shown

You will see one of the following account types:

Recommended Location

Move your .bak file to C:\QBMBackups\ before granting permissions. This keeps backup files organized and makes permission management easier.

2

If Log On is "Local System Account"

Grant permissions to the SYSTEM account

Grant access to: SYSTEM (NT AUTHORITY\SYSTEM)
Choose a Method
GUI Method (Windows Explorer)
  1. Right-click on C:\QBMBackups folder → Properties
  2. Go to Security tab → Click Edit
  3. Click Add → Type SYSTEM
  4. Click Check Names → Click OK
  5. Select Full Control → Click Apply
Command Line Method (Run as Administrator)
Command Prompt
icacls "C:\QBMBackups" /grant "NT AUTHORITY\SYSTEM:(OI)(CI)F"
3

If Log On is "Network Service"

Grant permissions to the Network Service account

Grant access to: NT AUTHORITY\NETWORK SERVICE
Choose a Method
GUI Method (Windows Explorer)
  1. Right-click on C:\QBMBackups folder → Properties
  2. Go to Security tab → Click Edit
  3. Click Add → Type NETWORK SERVICE
  4. Click Check Names → Click OK
  5. Select Full Control → Click Apply
Command Line Method (Run as Administrator)
Command Prompt
icacls "C:\QBMBackups" /grant "NT AUTHORITY\NETWORK SERVICE:(OI)(CI)F"
Network Share Note

If your .bak file is on a network share (e.g., \\NAS\Backups\...), Network Service typically accesses it as the computer account (e.g., DOMAIN\SERVERNAME$). For best results, copy the backup file locally to C:\QBMBackups\ before restoring, or grant share permissions to your server's computer account.

4

If Log On is "Local Service"

Grant permissions to the Local Service account

Grant access to: NT AUTHORITY\LOCAL SERVICE
Command Line Method (Run as Administrator)
Command Prompt
icacls "C:\QBMBackups" /grant "NT AUTHORITY\LOCAL SERVICE:(OI)(CI)F"
GUI Alternative

You can also use the GUI method described in Step 2, but enter LOCAL SERVICE instead of SYSTEM when adding the account.

5

If Log On is "This Account" (Specific User)

Grant permissions to the exact account shown in service properties

This configuration is common in more secure enterprise environments. The SQL Server service runs under a dedicated domain or local user account.

Grant access to: The exact account shown (e.g., DOMAIN\SqlSvc or .\SqlSvcUser)
Steps to Follow
  1. Move your .bak file to C:\QBMBackups\
  2. Right-click on the folder → Properties → Security
  3. Click Add and enter the exact account name you saw under Log On
  4. Grant Full Control (or at minimum: Read on .bak file + Modify on data folder)
Command Line Example
Command Prompt
icacls "C:\QBMBackups" /grant "DOMAIN\SqlSvc:(OI)(CI)F"
Replace with Your Account

Replace DOMAIN\SqlSvc in the command with the actual account name you found in the SQL Server service Log On tab.

6

Important: Do Not Change the Service Account

Avoid modifying SQL Server service configuration

Warning: Do Not Switch the Service Account

Never change the SQL Server service account to "Local System" just to complete a restore operation. This can cause serious problems including broken service permissions, loss of access to network shares, violations of security policies, and failures in other SQL Server features.

Correct Approach

Keep the service account as configured by your IT department. Instead, grant the necessary folder/file permissions to that existing service account.

7

Verify Target Folder Permissions

Ensure SQL Server can write the restored database files

Even if SQL Server can read your .bak file, it must also be able to write the restored .mdf and .ldf database files to the target location.

Custom Data Folders

If you're restoring to a custom folder (e.g., C:\SQLData\), you must also grant Full Control to the same service account on that folder. The service account needs write permissions wherever the .mdf and .ldf files will be created.

Common Data Folder Locations
Default Paths
C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\DATA\
C:\SQLData\
D:\SQLData\

Quick Support Checklist

  1. 1 Check SQL Server service Log On account via services.msc
  2. 2 Move backup file to C:\QBMBackups\
  3. 3 Grant folder permissions based on account type: SYSTEM, NETWORK SERVICE, LOCAL SERVICE, or the specific user
  4. 4 Ensure the target data folder also has write permissions
  5. 5 Retry the restore operation in SQL Server Management Studio or QBM

Still Having Issues?

If you've followed all the steps above and still encounter "Access Denied" errors, please contact QBM Support with the following information: