Backup and restore operations are among the most powerful actions that can be performed on a Windows system.
The Backup and Restore privileges allow an account to bypass normal file and folder permissions, reading or writing any file on the system regardless of its access control list.
These privileges exist for a legitimate reason, they are required by backup software and recovery tools, but in the wrong hands they become a quiet path to data theft or tampering.
Visibility into when these privileges are actually used is therefore a critical part of endpoint hardening and forensic readiness.
Windows includes a security option, Audit: Audit the use of Backup and Restore privilege, that generates a security audit event whenever these privileges are exercised.
When this option is enabled together with the Audit privilege use policy, Windows records an event for every file that is backed up or restored, giving security teams the signals they need to detect misuse.
By enforcing this configuration through Microsoft Intune, administrators ensure that privileged backup and restore activity is consistently audited across all managed Windows endpoints.
The result is an environment where sensitive privileged operations are no longer invisible, but recorded, reviewable, and ready for investigation.
Why This Policy Matters
Privileged operations are a prime target for attackers, because they provide access that bypasses normal security controls.
The Backup and Restore privileges are especially sensitive, since they can be used to read protected files or overwrite system data without triggering standard permission checks.
Without auditing the use of Backup and Restore privilege:
Sensitive files can be read or overwritten with no record of the activity
Privilege abuse blends into normal administrative and backup operations
Incident responders lack the evidence needed to reconstruct what happened
Compliance and forensic readiness gaps remain hidden until it is too late
With this setting enforced through Intune:
Windows generates a security audit event whenever the Backup or Restore privilege is used
Security teams gain visibility into sensitive privileged operations
Forensic investigations have reliable evidence to work from
The control is applied consistently across every managed endpoint
This configuration aligns with modern security principles such as defense in depth, endpoint hardening, proactive threat detection, and Zero Trust architecture.
Security Governance
Security governance ensures that hardening controls are consistently applied, monitored, and aligned with organizational standards.
Without centralized governance, audit settings such as this one can drift across devices, leaving blind spots that attackers can exploit.
Managing the Audit the use of Backup and Restore privilege setting through Microsoft Intune brings several governance benefits:
Centralized enforcement of privilege-use auditing across all managed Windows endpoints
Consistent configuration aligned with corporate security baselines
Clear visibility into deployment status and configuration compliance
Defined ownership and accountability through scope tags and role-based administration
An auditable policy lifecycle from creation to enforcement and validation
This level of governance ensures that auditing of privileged operations is handled in a controlled and transparent manner, reinforcing compliance with internal security policies and regulatory frameworks.
Windows CSP Overview
This section explains how the policy is exposed at the operating system level and how Microsoft Intune interacts with it.
The configuration is powered by the Windows Policy Configuration Service Provider (CSP) framework, specifically the LocalPoliciesSecurityOptions area.
The specific setting responsible for auditing the use of the Backup and Restore privilege is:
./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/Audit_AuditTheUseOfBackupAndRestoreprivilege
This configuration:
Applies at the device scope
Is supported on Pro, Enterprise, Education, and IoT Enterprise / IoT Enterprise LTSC editions
Requires Windows 11, version 22H2 with KB5053657 (10.0.22621.5126) or later, or Windows 11, version 24H2 (10.0.26100) or later
Is enforced through the Windows MDM engine when deployed via Intune
When enabled, Windows audits the use of all user privileges, including Backup and Restore, when the Audit privilege use policy is in effect. If the setting is not configured, the device honors its existing local configuration, which can lead to inconsistent behavior across managed devices.
Description Framework Properties
This section defines how the configuration behaves at a technical level within the CSP framework. Understanding these properties is essential for ensuring correct deployment and avoiding configuration conflicts.
Format: b64
Access Type: Add, Delete, Get, Replace
Default Value: AA==
This means:
The value is encoded as a base64 string
The default value AA== represents the disabled state
It must be explicitly enabled by setting the value to AQ==
It can be centrally managed and enforced via Intune
Allowed Values
This section defines the valid configuration values supported by the policy. The setting uses a base64-encoded value and supports the following options:
AA== (Default) Disable auditing of the Backup and Restore privilege
AQ== Enable auditing of the Backup and Restore privilege
When set to AQ== (Enable), Windows generates a security audit event whenever the Backup or Restore privilege is used, allowing administrators to monitor and investigate privileged file operations.
Group Policy Mapping
For organizations operating in hybrid environments, this CSP setting maps to a corresponding Group Policy configuration.
Name: Audit: Audit the use of Backup and Restore privilege
Path: Windows Settings > Security Settings > Local Policies > Security Options
This mapping helps administrators understand how the same security control can be represented across traditional Group Policy and modern cloud-based management through Microsoft Intune.
Security Considerations
Before enabling this policy, administrators should understand how it behaves and plan for its impact.
This setting only generates events when the Audit privilege use policy is also enabled
Enabling it can produce a very high volume of events, sometimes hundreds per second, during backup operations
Ensure that the event collection and SIEM pipeline can handle the additional audit volume
Supported on Windows 11 22H2 with KB5053657 (10.0.22621.5126) or later, or Windows 11 24H2 (10.0.26100) or later
Applies at the device scope only, it is not available at the user scope
A phased, pilot-first deployment is recommended to validate the behavior in a controlled group, confirm that the resulting event volume is manageable, and avoid unexpected impact before rolling the setting out across production devices.
How to Configure Audit Use of Backup and Restore Privilege Using Intune (Settings Catalog)
You can enforce this policy centrally using the Intune Settings Catalog, ensuring that auditing of the Backup and Restore privilege is applied consistently across all managed Windows devices.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshot.
Create the Configuration Profile
In the Microsoft Intune admin center:
Navigate to Devices
Select Windows
Click Configuration
Select + Create policy
In the Create a profile pane:
Platform: Windows 10 and later
Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy. In the next steps, you will search for and configure the setting that audits the use of the Backup and Restore privilege.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of the configuration profile. This stage is essential for long-term management, clarity, and governance within Microsoft Intune, especially in environments with multiple endpoint hardening policies and security baselines.
Providing a clear Name and a concise but meaningful Description ensures that the purpose of the policy is immediately understood by administrators and security teams in the future. As shown in the screenshot, configure the fields as follows.
Policy Name and Description
Name: WIN – Endpoint Hardening – Audit Use of Backup and Restore Privilege
Description: Enables auditing of the Backup and Restore privilege on managed Windows endpoints, generating a security audit event whenever these privileges are used while the Audit privilege use policy is active. This strengthens visibility into sensitive privileged operations, supports forensic investigations, and is centrally enforced through Microsoft Intune.
The Platform field is already pre-selected as Windows, so no changes are required.
Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows security setting you want to enforce.
To open the Settings picker panel, click Add settings.
By default, this setting is not configured, which means Windows will follow its existing behavior and will not explicitly enforce auditing of the Backup and Restore privilege through Intune unless you enable it.
In the search field at the top of the Settings picker, type Audit The Use Of Backup And Restore privilege, and then click Search to filter the results.
From the returned results, select the category Local Policies Security Options, and then choose the setting Audit The Use Of Backup And Restore privilege. Once selected, the setting is automatically added to the configuration profile.
Back on the configuration page, change the value from its default state to Enable.
When enabled, Windows audits the use of the Backup and Restore privilege. This ensures that:
A security audit event is generated for every file that is backed up or restored, when Audit privilege use is active
Privileged file operations become visible to administrators and security teams
Forensic and incident investigations have reliable evidence of privilege use
This configuration aligns with modern endpoint hardening practices and supports Zero Trust security principles, ensuring that sensitive privileged operations are continuously monitored.
Configure Scope Tags (Optional)
Scope tags are used to control who can view and manage this policy within the Microsoft Intune admin center. They are particularly useful in environments with delegated administration, multiple IT teams, or regional management models.
As shown in the screenshot, the Default scope tag is selected. This is the standard and recommended configuration for most environments, as it ensures the policy is visible to all administrators who have access to Intune.
Optionally, custom scope tags can be assigned if you need to:
Restrict policy visibility to specific IT roles or teams
Enforce administrative separation of duties
Support delegated or region-based Intune management
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Audit Use of Backup and Restore Privilege
After configuring the policy settings, the next step is to assign the policy to the appropriate target group. Assignments define which devices will receive and enforce this configuration, ensuring the policy is applied in a controlled and intentional manner.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target. This approach allows you to deploy the policy gradually, starting with test devices before expanding to production.
As shown in the screenshot, the policy is assigned to the following group:
GRP – MS365Education – Test Computers
Once the group is selected, verify the following:
The group appears under Included groups
The group status is Active
No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is appropriate for controlled test deployments.
After confirming the assignment, click Next to proceed to the Review + Create step.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy. This is where you validate that all configurations are correct and aligned with your intended endpoint hardening and audit objective.
Pay special attention to the following items.
Policy name and description
Confirm that the policy clearly reflects its purpose: auditing the use of the Backup and Restore privilege so that sensitive privileged file operations are recorded for security analysis.
Configuration settings: Verify that Audit The Use Of Backup And Restore privilege is set to Enable, under Local Policies Security Options.
Scope tags: Ensure the correct scope tag is assigned. In this example, the Default scope tag is used.
Assignments: Confirm the policy is assigned to the intended group: GRP – MS365Education – Test Computers. Also verify that no unintended exclusions are configured.
This final review step helps prevent misconfigurations, unintended deployments, or scope issues, especially in environments with multiple security baselines, delegated administration, and layered endpoint security policies.
Once everything has been validated, click Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – Audit Use of Backup and Restore Privilege configuration profile, the next step is to verify its deployment status.
This validation confirms that the policy has been successfully applied and that Windows is auditing the use of the Backup and Restore privilege on the targeted devices.
Although Microsoft Intune can take up to 8 hours to automatically deliver configuration profiles, deployment often occurs much faster. If needed, you can accelerate the process by:
Triggering a manual device sync from the Company Portal
Initiating a sync directly from the Microsoft Intune admin center
Monitoring deployment ensures that the audit policy is active and operating as intended.
How to Verify Policy Deployment Status
To review the deployment results:
In the Microsoft Intune admin center, navigate to Devices ➝ Configuration profiles
Use the search bar to locate the profile: WIN – Endpoint Hardening – Audit Use of Backup and Restore Privilege
Select the policy to open the Overview page
Review Deployment Metrics
Intune provides clear indicators to evaluate the policy deployment status:
Succeeded Devices have successfully applied the policy
In progress Devices are still processing the configuration
Error The policy failed to apply and requires investigation
Not applicable The device does not support the configuration
When devices report Succeeded, it confirms that Windows is auditing the use of the Backup and Restore privilege, ensuring that privileged file operations are recorded for security analysis.
This verification step confirms that the endpoint hardening control is successfully deployed and improving visibility into privileged operations across managed Windows devices.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the WIN – Endpoint Hardening – Audit Use of Backup and Restore Privilege policy was successfully applied.
This validation ensures that auditing of the Backup and Restore privilege is actively enforced at the operating system level.
Windows records Intune policy processing events locally, allowing administrators to confirm policy enforcement without relying only on the Intune portal.
How to Verify
Open Event Viewer on the target device
Navigate to: Applications and Services Logs ➝ Microsoft ➝ Windows ➝ DeviceManagement-Enterprise-Diagnostics-Provider ➝ Admin
Select Filter Current Log
Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
Open the event details and confirm that the LocalPoliciesSecurityOptions setting was applied
Pro Tip
Match the event timestamp with the device's most recent Intune sync.
For deeper validation, you can confirm the effective setting directly on the device:
Open Local Security Policy (secpol.msc), then navigate to Local Policies ➝ Security Options
Locate Audit: Audit the use of Backup and Restore privilege and confirm it is set to Enabled
Remember that this setting only generates events when the Audit privilege use policy is also enabled. Once both are active, privilege use events appear in the Windows Security log during backup or restore operations.
If the policy is correctly applied, Windows will audit the use of the Backup and Restore privilege, ensuring that:
A security audit event is generated for privileged backup and restore operations
Privileged file activity is recorded and available for review
Security teams gain reliable evidence for monitoring and investigation
Why This Matters for Endpoint Security
Privileged access is one of the most sensitive areas in modern endpoint security, because it bypasses the controls that protect everything else.
Without visibility into how Backup and Restore privileges are used, attackers or malicious insiders can read or alter protected data while blending into routine administrative activity.
By enabling auditing of the Backup and Restore privilege through Microsoft Intune and validating the configuration locally, organizations ensure that:
Sensitive privileged operations are continuously recorded
Threat visibility across managed endpoints is significantly improved
Forensic readiness is strengthened through reliable audit evidence
Endpoints are more resilient against privilege abuse and insider threats
This configuration provides strong security value without disrupting standard user workflows when properly validated and deployed.
Key Takeaway
Effective endpoint security depends on visibility into the most powerful actions on a system.
By enabling auditing of the Backup and Restore privilege through Microsoft Intune, organizations ensure that sensitive privileged operations are consistently recorded across all managed devices.
Combined with centralized deployment and proper client-side validation, this policy helps transform endpoint security into a more resilient, controlled, and trustworthy environment.
And in modern security architecture, auditing privileged operations is not optional, it is essential.
More Information
For additional technical details, refer to the official Microsoft documentation below:
https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-monitor
https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Thank you for reading!
🖥️ Ricardo Barbosa
🎖️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect | 💼 Technology Director at Altelix.com