|© 2001 − 2021, Dr. Jürgen Rathlev|
Since version 5.8 Personal Backup contains the utility program PbStarter.
This can be used to run backups under a user account different
from that of the logged-on user. You will find the utility in the Windows start menu
as Personal Backup - Backup under different account. The purpose of
this program is to provide additional protection against malware
that maliciously encrypts a user's data including the backed-up files and
demands a ransom in return for the decryption key (so-called
The best way to protect your backed-up data is to use a backup directory where all logged-on users only have read permissions in that any program started under their user account cannot write into the directory containing the backed-up data and hence nothing can be changed there. To achieve this, a new user account must be created via Windows Control Panel. This new account will only be used to perform backups and is the only account that can write to the backup directory. No other activities should be performed under this account.
Important prerequisite: To adjust the permissions of the backup directory, it is essential that the drive or the drive partition that holds the backup directory is formatted in NTFS (Windows default). The FAT32 file system often used for USB sticks will not allow permissions to be to changed.
To run a program under a different user account, you can use the Windows console application RunAs, but it cannot save passwords and requires an entry of the password on starting each backup. In addition, compiling the desired configuration is a difficult task even for experts. In contrast, PbStarter can save the required password as an encrypted string which will enable any user to start a secure backup even without knowing this password. Entering the password is only done once during backup configuration by an authorized user. In addition, by providing a graphical interface, the configuration of backups becomes clear and easy.
Before you can use this procedure, some prerequisites will be necessary. To make this comprehensible to any layman, it will be described step by step as follows. Bear in mind that there are some minor differences between Windows versions 7, 8 and 10. Particularly in Windows 10 Home several settings, like allocating users to local groups, are not available. For this purpose at least the Pro version is required.
The following has been compiled carefully, but the author assumes no responsibility for the topicality, correctness, completeness or quality of the information provided. Every user should be aware of the risks involved in changing system settings. Liability claims against the author whether material or non-material caused by the use of the information provided shall be rejected.
Unfortunately, the user account initially created during Windows installation
is automatically granted administrator rights by default. However, for
all normal activities on your computer (mail, Internet, text
processing, image processing, etc.), this is not required at all.
In fact, it is no problem to install new programs or change system settings
even if you are logged on as a normal user. As soon as elevated rights are required,
Windows User Access Control will pop up automatically and prompt for a temporary
logon as Administrator.
Therefore, it is strongly recommended that only those rights needed to carry out their tasks be assigned to users. These can be separated into three groups:
Following this concept, some initial adjustments to user accounts are necessary:
As described above, write access to the backup directory must be blocked
for all standard users except the special backup user. In addition, it must be
ensured that the backup user has read permissions to all directories to be
Important note: The drive containing the backup directory must be formatted in NTFS (Windows default). The FAT32 file system often used on USB sticks does not support security settings.
To understand the procedure, it is important to know that permissions of a parent directory are automatically passed to all its child objects (files and subdirectories). Assuming that a new directory is created on drive F:, e.g. F:\Backup, it will inherit all permissions from its parent directory F:\. You can check this yourself by right-clicking on the new directory and selecting Properties and the Security tab. In the upper part of the dialog window, all users and groups having permissions on this directory are displayed and, in the lower part, the permissions assigned to the selected user or group can be seen (grayed out because inherited). A group contains several users to simplify the assignment of permissions. The permission displayed refers to all users in the group.
Using this program, several backup tasks previously configured with Personal Backup can be arranged as a group. Apart from this, each group contains the credentials of the user account under which the backups are to be performed (e.g. the BackupUser mentioned above). Clicking the button Start backup, all backup tasks in the selected group will be performed using the account of the specified user. The tasks are processed in the order as specified by the list or optionally in parallel. In addition, you can select how the status window will be displayed during backups and if the program should prompt for the password on each start of a backup or save it permanently as an encrypted string. Optionally, you can specify that the backups will be run as an administrator. In this case the Windows User Access Control will prompt for an elevation of user privileges (e.g. to use Volume Shadow Copies).
After starting the program for the first time, all fields (see screenshot on the right)
are initially empty. At first enter a unique name for the group to be created
in the description field. At the top right insert the name of the user account
under which the backups are to be performed. By clicking the button to the right,
the associated password can be entered to be permanently saved as an encrypted string.
If no fixed password is specified, it must be entered on each start of the backups
by the user. Optionally, you can specify to run the backups with elevated right as
administrator. This is, for example, required if
Volume Shadow Copies (VSS)
are used for the backup.
Then select the backup tasks (buj files) for this group by clicking the button on the left beneath the list field. Notice the important notes below.
Short description of the buttons:
Creating a new group
Delete selected group
Add backup tasks
Remove a backup task
Edit the selected backup task
Show the log file of the selected backup task
Change the order of the backup tasks
On the right,
In the field to the bottom left,
The group properties will be saved automatically on closing the program or
starting a backup. By clicking the small arrow to the right of the description field
you can switch between different groups.
Clicking the third button from the left at the bottom will open a dialog (shown on the right) for creating a Desktop shortcut to start selected backup groups with one double click under the associated user accounts. You can combine this with a subsequent action (e.g. Shutdown). In this way it is very easy to run a secure backup before shutting down the computer. No longer use the Windows function Start menu - Shutdown: instead double-click this Desktop icon!
The required settings can be made in a dialog (see screenshot). The list on the
left shows all configured backup groups. Select the groups to be run from
the Desktop shortcut by click and Ctrl-click. On the right you can select
the action to be performed after the backups have finished (see more).
is selected, the backups will not start immediately after clicking the Desktop
shortcut but rather the user will be prompted beforehand to select the subsequent action.
In this way, it is very easy to start a secure backup under a different account and
decide in each case what should happen afterwards (e.g. hibernate, poweroff
or even continue).
Optionally, you can specify that all running programs of the logged-on user should be terminated prior to the backup and that a log file should be written. After clicking OK, the desktop shortcut will be created.
Create a new task: Clicking this button, will add several selected backup groups to the Windows Task Scheduler to be started automatically for a time schedule. The group selection and other settings are done similar to the Desktop shortcut (see above). Next, you insert the name for the task and the time schedule. (see here).
Edit a task: Clicking this button will show a list of all tasks using
PbStarter. Select a task and click the button Edit task
to modify the associated time schedule.
If PbStarter was started using the Windows Task Scheduler or a desktop shortcut (see above), an own log file will be created. It will record start and end times, all executed backup groups with their backup tasks and whether errors occurred (e.g. if a running program could not be terminated or Personal Backup could not be started). Clicking this button will display the log. If there happened errors during backup, detailed information can be retrieved from the log of the particular task (see above).
As described above, the logged-on user cannot write or make changes to the backup directory.
By clicking this button, a selectable file manager, e.g.
and additionally any other application, e.g. a text editor such as
will be started under the displayed user account. Using the application(s) started in this
way the user will be able to make required changes in the backup directory.
Note: Windows Explorer cannot be started in this way.
All Backup tasks to be executed must be located in a directory to which the backup user can write. For this, it is recommended that a new subdirectory (e.g. F:\Backup\Tasks) be created in the backup directory (see above: F:\Backup) and all required buj files be copied there. The same applies to log files. To access these files easily, it is useful to create another subdirectory F:\Backup\Logs and enter this name in the group configuration (see above).
Because there are some pitfalls in this procedure, the following guide will help the user understand how to start backups under a different user account using Windows Task Scheduler.