Operating System Error 5 on Backup: Fix Access Denied

Operating system error 5 means Windows refused SQL Server access to a folder or a file. The account that failed isn’t you. It is the account the SQL Server service runs under. That’s why a backup can fail on a machine where you are an administrator.

What the Message Says

The failure arrives as two messages. Message 3201 says SQL Server couldn’t open the backup device. It ends with the operating system’s own words: error 5, access denied. Message 3013 only says that the backup ended abnormally. The number that matters is the one in the first message. Operating system error 5 is a permission problem. Other numbers point to other causes, as the last sections show.

To reproduce it, the first script creates a small database named BackupAccessDemo. The second one backs it up into the Windows folder. The service account can’t write there on a normal machine.

IF DB_ID(N'BackupAccessDemo') IS NULL CREATE DATABASE BackupAccessDemo;

BACKUP DATABASE BackupAccessDemo TO DISK = N'C:\Windows\BackupAccessDemo.bak';

Msg 3201, Level 16, State 1, Line 1
Cannot open backup device 'C:\Windows\BackupAccessDemo.bak'. Operating system error 5(Access is denied.).
Msg 3013, Level 16, State 1, Line 1
BACKUP DATABASE is terminating abnormally.

Find the Account That Needs Access

The SQL Server service opens the backup file, not you. Windows checks the permissions of the account the service runs as. Your own rights don’t count, even if you are the machine’s administrator. Setup gave that account rights to the default backup folder. Every folder you choose yourself needs a grant. If the reproduction below succeeds, the service has more rights than it should. Delete C:\Windows\BackupAccessDemo.bak and read this section on accounts.

One query names the account. It reads the service list from a DMV, and it needs the permission to view server state.

SELECT servicename, service_account FROM sys.dm_server_services WHERE servicename LIKE N'SQL Server (%';

On this test server the instance is named SQLDEV, so the account carries that name. A default instance shows NT Service\MSSQLSERVER, and a server set up with a domain account shows that account. Copy the value exactly. You need it in the next step.

Grant the Folder Permission

Open File Explorer, right-click the backup folder and choose Properties. On the Security tab, choose Edit, then Add. Type the service account’s full name, such as NT SERVICE\MSSQL$SQLDEV, and click Check Names. Give it Modify and click OK. Modify lets the account create, overwrite and delete the backup files. It doesn’t need Full Control.

The command line does the same in one line. Run it from an elevated PowerShell. The single quotes stop PowerShell from reading the dollar sign in the account name. The flags make the permission apply to the files and folders inside as well.

icacls 'D:\SqlBackups' /grant 'NT SERVICE\MSSQL$SQLDEV:(OI)(CI)M'

In a Command Prompt, use double quotes instead of single quotes. Run the command on the backup folder, not on a single file, so tomorrow’s backups work too. A folder under a user profile fails with error 5 until the account has Modify. After the grant, the same backup succeeds.

Choose the folder with care. A backup folder on the same disk as the data files survives a deleted database. It doesn’t survive a failed disk. Put backups on another disk or a network location, and grant the account there.

When It Isn’t Error 5

Two look-alike failures send people to the wrong fix. A folder that doesn’t exist gives error 3, which Windows words as the system cannot find the path. A mapped drive letter does the same. You mapped the drive in your own session, and the service can’t see it. This statement fails the first way.

BACKUP DATABASE BackupAccessDemo TO DISK = N'C:\NoSuchFolderDemo\BackupAccessDemo.bak';

Msg 3201, Level 16, State 1, Line 1
Cannot open backup device 'C:\NoSuchFolderDemo\BackupAccessDemo.bak'. Operating system error 3(The system cannot find the path specified.).
Msg 3013, Level 16, State 1, Line 1
BACKUP DATABASE is terminating abnormally.

For a network share, use the full path that starts with two backslashes and the server name. A virtual or local service account reaches the share as the computer’s own account. Give that account Modify on the share and on the folder behind it. Or run the service under a domain account that has it.

Pointing BACKUP at a folder instead of a file name also fails with operating system error 5. That mistake is common when a path is copied without its file name. The same errors appear on RESTORE. The service account must read the backup folder, and it must write to the folder that holds the data files.

Check That It Works

Back up to a file name with no folder. The file lands in the default backup folder, where the account already has rights. Then read it back.

BACKUP DATABASE BackupAccessDemo TO DISK = N'BackupAccessDemo_ok.bak' WITH CHECKSUM, INIT;
GO
RESTORE VERIFYONLY FROM DISK = N'BackupAccessDemo_ok.bak' WITH CHECKSUM;

The check prints a message that the backup set on file 1 is valid. The permission problem is gone, and the file is readable. You could argue for a quick fix. Run the service as a local administrator, or give Everyone full control. Both work, and both are wrong. They give every query that SQL Server runs a wider reach than it needs.

What to Remember

Read the number in message 3201. Operating system error 5 means permissions. Error 3 means the path. The account is the one the service runs under. Find it with sys.dm_server_services, grant it Modify on the backup folder, and test with a real backup.

When you finish with the demo, run the cleanup script. Then remove BackupAccessDemo_ok.bak from your default backup folder yourself, because SQL Server doesn’t delete backup files.

USE master;
GO
IF DB_ID(N'BackupAccessDemo') IS NOT NULL
BEGIN
    ALTER DATABASE BackupAccessDemo SET SINGLE_USER WITH ROLLBACK IMMEDIATE;
    DROP DATABASE BackupAccessDemo;
END;
EXEC msdb.dbo.sp_delete_database_backuphistory @database_name = N'BackupAccessDemo';

Access denied is not a problem with your login, it is a problem with the account the service runs as.

Published by Pinal Dave on SQLAuthority. More of my work at pinaldave.com.