Backing Up in Windows as a Non-Administrative User

3. To run a TSM backup from an account belonging to the Backup Operators group (XP, 2003, Vista, 7, 2008, 2008R2, 8)

Of the two possible methods of backing up Windows from a non-administrative account, this is the only one that will work in Windows Vista or higher (except that it does not work in Vista Home, which lacks the Backup Operators administrative group). Please see additionally Backing up Windows Vista and higher as a non-administrative user on this topic.
Add the account to the Backup Operators group.
Ensure that the account has Write rights on the TSM Installation folder C:\Program Files\Tivoli\TSM\baclient\.
Ensure that the Backup Operators group has the following rights (via [Administrative Tools] > [Local Security Policy] > [Local Policies] > [User Rights Assignment]):
```
Back up files and directories
Restore files and directories
Manage auditing and security logs
```
Note that by default, this group does not have the last of these rights (Manage auditing and security logs), and so it should explicitly be given this.
This account should now be able to back up all files local to the machine. However, some Windows system objects such as Active Directory still require administrative priviledges to perform backups.

Note that as a consequence of running TSM as a non-administrative user, you will be prompted for the TSM password irrespective of the setting of the PasswordAccess to Generate in the configuration file. This is because the account will not have rights to access the encrypted TSM password in the Registry.

The README notes from Tivoli on this subject are reproduced in the following document on access rights.

IT Services

Backing Up in Windows as a Non-Administrative User