UBS Knowledge Base
UBS Knowledge Base
Breadcrumbs

Troubleshooting Guide: SQL Server Backup “Access is Denied” (Error 5)

This section provides steps to resolve the error: “Cannot open backup device... Operating system error 5 (Access is denied)”. This error occurs when the SQL Server service account lacks the necessary NTFS permissions to write the backup file (.bak) to the specified destination folder.

Step 1: Identify the SQL Server service account

SQL Server performs backups using its own service identity, not the identity of the logged-in Windows user. Identify this account first.

  1. Press Windows Key + R, type services.msc, and press Enter.

  2. Locate the service: SQL Server (MSSQLSERVER), or the specific SQL Server instance name.

  3. Check the Log On As column.

  4. Common accounts include NT Service\MSSQLSERVER, NetworkService, LocalSystem, or a specific domain user, such as DOMAIN\sql_svc.

  5. Note this account name exactly.

Step 2: Grant folder permissions

Once the service account is identified, grant it Modify or Full Control permissions on the destination folder.

  1. Open File Explorer and navigate to the folder where the backup is failing, for example on the D: drive.

  2. Right-click the folder and select Properties.

  3. Select the Security tab and click Edit....

  4. Click Add....

  5. In the “Enter the object names to select” box, type the exact account name found in Step 1.

  6. Tip: If using a local service account like NT Service\MSSQLSERVER, ensure the Location is set to the local computer name, not the network domain.

  7. Click Check Names to verify, then click OK.

  8. In the “Permissions for...” list, select the account and check the box for Modify.

  9. Click Apply and OK.

Step 3: Verify inheritance and file attributes

If the error persists, check for existing file locks, read-only files, or restricted inheritance.

  1. Check for read-only files: ensure there is not an existing backup file in the folder with the same name that is marked as read-only.

  2. To check this, right-click the file, select Properties, then untick Read-only.

  3. Verify inheritance: in the folder Properties > Security tab, click Advanced.

  4. Ensure the SQL Server service account is listed and the Applies to column says This folder, subfolders and files.

  5. If it does not, click Change permissions, select the account, click Edit, and update the Applies to dropdown.

Step 4: Troubleshooting network or UNC paths

If backing up to a network share, such as \\Server\Share\, additional checks are required.

  1. Service account type: local accounts like NT Service\MSSQLSERVER or LocalSystem often cannot authenticate across a network.

  2. Recommendation: if backing up to a network location, the SQL Server service should ideally run under a domain user account that has permissions on both the local server and the network share.

  3. Share permissions: ensure the account has Change permissions at the share level, in addition to NTFS permissions at the folder level.