Need help with GPO user rights: SMS migration failing with "Privilege Not Held"

John Wilson 20 Reputation points
2026-09-03T19:03:40.2633333+00:00

I'm trying to run the SMS migration tasks during our cutover. I'm in the orchestrator. I go to start the migration tasks. This is what it comes back as

error: Privilege Not Held

Upon investigation, the SMS orchestrator service account lacks the SeBackupPrivilege and SeRestorePrivilege rights on the target servers.

How do we grant user rights assignments via GPO? we weren't getting this specific permission error before.

Windows for business | Windows 365 Enterprise
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. VPHAN 42,425 Reputation points Independent Advisor
    2026-09-03T19:38:03.5333333+00:00

    Hi John Wilson,

    Inside this directory, locate the policy named "Back up files and directories", which serves as the graphical equivalent of the missing SeBackupPrivilege. Double-click to define the policy settings and add your SMS orchestrator service account. It is critical that you also manually add the default Administrators and Backup Operators groups alongside your service account; because Group Policy overwrites local settings, failing to include these default groups will strip domain administrators of their native backup capabilities on those servers. Next, locate the "Restore files and directories" policy, which represents the missing SeRestorePrivilege, and add the exact same service account and default groups. Once you save the policy, log into the target servers and run "gpupdate /force" in an elevated Command Prompt to immediately apply the newly assigned privileges and allow your migration tasks to run successfully.

    VPHAN

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.