How to access files on a mounted Recovery Point without having specific permissions (179061)

You need to restore some files from a mounted recovery point. You do not have NTFS permissions for the folder hosting them and it is unlikely that your account will be granted such permissions. However you have local administrator permissions on the core server. Since this is an issue likely to repeat on a regular basis, you need to set up a simple way for getting access to these files.

To gain access to the files to be restored, you need to impersonate an account that has NTFS permissions on the protected server. The prime candidate is the "NT Authority\System Account" as its SID (S-1-5-18) is the same for all windows protected servers. There are various ways to impersonate the "NT Authority\System" account.  Since AppAssure does not have such built in capabilities, third party free software needs to be used. One of the commonly used applications to achieve this is Sysinternals' PSEXEC.exe. It can be aquired by downloading the PSTOOLS suite of utilities from https://technet.microsoft.com/en-us/sysinternals/bb896649.aspx

Download and unzip PSTOOLS.zip. Identify PSEXEC.exe and copy it into a directory of your choice on the core.PSEXEC.exe is a command line application that does not require installation.

PSEXEC allows to launch some applications while impersonating the "NT Authority\System" account.

You can check if it is the case by opening a command prompt and running 

psexec.exe /i /s cmd.exe

A new DOS command box pops up. Entering whoami at the command prompt reveals that this DOS box runs as the "NT Authority\System" account.

The new issue is how to launch Windows Explorer under the "NT Authority\System". Although this is possible, it is a difficult task as the trying to launch Explorer as "NT Authority\System" into session 1 (current user session) results in Explorer exiting immediately and returning an error code of 1. This happens due to some new security features refering to Session 0, introduced in Windows 2008 and later. You can find out more about the Session 0 isolation here: https://msdn.microsoft.com/en-us/library/windows/hardware/dn653293(v=vs.85).aspx

As such, you need to find a third party replacement for Windows Explorer that would be used to access the files to be restored. There are quite a few file managers similar to windows Explorer. One free option that was tested for solving the issue raised by this KB is FreeCommander on Windows 2012 Server. The (free) 32 bit version may be downloaded from here: http://freecommander.com/en/downloads/

To launch freecommander under the "NT Authority\System" account, assuming that free commander was installed in the default location, run:

psexec.exe /s /i "C:\Program Files (x86)\FreeCommander XE\freeCommander.exe"

Note that, from FreeCommander, you have access to files and folders with restricted access, which can be accessed by the "NT Authority\System" account only.

You will get some error messages stating that the Desktop Folder could not be found. This is to be expected due to the specifics of the "NT Authority\System" account. Create the desktop folder using FreeCommander to remove the error messages.

To put everything back together in a workable manner:

1. Create a folder called C:\RPAccess

2. Copy PSEXEC.exe to C:\RPAccess

3. Install FreeCommander to C:\RPAccess\FC

4. Create .bat file called AccessMountedRP.bat in C:\RPAccess

5. Copy and paset the line below in the .bat file and save it.

C:\RPAccess\psexec.exe /s /i "C:\RPAccess\FC\freeCommander.exe"

6. Create a shortcut for AccessMountedRP.bat on your desktop.

7. Launch FreeCommander running as administrator the shortcut above.

8. Click OK through all the error messages ("could not find the Desktop folder" and similar) until FreeCommander comes up.

9. Create the Desktop Folder.

10. Exit and do #7 again.

All should be OK now and the files with particular permissions should be available for restore now.