Fix SQL Server error 3201: operating system error 5 (access denied)

This error means SQL Server could not create or open the backup file because Windows refused access. The fix is almost always to give the SQL Server service account write permission on the folder. Your own permissions do not matter here.

The error

Msg 3201, Level 16, State 1, Line 1
Cannot open backup device 'D:\Backups\Sales.bak'. Operating system error 5(Access is denied.).
Msg 3013, Level 16, State 1, Line 1
BACKUP DATABASE is terminating abnormally.

The same error appears on restore when SQL Server cannot read the .bak file.

Why your permissions are not the point

When you run BACKUP DATABASE, the SQL Server service writes the file, under its own Windows account. You might be a local administrator, but the service is not. So the question is: can the service account write to that folder?

Step 1: find the service account

SELECT servicename, service_account
FROM sys.dm_server_services;

Typical results:

Step 2: grant write access to a local folder

From an administrator command prompt (change the account and path to match yours):

icacls "D:\Backups" /grant "NT Service\MSSQLSERVER":(OI)(CI)M

(OI)(CI) makes the permission apply to files and subfolders created later. M is Modify, which covers creating, writing and deleting backup files. In the GUI, do the same from the folder's Properties > Security > Edit > Add. Type the account name exactly, with the location set to the local computer.

Step 3: for a network share, grant the computer account

Built-in virtual accounts such as NT Service\MSSQLSERVER reach the network as the server's computer account, DOMAIN\SQLSERVER01$. Grant that account:

• Share permissions: Change (or Full Control).
• NTFS permissions on the target folder: Modify.

Without a domain, computer accounts cannot be used. Run SQL Server under a named local account, create the same user name and password on the NAS, and grant it access there. Always use a UNC path (\\nas\backups), never a mapped drive letter.

Other operating system errors with 3201

Avoid the root of C:

Backing up directly to C:\ is blocked for most service accounts, and a backup on the system disk is a poor idea anyway. Use a dedicated folder on another disk, set up once with the right permissions, and point every job there.