# Should the backup system have separate admin accounts?

Yes. If the same domain administrator account that runs everything else can also delete backups, then an attacker who steals that one account controls both your systems and your way back. Give the backup system its own administrator accounts that are not members of the main domain or directory, protect them with multi-factor authentication, preferably phishing-resistant, and use them only from a dedicated management workstation. Service accounts that the backup software uses to read data from servers should have only the rights they need, and their passwords should be long, unique and stored safely. Where the backup product supports it, require a second person to approve deleting backups or shortening retention, often called four-eyes approval. Review who has backup admin rights at least twice a year and whenever someone leaves. These steps cost little and close one of the gaps ransomware attackers exploit most often.

FAQ: [Backups and recovery](https://netsenx.com/en/faq/backups) · https://netsenx.com/en/faq/should-backup-admin-accounts-be-separate

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [How long should we keep backups?](https://netsenx.com/en/faq/how-long-should-backups-be-kept)
- [Should backups be encrypted?](https://netsenx.com/en/faq/should-backups-be-encrypted)
- [How do we protect backup servers on the network?](https://netsenx.com/en/faq/how-to-protect-backup-servers-on-the-network)
- [What is the difference between a backup plan and a disaster recovery plan?](https://netsenx.com/en/faq/difference-between-a-backup-plan-and-a-disaster-recovery-plan)
- [How should we back up virtual machines and hypervisors?](https://netsenx.com/en/faq/how-to-back-up-virtual-machines-and-hypervisors)