When your NAS backup fails with a permissions error, it usually does not fail quietly. You will see messages like “Access is denied,” “You do not have permission to access \\NAS\Backup,” “0x80070005 Access Denied,” or “Failed to create backup – Destination permission error” in Windows File History, Windows Backup, Mac Time Machine, or third-party tools like Veeam Agent, Acronis, or Synology Active Backup. The backup job may start, copy a few files, then abort, or it may not even list the NAS share as a valid destination. Sometimes you can browse the NAS in File Explorer but cannot write, delete, or overwrite files there.
This is not a wait-and-see error. If scheduled backups cannot write to the NAS, you have no current restore point, and version history stops accumulating. Leave it unfixed and the next drive failure or ransomware event will leave you with an outdated backup. The good news is that most NAS permissions errors are caused by stale credentials, mismatched share and file-system permissions, or ownership conflicts after a Windows reinstall, and they can be fixed without reformatting the NAS or losing data. As of early 2026, Windows 11 23H2 and 24H2 have tightened default SMB guest access, which has made these errors more common after updates.
Likely Causes
| Cause | How to confirm | Fix difficulty |
|---|---|---|
| Stale or mismatched Windows credentials for the NAS | Credential Manager shows old password; NAS log shows repeated authentication failures for your user | Easy |
| NAS share-level permissions block write access | You can read but not create files in \\NAS\share; DSM/QTS share permissions show Read Only for your user/group | Easy |
| NTFS/ACL file permissions and ownership mismatch | Security tab shows Unknown account (S-1-5-21…) as owner; Effective Access shows Deny for your user | Moderate |
| Inheritance broken or explicit Deny rule on backup folder | Advanced Security shows inheritance disabled or a Deny entry for Everyone or Authenticated Users | Moderate |
| Antivirus or ransomware protection blocking network writes | Backup works when protection is paused; Controlled Folder Access or antivirus log shows blocked network process | Moderate |
| SMB guest access disabled or SMB1/SMB signing mismatch | Error 0x80004005 or “You can’t access this shared folder because your organization’s security policies block unauthenticated guest access” | Advanced |
Fix 1: Re-authenticate to the NAS With Correct Credentials
What causes it
Windows caches the first username and password you use for a NAS. If you changed the NAS password, changed your Windows Microsoft account password, or first connected with a guest or different local user, every backup attempt reuses the wrong cached credentials and gets rejected as a permissions error even though the share itself is fine.
How to check
Press Win + R, type \\YOUR-NAS-NAME or \\YOUR-NAS-IP and press Enter. If it prompts for credentials or opens but shows access denied when you try to create a new folder, credentials are suspect. Open Control Panel > User Accounts > Credential Manager > Windows Credentials. Look under Windows Credentials for an entry for your NAS name or IP. Check the NAS logs: Synology DSM > Log Center > Logs, or QNAP QTS > System Logs > System Event Logs, and filter for Connection or Authentication failures for your backup user around the time of the backup.
What to do
In Credential Manager, select the NAS entry and click Remove. Restart the PC. Press Win + R, type \\YOUR-NAS-IP\Backup and press Enter. When prompted, check Remember my credentials and enter the dedicated NAS backup user in the format NASNAME\username or IP\username, not just username, and the current password. Test write access by right-clicking inside the share > New > Text Document and deleting it. Then re-run the backup job. In your backup software, re-enter the destination path as \\YOUR-NAS-IP\Backup and re-authenticate there as well. For Windows File History: Settings > System > Storage > Advanced storage settings > Backup options > See advanced settings > Select drive > Add network location.
How to undo it
Open Credential Manager > Windows Credentials > Add a Windows credential. Re-add the previous entry with Address as your NAS name or IP, User name as the old value, and Password as the old password, or click Remove on the new entry and reboot to clear the cache again.
Fix 2: Take Ownership and Reset Folder Ownership on Windows
What causes it
If you reinstalled Windows, moved drives from another PC, or restored a NAS backup folder from an external disk, the folder owner is still the old Windows SID like S-1-5-21-xxx. Your new Windows account, even with the same name, is a different security principal and has no rights until you take ownership.
How to check
On the affected backup folder on the NAS mapped drive (for example Z:\Backups\FileHistory), right-click > Properties > Security > Advanced. Look at Owner at the top. If it shows Unable to display current owner, Account Unknown, or a different user, ownership is the problem. Click Effective Access > Select a user > type your Windows username > View effective access to confirm you have no Write or Modify rights.
What to do
Map the NAS share first if needed: File Explorer > This PC > Map network drive > Drive Z: > Folder \\YOUR-NAS-IP\Backup > check Reconnect at sign-in and Connect using different credentials. Then right-click the backup folder > Properties > Security > Advanced > Change next to Owner > type your Windows username > Check Names > OK > check Replace owner on subcontainers and objects > Apply. After ownership changes, still in Advanced Security, click Add > Select a principal > your username > Type: Allow > Applies to: This folder, subfolders and files > check Full control > OK. Check Replace all child object permission entries with inheritable permission entries from this object, then Apply. Allow the propagation to complete before testing the backup.
How to undo it
Return to Properties > Security > Advanced > Change owner and set it back to the original owner name shown previously, such as Administrators or the dedicated NAS service account. Uncheck Replace owner on subcontainers and objects and click Apply. If you enabled Replace all child object permission entries, you will need to restore permissions from a previous backup or manually reapply the NAS default ACLs.
Fix 3: Correct Share Permissions on the NAS Itself
What causes it
NAS devices have two permission layers: share permissions and file-system ACLs. Even if file permissions look correct, a share permission set to Read Only will block every write from the network regardless of what Windows shows. This happens after creating a new share with default read-only settings or after changing DSM/QTS user group assignments.
How to check
Log into the NAS web UI. On Synology DSM 7: Control Panel > Shared Folder > select your Backup share > Edit > Permissions. On QNAP QTS 5: Control Panel > Shared Folders > Shared Folders > select share > Edit Shared Folder Permission. Look at the row for your backup user and the group it belongs to. If it shows Read Only or No Access, or if Custom shows Deny for Create files/folders, that is the block. Also check Control Panel > User & Group > User > Edit > Permissions to confirm group-level Deny is not overriding an Allow.
What to do
In the NAS Permissions window, set your dedicated backup service account, for example backup_svc, to Custom or Read/Write. Click Custom and ensure Create files/folders, Create folders/append data, Write attributes, and Delete are checked. Remove any Deny entries for that user or for the Everyone group on that share. Click Save. For Synology, also go to Control Panel > Shared Folder > Advanced > check Enable advanced share permissions if you use them, then re-check the advanced entries. Trigger a test backup immediately without changing anything else to isolate the result.
How to undo it
Return to the same Shared Folder > Permissions screen and set the user back to Read Only or No Access, and re-add any Deny entries you removed. Click Save. No data is deleted by changing this setting back.
Fix 4: Fix NTFS ACLs, Inheritance, and Explicit Deny Entries Inside the Backup Folder
What causes it
On NTFS-formatted NAS volumes or when using Advanced ACLs on ext4/Btrfs NAS shares, a broken inheritance chain or a single explicit Deny for Authenticated Users, Everyone, or SYSTEM will override all Allows. Backup tools running as SYSTEM or as your user then get Access Denied even though share permissions are Read/Write.
How to check
In Windows, right-click the backup folder on the mapped NAS drive > Properties > Security > Advanced. Check if Enable inheritance is shown as a button, which means inheritance is currently disabled, and look for any row where Type = Deny. Click Effective Access > Select a user > enter the account that runs the backup. For Windows Backup, that is SYSTEM. For File History and most third-party tools, it is your logged-in user. Click View effective access and see if Write or Create folders is marked with a red X.
What to do
In Advanced Security, click Enable inheritance if it appears, then select Convert inherited permissions into explicit permissions when prompted if you want to keep current explicit entries. If a Deny entry exists that you did not intentionally create, select it > Remove. Then click Add > Select a principal > type SYSTEM > Allow > Applies to: This folder, subfolders and files > check Full control > OK. Repeat for Administrators and for your backup user. Check Replace all child object permission entries with inheritable permission entries from this object only if you are comfortable overwriting subfolder custom ACLs, then Apply. Keep the Advanced Security window open until the progress bar completes. On Synology, also open File Services > SMB > Advanced > check Enable advanced permissions checking if available, then inspect File Station > right-click Backup folder > Properties > Permission > check ACL entries there.
How to undo it
In Advanced Security, click Disable inheritance > Remove all inherited permissions from this object, then manually re-add the previous Allow and Deny entries exactly as they were, or click Restore defaults if the NAS share offers it. If you checked Replace all child object permissions, restore the previous ACL state from a NAS snapshot: Synology DSM > Control Panel > Shared Folder > Snapshots > Recovery, or QNAP > Storage & Snapshots > Snapshot.
Fix 5: Clear Blocked Access From Antivirus, Controlled Folder Access, and Firewall
What causes it
Windows Security Controlled Folder Access, Bitdefender, Norton, Avira, and other endpoint tools treat sustained network writes to a NAS as suspicious ransomware behavior and silently block them. The backup engine then reports a permissions error because the OS denied the write at the process level.
How to check
Open Windows Security > Virus & threat protection > Manage ransomware protection. If Controlled folder access is On, click Protection history and look for Blocked actions involving FileHistory.exe, wbengine.exe, System, or your backup tool executable trying to access \\YOUR-NAS-IP. For third-party antivirus, open its Protection History or Blocked Applications log and filter for the last backup attempt time. Do a quick test: temporarily set Controlled folder access to Off and pause third-party protection for 10 minutes, then run a manual backup of a small folder of 50 MB. If it succeeds with protection off, you have found the blocker.
What to do
Turn Controlled folder access back to On, then click Allow an app through Controlled folder access > Add an allowed app > Recently blocked apps > select FileHistory.exe located at C:\Windows\System32\FileHistory.exe, wbengine.exe at C:\Windows\System32\wbengine.exe, and your backup tool exe such as C:\Program Files\Veeam\Veeam Agent\VeeamAgent.exe or C:\Program Files\Acronis\TrueImageHome\TrueImage.exe > Add. Next, go to Windows Security > Firewall & network protection > Allow an app through firewall > Change settings > ensure File and Printer Sharing is checked for Private network. In your third-party antivirus, open Settings > Exceptions or Allow List > Add Folder > Z:\ or \\YOUR-NAS-IP\Backup and Add Process > your backup exe. Re-enable protection and test again.
How to undo it
Go back to Windows Security > Manage ransomware protection > Controlled folder access > Allow an app through Controlled folder access > select the app you added > Remove. In Firewall > Allow an app through firewall, uncheck File and Printer Sharing for Private if you had enabled it. In your antivirus, remove the folder and process exceptions you added and re-enable any protection you paused.
Fix 6: Force SMB Signing, Disable Guest Fallback, and Re-map the Drive Correctly
What causes it
Current Windows defaults disable insecure guest logons for SMB. If your NAS share allows guest access or your mapping was created with net use without credentials, Windows will try guest, get rejected, and return Access Denied or error 0x80070035 Network path not found. An SMB version mismatch between NAS set to SMB1 only and Windows requiring SMB2 or higher causes the same symptom.
How to check
Open an elevated Command Prompt: press Win + X > Terminal (Admin) > type gpedit.msc if you have Windows Pro, or run regedit for Home. Check Local Group Policy Editor > Computer Configuration > Administrative Templates > Network > Lanman Workstation > Enable insecure guest logons. If it is Not Configured or Disabled, guest access is blocked. In the NAS UI, go to File Services > SMB > Advanced > Minimum SMB protocol and Maximum SMB protocol. If Minimum is set to SMB1 or NT1 and Maximum is SMB1, it is outdated. In Command Prompt, run net use and see if your NAS mapping shows status OK with a blank user or Guest.
What to do
On the NAS, set File Services > SMB > Advanced > Minimum SMB protocol to SMB2 and Maximum to SMB3, and click Apply. Do not leave SMB1 enabled. On Windows, disconnect the bad mapping: open Command Prompt as Administrator > net use Z: /delete > net use \\YOUR-NAS-IP\IPC$ /delete. Then create a clean mapping with explicit credentials: net use Z: \\YOUR-NAS-IP\Backup /persistent:yes /user:NASNAME\backup_svc YourPasswordHere. If you use Windows Pro and need a lab-only guest share, set Enable insecure guest logons to Enabled, run gpupdate /force, and reboot, but prefer authenticated shares for backups. Also verify Date and Time are synchronized: Settings > Time & language > Date & time > Set time automatically On, because Kerberos and SMB authentication fail if the NAS and PC clocks differ by more than five minutes.
How to undo it
Run net use Z: /delete and remap without the /user switch to return to your prior method. In Group Policy, set Enable insecure guest logons back to Not Configured and run gpupdate /force. On the NAS, set Minimum and Maximum SMB protocol back to their previous values and click Apply.
Fix 7: Reset Read-Only Attributes and Folder Flags on the Backup Destination
What causes it
A backup folder marked Read-only or with the System attribute from a prior backup set can cause new backup jobs to fail when they try to create or rotate files inside it. This is common after copying a FileHistory or WindowsImageBackup folder between drives with File Explorer or robocopy without the correct flags.
How to check
Open Command Prompt as Administrator. Type attrib “Z:\Backups” and press Enter. If it shows R for Read-only or S for System on the folder, and attrib “Z:\Backups\*” shows many files with R, the attribute is set. Also right-click the folder > Properties > General > check if Read-only is checked or filled. Try creating a file inside: right-click > New > Text Document. If you get You need permission to perform this action with no UAC prompt, attribute plus ACL combination is likely.
What to do
In elevated Command Prompt, run attrib -R -S “Z:\Backups” /S /D to clear Read-only and System recursively, then run icacls “Z:\Backups” /reset /T /C /Q to reset ACLs to inherited defaults if you have already fixed ownership in Fix 2 and share permissions in Fix 3. Wait for both commands to finish. Do not interrupt them. After completion, run attrib “Z:\Backups” again to confirm R and S are gone, then manually create and delete a test file in the folder. Re-run the backup job from its native scheduler: for File History click Run now, for Windows Backup click Back up now, for Veeam Agent click Backup Now.
How to undo it
To restore the previous flags, run attrib +R “Z:\Backups” /S /D or attrib +S “Z:\Backups” if the folder originally had them. For ACLs, there is no single undo after icacls /reset, so restore from the NAS snapshot or from Properties > Security > Advanced > Restore defaults, then reapply the ownership and permissions you documented before the change.
If Nothing Works
If all fixes still leave Access Denied, isolate whether the issue is the PC, the user, or the NAS. Create a brand new share on the NAS: DSM > Control Panel > Shared Folder > Create > name it Backup_Test, give only your backup_svc user Read/Write and no other users access, and disable Recycle Bin for the test. Create a brand new local Windows user: Settings > Accounts > Other users > Add account > I don’t have this person’s sign-in information > Add a user without a Microsoft account, then map the new share as that user with net use T: \\YOUR-NAS-IP\Backup_Test /user:NASNAME\backup_svc. If that works, your original share ACL is corrupted and should be recreated and data migrated with rsync on the NAS rather than Windows copy.
Next, test with NAS logs and Windows Event Viewer side by side. On Windows, open Event Viewer > Windows Logs > System and Application and filter for source srv, mrxsmb, or backup engine errors at the exact backup time. On the NAS, enable detailed SMB logging: Synology DSM > Log Center > Archiving > Enable SMB transfer logs, or QNAP > System Logs > Enable. Compare the error codes. If you see STATUS_LOGON_FAILURE or STATUS_ACCESS_DENIED in the NAS log despite correct credentials, reset the NAS user password to a 12-16 character alphanumeric password without special characters like & or % that can be mishandled in net use, then update Credential Manager and the backup job. As a last resort, back up the NAS configuration, update DSM/QTS and Windows to the latest stable build, and re-join the NAS to the workgroup or domain if it is domain-joined, because a broken domain trust also surfaces as a permissions error.
FAQ
Why can I open the NAS share but my backup still says access denied?
Browsing uses read permission and often succeeds with cached or guest credentials, while backups need write, modify, and delete. Share permissions, NTFS ACLs, and antivirus blocks are separate checks that only trigger on write. Re-authenticate with a dedicated Read/Write service account, verify the NAS share permission is Read/Write, and check the folder Security > Advanced > Effective Access for Write for the exact account that runs the backup, which may be SYSTEM rather than your user.
Should I use Everyone Full Control to fix NAS permissions quickly?
Do not. Granting Everyone Full Control exposes every file on that share to any device on your network and to any malware running as any user, including ransomware. Create a single purpose backup_svc account on the NAS, give that account Read/Write on only the Backup share, and use a strong, unique password for that account in Credential Manager and in the backup job. Remove Everyone and Guest from the share permissions entirely.
Will resetting permissions delete my existing backups?
Changing share permissions, ownership, or clearing Read-only attributes does not delete files. However, checking Replace all child object permission entries with inheritable permission entries and running icacls /reset will overwrite custom ACLs on every subfolder and file, which can make older backup versions inaccessible until permissions are corrected again. Before bulk changes, create a NAS snapshot: Synology > Snapshot Replication > Snapshot > Take Snapshot, or QNAP > Storage & Snapshots > Snapshot > Take Snapshot, so you can revert.
How do I stop this error from returning after the next Windows update?
Use a static IP or DHCP reservation for the NAS so the Credential Manager entry does not stale, always map with net use /persistent:yes /user:NASNAME\backup_svc, and keep Minimum SMB protocol at SMB2 or higher on the NAS. After major Windows updates, open Credential Manager and confirm the NAS credential still exists, verify Date & time > Set time automatically is On, and run a manual test backup of a small folder before the next scheduled run. Store the backup_svc password in a password manager so you can re-enter it exactly when prompted.
