Error "Access is denied" when backing up files and folders on Windows

What it means

"Access is denied" means the Windows account that runs the backup can't read some of the files you selected. The Magnus Box Application runs backups as a service account, not as the logged-in user. That account can read normal local files, but it can't see everything the user can.

Find the cause

Open the job log (Users > [user] > Job History > [job]) and look at the paths that failed.

The paths are on a mapped drive or network share (for example Z:\ or \\server\share). This is the most common cause. Mapped drives belong to the logged-in user, so the backup service can't see them. Go to Accessing Windows network shares and UNC paths and follow the steps there.
The paths are local but in a protected location, such as another user's profile folder or a folder with custom permissions. Continue below.
The error says backup-tool.exe couldn't be launched. That's usually antivirus blocking the app, not a file permission. See Antivirus detects Magnus Box as a virus or malware.

Fix access to local protected folders

Choose the option that grants the least extra access.

Option 1: Grant the service account read access to the folder

Right-click the folder > Properties > Security > Edit > Add.
Enter NT SERVICE\backup.delegate and click Check Names, then OK.
Give it Read & execute and click OK.
Run the backup again.

Option 2: Run the backup service as a different account

Open Services (services.msc).
Double-click Magnus Box (delegate service). On a white-labeled install it shows your brand name.
On the Log On tab, choose This account and enter an account that can read the files. On a domain controller, it has to be a domain account.
Click OK, restart the service, and run the backup again.

Only give the service the access it needs. A service account with broad admin rights is a bigger risk if the device is ever compromised.

Still stuck?

If you're sure the files are local and the service account can read them, email support@magnusbox.com with the username, device name, the job's date and time, and one or two of the failing paths.