Sharing temporary files between users - sql-server

Question

I am building a web application deployment script in PowerShell, and for one task I am trying to create and restore a database from a Sql-Server backup file.
The files end up being in the user's desktop, so when I instruct Sql-Server to restore it, it complains with an 'Access is denied.' error when reading the backup.
RESTORE DATABASE [Acme] FROM DISK = 'C:\Users\matthew\Desktop\my-database.bak' WITH REPLACE
Responds with
Msg 3201, Level 16, State 2, Line 2
Cannot open backup device 'C:\Users\matthew\Desktop\my-database.bak'. Operating system error 5(Access is denied.).
Moving the file to a publicly accessible area like C:\Temp works, as indicated in the following answer: Why can't I read from .BAK files on my Desktop using SQL Express in Windows Authentication Mode
However, C:\Temp is not a standard Windows temp directory. Since I am using PowerShell, I am leveraging .NET libraries, such as using GetTempPath. This ends up pointing to
C:\Users\matthew\AppData\Local\Temp
which still has the same permission problem.
Is there a standard way to get a temporary directory that any local user can access?
EDIT: to clarify, the user matthew and the user that is restoring the backup are different.

Answer 1

It's not uncommon to create a folder C:\Temp as a system-wide temp directory. For a backup/restore scenario you just need a folder that's accessible by both the backup and the restore user, be it a custom folder, a built-in public folder like C:\Users\Public\Documents, or adjusted permissions on a userprofile.
However, from a security point of view it's probably a good idea to create a dedicated folder (e.g. C:\backup) to which only the required users have access, e.g. like this:
$backupDir = 'C:\backup'
$backupUser = 'DOMAIN\userA'
$restoreUser = 'DOMAIN\userB'
function New-Ace {
[CmdletBinding()]
Param(
[Parameter(Mandatory=$true)]
[string]$User,
[Parameter(Mandatory=$true)]
[string]$Access
)
New-Object Security.AccessControl.FileSystemAccessRule ($User, $Access,
'ObjectInherit, ContainerInherit', 'None', 'Allow')
}
$dir = New-Item -Type Directory $backupDir
$acl = Get-Acl -Path $dir
$acl.SetAccessRuleProtection($true, $false)
$acl.AddAccessRule((New-Ace -User $backupUser -Access 'Modify'))
$acl.AddAccessRule((New-Ace -User $restoreUser -Access 'Read'))
$acl | Set-Acl -Path $dir