reg save HKLMSECURITY (ERROR: Access is denied.)

I have a user in a domain who is a member of the Backup Operators group. When using Windows’ native reg command to save a remote domain controller’s SAM and SYSTEM hives, it does so successfully:

PS C:Users...> reg save \DC-1HKLMSAM C:SAM
The operation completed successfully.
PS C:Users...> reg save \DC-1HKLMSYSTEM C:SYSTEM
The operation completed successfully.
PS C:Users...> dir \DC-1C$


    Directory: \DC-1C$


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----        22/12/2025     12:10                inetpub
d-----        08/05/2021     09:20                PerfLogs
d-r---        13/04/2026     15:54                Program Files
d-----        24/11/2025     18:25                Program Files (x86)
d-r---        17/03/2026     18:10                Users
d-----        21/02/2026     10:56                Windows
-a----        12/05/2026     18:39          49152 SAM
-a----        12/05/2026     18:39       18710528 SYSTEM

However, when attempting to save the SECURITY hive, reg reports an error message:

PS C:Users...> reg save \DC-1HKLMSECURITY C:SECURITY
ERROR: Access is denied.

Looking at process monitor on the target domain controller, I notice that the error occurs on the RegOpenKey operation, suggesting that reg fails to open the SECURITY hive, rather than saving it in the specified location:

process monitor output

I understand that members of the Backup Operators group are granted the ability to bypass the ACLs of securable objects and thus using a command like reg save, successfully backup an object such as the SYSTEM hive.

Why does this happen? Is there some other restriction I’m not aware of?

Note: The target domain controller is running Windows Server 2022 (10.0.20348 Build 20348).