A computer-implemented method, comprising: saving (302;502), during backup or replication activity to a database, a plurality of user accounts belonging to an access control group associated with a machine on a host system, the machine having at least image level backup stored on a backup server; receiving (304;504;702) a restoration request (206;402) from the host system, the restoration request including a first machine identifier and a user identifier of a user currently logged onto the machine, wherein the restoration request is configured to request access to the at least one image level backup; determining (306;506;704) whether the first machine identifier matches to a second machine identifier associated with the machine present in the at least one image level backup; accepting (310;512;716) or denying (308;508;706) the restoration request based at least in part on the determination of whether the first machine identifier matches the second machine identifier; writing an authentication cookie to a location within a file system of the machine accessible to at least the user; issuing, to the machine on the host system, a prompt to provide the authentication cookie; denying the restoration request if no authentication cookie is received within a predetermined time interval; and if an authentication cookie is received within the predetermined time interval, accepting the restoration request if the received authentication cookie matches the written authentication cookie; and denying the restoration request if the received authentication cookie does not match the written authentication cookie. saving (302;502), during backup or replication activity to a database, a plurality of user accounts belonging to an access control group associated with a machine on a host system, the machine having at least image level backup stored on a backup server; receiving (304;504;702) a restoration request (206;402) from the host system, the restoration request including a first machine identifier and a user identifier of a user currently logged onto the machine, wherein the restoration request is configured to request access to the at least one image level backup; determining (306;506;704) whether the first machine identifier matches to a second machine identifier associated with the machine present in the at least one image level backup; accepting (310;512;716) or denying (308;508;706) the restoration request based at least in part on the determination of whether the first machine identifier matches the second machine identifier; writing an authentication cookie to a location within a file system of the machine accessible to at least the user; issuing, to the machine on the host system, a prompt to provide the authentication cookie; denying the restoration request if no authentication cookie is received within a predetermined time interval; and if an authentication cookie is received within the predetermined time interval, accepting the restoration request if the received authentication cookie matches the written authentication cookie; and denying the restoration request if the received authentication cookie does not match the written authentication cookie. accepting the restoration request if the received authentication cookie matches the written authentication cookie; and denying the restoration request if the received authentication cookie does not match the written authentication cookie.