Re: Backing up a Windows AD DC with samba-tool

It is perfectly safe to backup a shutdown AD, as long as it is a single entity.
If it is more than one then you shut down the "slaves" first ,then the current "master" & back them all up. (the master goes down last, so it stays the master for timestamps)

Then restart the master (time sync) then slaves , so it just looks like a network outage.
To restore you MUST shut them all down and restore them all ,or things will break very very very badly (timestamps will be all over the place)

I generally do this once a week for the last  8 years.

And I have done several test restores as well as at least one  full 3 site recovery and it was fine.
It only goes bad if you try and get smart.

The first issue you will have , is with a restore, that the clocks are "bad" and on initial restore the certs issued to clients are bad, until the times all sync
(keeping in mind that if it is a VM, it's gonna screw with your network clocks , so its better to pull the network cables, until it catches up.)

It's not something you should be doing  randomly, for recovery from small changes.
Get the master up first, ideally off the network if it's being used as a time server (which it should be anyway...)



On 6/4/2026, 2:33 AM, "samba on behalf of Peter Milesson via samba" <[email protected] <mailto:[email protected]> on behalf of [email protected] <mailto:[email protected]>> wrote:


Hi folks,


Is it possible to back up a Windows 2022 AD DC with samba-tool? And how 
could I restore it, if it's possible?


Running "sudo samba-tool domain backup online --targetdir=/home/<some 
user>/<backupdir> --server=DC1.mydomain.talps -UAdministrator" gives me 
2 compressed archives, one with the domain data, and one with sysvol 
information.


The reason I ask is, that backing up the domain of a AD DC under Windows 
take ages, while the Samba version finishes within a few seconds.


Best regards,


Peter




-- 
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba <https://lists.samba.org/mailman/options/samba>



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba