Re: Backing up a Windows AD DC with samba-tool

On Wed, 8 Apr 2026 03:18:09 +0000
itdept_head via samba <[email protected]> wrote:

> 
> It is perfectly safe to backup a shutdown AD, as long as it is a
> single entity. If it is more than one then you shut down the "slaves"
> first ,then the current "master" & back them all up. (the master goes
> down last, so it stays the master for timestamps)
> 
> Then restart the master (time sync) then slaves , so it just looks
> like a network outage. To restore you MUST shut them all down and
> restore them all ,or things will break very very very badly
> (timestamps will be all over the place)
> 
> I generally do this once a week for the last  8 years.
> 
> And I have done several test restores as well as at least one  full 3
> site recovery and it was fine. It only goes bad if you try and get
> smart.
> 
> The first issue you will have , is with a restore, that the clocks
> are "bad" and on initial restore the certs issued to clients are bad,
> until the times all sync (keeping in mind that if it is a VM, it's
> gonna screw with your network clocks , so its better to pull the
> network cables, until it catches up.)
> 
> It's not something you should be doing  randomly, for recovery from
> small changes. Get the master up first, ideally off the network if
> it's being used as a time server (which it should be anyway...)

First, there is no concept of master and slaves in AD, all DC are equal
and hold the same AD database, it is just that there also the FSMO
roles and they can be on any DC.

You should not backup an individual DC, what you actually backup is the
AD database and this can be backed up on any DC and you can do it
while the DC is running.

You should only require such a backup in the event of a total DC
failure, that is if you have no DCs left running. If an individual DC
dies, you should demote it (forcibly if required) and replace it with
another one.

Rowland

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba