Re: Backing up a Windows AD DC with samba-tool

On 4/8/26 7:23 AM, Rowland Penny via samba wrote:
> On Wed, 8 Apr 2026 03:18:09 +0000
> itdept_head via samba <[email protected]> wrote:
>
>> It is perfectly safe to backup a shutdown AD, as long as it is a
>> single entity. If it is more than one then you shut down the "slaves"
>> first ,then the current "master" & back them all up. (the master goes
>> down last, so it stays the master for timestamps)
>>
>> Then restart the master (time sync) then slaves , so it just looks
>> like a network outage. To restore you MUST shut them all down and
>> restore them all ,or things will break very very very badly
>> (timestamps will be all over the place)
>>
>> I generally do this once a week for the last  8 years.
>>
>> And I have done several test restores as well as at least one  full 3
>> site recovery and it was fine. It only goes bad if you try and get
>> smart.
>>
>> The first issue you will have , is with a restore, that the clocks
>> are "bad" and on initial restore the certs issued to clients are bad,
>> until the times all sync (keeping in mind that if it is a VM, it's
>> gonna screw with your network clocks , so its better to pull the
>> network cables, until it catches up.)
>>
>> It's not something you should be doing  randomly, for recovery from
>> small changes. Get the master up first, ideally off the network if
>> it's being used as a time server (which it should be anyway...)
> First, there is no concept of master and slaves in AD, all DC are equal
> and hold the same AD database, it is just that there also the FSMO
> roles and they can be on any DC.
>
> You should not backup an individual DC, what you actually backup is the
> AD database and this can be backed up on any DC and you can do it
> while the DC is running.
>
> You should only require such a backup in the event of a total DC
> failure, that is if you have no DCs left running. If an individual DC
> dies, you should demote it (forcibly if required) and replace it with
> another one.
>
> Rowland
>
Hi Rowland,

A live domain backup for disaster recovery is what I'm interested in. If 
I could use samba-tool, even if the domain is on Windows DCs, that would 
be great. I don't use Exchange and other M$ dinosaurs, so it's really 
the domain structure, users, computers, and a few GPOs that I want to 
have backed up.

Thanks for clarify (for the nth time), that all DCs are equal ;-)

Best regards,

Peter



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba