Re: Backing up a Windows AD DC with samba-tool

On Wed, 8 Apr 2026 10:49:28 +0200
Peter Milesson via samba <[email protected]> wrote:

> 
> On 4/8/26 7:23 AM, Rowland Penny via samba wrote:
> > On Wed, 8 Apr 2026 03:18:09 +0000
> > itdept_head via samba <[email protected]> wrote:
> >
> >> It is perfectly safe to backup a shutdown AD, as long as it is a
> >> single entity. If it is more than one then you shut down the
> >> "slaves" first ,then the current "master" & back them all up. (the
> >> master goes down last, so it stays the master for timestamps)
> >>
> >> Then restart the master (time sync) then slaves , so it just looks
> >> like a network outage. To restore you MUST shut them all down and
> >> restore them all ,or things will break very very very badly
> >> (timestamps will be all over the place)
> >>
> >> I generally do this once a week for the last  8 years.
> >>
> >> And I have done several test restores as well as at least one
> >> full 3 site recovery and it was fine. It only goes bad if you try
> >> and get smart.
> >>
> >> The first issue you will have , is with a restore, that the clocks
> >> are "bad" and on initial restore the certs issued to clients are
> >> bad, until the times all sync (keeping in mind that if it is a VM,
> >> it's gonna screw with your network clocks , so its better to pull
> >> the network cables, until it catches up.)
> >>
> >> It's not something you should be doing  randomly, for recovery from
> >> small changes. Get the master up first, ideally off the network if
> >> it's being used as a time server (which it should be anyway...)
> > First, there is no concept of master and slaves in AD, all DC are
> > equal and hold the same AD database, it is just that there also the
> > FSMO roles and they can be on any DC.
> >
> > You should not backup an individual DC, what you actually backup is
> > the AD database and this can be backed up on any DC and you can do
> > it while the DC is running.
> >
> > You should only require such a backup in the event of a total DC
> > failure, that is if you have no DCs left running. If an individual
> > DC dies, you should demote it (forcibly if required) and replace it
> > with another one.
> >
> > Rowland
> >
> Hi Rowland,
> 
> A live domain backup for disaster recovery is what I'm interested in.
> If I could use samba-tool, even if the domain is on Windows DCs, that
> would be great. I don't use Exchange and other M$ dinosaurs, so it's
> really the domain structure, users, computers, and a few GPOs that I
> want to have backed up.

The problems with backing up a Windows domain with Samba-tool are:

Does it work ? I do not know, never tried.

How would you use the resultant backup to restore a Windows domain ? I
suppose you could possibly use it to create a Samba domain, join a
Windows server to the domain and then demote the Samba DC, but again, I
have never tried this.
 
> 
> Thanks for clarify (for the nth time), that all DCs are equal ;-)

I keep saying this, but people keep referring to 'master' and 'slaves'
;-)

Rowland



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba