Re: Backing up a Windows AD DC with samba-tool

On 4/8/26 11:42 AM, itdept_head via samba wrote:
>
> On 8/4/2026, 4:50 PM, "samba on behalf of Peter Milesson via samba" <[email protected] <mailto:[email protected]> on behalf of [email protected] <mailto:[email protected]>> wrote:
>
>
>
>
> On 4/8/26 7:23 AM, Rowland Penny via samba wrote:
>> On Wed, 8 Apr 2026 03:18:09 +0000
>> itdept_head via samba <[email protected] <mailto:[email protected]>> wrote:
>>
>>> It is perfectly safe to backup a shutdown AD, as long as it is a
>>> single entity. If it is more than one then you shut down the "slaves"
>>> first ,then the current "master" & back them all up. (the master goes
>>> down last, so it stays the master for timestamps)
>>>
>>> Then restart the master (time sync) then slaves , so it just looks
>>> like a network outage. To restore you MUST shut them all down and
>>> restore them all ,or things will break very very very badly
>>> (timestamps will be all over the place)
>>>
>>> I generally do this once a week for the last 8 years.
>>>
>>> And I have done several test restores as well as at least one full 3
>>> site recovery and it was fine. It only goes bad if you try and get
>>> smart.
>>>
>>> The first issue you will have , is with a restore, that the clocks
>>> are "bad" and on initial restore the certs issued to clients are bad,
>>> until the times all sync (keeping in mind that if it is a VM, it's
>>> gonna screw with your network clocks , so its better to pull the
>>> network cables, until it catches up.)
>>>
>>> It's not something you should be doing randomly, for recovery from
>>> small changes. Get the master up first, ideally off the network if
>>> it's being used as a time server (which it should be anyway...)
>> First, there is no concept of master and slaves in AD, all DC are equal
>> and hold the same AD database, it is just that there also the FSMO
>> roles and they can be on any DC.
>>
>> You should not backup an individual DC, what you actually backup is the
>> AD database and this can be backed up on any DC and you can do it
>> while the DC is running.
>>
>> You should only require such a backup in the event of a total DC
>> failure, that is if you have no DCs left running. If an individual DC
>> dies, you should demote it (forcibly if required) and replace it with
>> another one.
>>
>> Rowland
>>
> Hi Rowland,
>
>
> A live domain backup for disaster recovery is what I'm interested in. If
> I could use samba-tool, even if the domain is on Windows DCs, that would
> be great. I don't use Exchange and other M$ dinosaurs, so it's really
> the domain structure, users, computers, and a few GPOs that I want to
> have backed up.
>
>
> Thanks for clarify (for the nth time), that all DCs are equal ;-)
>
>
> Best regards,
>
>
> Peter
>
>
> I should clarify a few things:
>
> "master" is where we generally make changes:
> "slave" is satellite offices.
> This is VM's
>
>   Going to disagree about the backup at any location.
>
> The AD's are not  perfectly synced in the real world, we can see delays of upto 5-10 minutes for changes to propagate... or in several cases... days.
> We have offices in some really distant locations with really flaky connections, and very strict government rules about what you can connect to (NTP) or equipment for time sync (GPS), No satellite ,no starlink...
>
> Tried just doing the database, and it always lead to problems, specifically because , we found it does not  deal with all aspects of the complete AD.
> GPO's etc.
>
> As regards "AD" all being the "same", only in a zero latency mind , yes they all have the same rights, and they can all do the same things, and in the ideal world they are identical but
> It's like saying all the identical twins called "bob" in different geolocated environments are the same.
>
> We don't have the luxury of cloud systems for storing the AD's nor the guaranteed uptime of connections, we operate in an environment where  many things  most people consider normal are considered outright illegal by the governments
> plus some farmer digging up a network connection can take 3 days to fix...
> So in our specific situation we require a very structured way of working, communication and systems are critical, because down time at a single location costs tens of thousands a day.
>
> Sadly...sometimes you cannot always get exactly what you want and you have to consider alternatives.
>
>
>
Hi itdpt_head,

Thanks for the clarification. We have completely different situations, 
and thus the solutions need to reflect that. I have got one domain, and 
a simple setup, changes not very frequent, and no remote offices. So I 
just want a simple solution for disaster recovery.

Best regards,

Peter


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba