What Does an Active Directory Backup Include?

A System State backup of a Domain Controller protects
important components required to recover Active Directory and the operating
system.

• Active Directory Domain Services (AD DS)
• NTDS.DIT
• SYSVOL
• Windows Registry
• Boot files
• Other system-state components

Microsoft recommends System State backup as an important method for
protecting Active Directory Domain Services data.

Before You Start

Before creating the backup, make sure you have:

• A Windows Server Domain Controller
• Appropriate administrator or backup permissions
• Windows Server Backup installed
• A dedicated backup destination
• The DSRM Administrator password
• Enough storage for the backup
• A documented recovery procedure

Step 1: Install Windows Server Backup

Windows Server Backup can be installed through Server Manager or
PowerShell.

Using Server Manager

1. Open Server Manager.
2. Select Manage.
3. Click Add Roles and Features.
4. Continue through the wizard.
5. Select Windows Server Backup under Features.
6. Complete the installation.

Using PowerShell

Install-WindowsFeature Windows-Server-Backup

Step 2: Create an Active Directory System State Backup

Open Server Manager → Tools → Windows Server Backup.

1. Select Local Backup.
2. Click Backup Once.
3. Select Different options.
4. Click Next.
5. Select Custom.
6. Click Next.
7. Click Add Items.
8. Select System State.
9. Click OK.

Step 3: Select the Backup Destination

Choose a backup destination that is separate from the Domain Controller.
For example:

E:\

You can also use a network share:

\\BackupServer\ADBackups

Select the destination, review the configuration, and click
Backup.

Step 4: Verify the Backup

Never assume that a backup is usable simply because the backup job
completed successfully.

Use the following command to list available backup versions:

wbadmin get versions

To check a specific backup destination:

wbadmin get versions -backuptarget:E:

For a network share:

wbadmin get versions -backuptarget:\\BackupServer\ADBackups

Record the appropriate Version identifier. You may need
it during the recovery process.

Step 5: Create a System State Backup Using WBADMIN

You can also create a System State backup directly from an elevated
Command Prompt.

wbadmin start systemstatebackup -backuptarget:E:

For a network backup destination:

wbadmin start systemstatebackup -backuptarget:\\BackupServer\ADBackups

Step 6: Understand the Two Types of Active Directory Restore

Non-Authoritative Restore

A non-authoritative restore is commonly used when a
Domain Controller needs to be restored or rebuilt while other healthy
Domain Controllers are still available.

For example:

After DC01 is restored, it can synchronize current Active Directory
information from its replication partners.

Authoritative Restore

An authoritative restore is used when restored Active
Directory data needs to become authoritative and replicate to other
Domain Controllers.

Step 7: Boot the Domain Controller into DSRM

Directory Services Restore Mode (DSRM) is used for certain Active
Directory recovery operations.

From an elevated Command Prompt:

bcdedit /set safeboot dsrepair

Restart the server:

shutdown /r /t 0

The server will restart into Directory Services Restore Mode.
You will need the DSRM Administrator password.

Step 8: Identify the Backup Version

After entering DSRM, list the available backups:

wbadmin get versions -backuptarget:E:

You may see a version similar to:

08/15/2026-01:00

Select the backup version that is appropriate for your recovery scenario.

Step 9: Perform a Non-Authoritative Restore

A typical System State recovery command looks like this:

wbadmin start systemstaterecovery -version:08/15/2026-01:00

If the backup is stored on a network share:

wbadmin start systemstaterecovery ^
-version:08/15/2026-01:00 ^
-backupTarget:\\BackupServer\ADBackups ^
-machine:DC01

Step 10: Restore SYSVOL When Required

SYSVOL is an important part of a Domain Controller because it contains
Group Policy-related data and logon scripts.

In certain forest recovery scenarios, an authoritative SYSVOL restore
may be required.

wbadmin start systemstaterecovery ^
-version:08/15/2026-01:00 ^
-authsysvol

Step 11: Return the Server to Normal Boot

After the recovery is complete, remove the DSRM boot option:

bcdedit /deletevalue safeboot

Then restart the server:

shutdown /r /t 0

Step 12: Verify Active Directory

After the Domain Controller starts normally, verify its health and
replication status.

Check Domain Controller Health

dcdiag

Check Replication Summary

repadmin /replsummary

Check Detailed Replication

repadmin /showrepl

Check SYSVOL and NETLOGON

net share

You should normally see:

NETLOGON
SYSVOL

Also verify:

• User authentication
• DNS functionality
• Active Directory replication
• Group Policy processing
• Domain Controller health
• Critical applications

What If Only a User Was Deleted?

A full System State restore is not always necessary when an individual
Active Directory object has been deleted.

If Active Directory Recycle Bin is enabled, deleted
objects can often be restored without performing a complete Domain
Controller recovery.

Get-ADObject -Filter 'Name -Like "*User*"' `
-IncludeDeletedObjects |
Restore-ADObject

Recommended Active Directory Backup Strategy

For production environments, avoid relying on a single backup copy.

Most importantly, regularly test your recovery process in an isolated
environment.

A backup that has never been tested is not a proven recovery plan.

Common Active Directory Backup Mistakes

1. Only Backing Up NTDS.DIT

Do not treat the NTDS.DIT file as a standalone Active
Directory backup strategy.

2. Keeping the Only Backup on the Domain Controller

If the Domain Controller and its storage fail, a backup stored on the
same system may be lost as well.

3. Using Authoritative Restore Unnecessarily

Authoritative recovery can affect replication throughout the domain.
Use it only when the recovery scenario requires it.

4. Forgetting the DSRM Password

The DSRM password may be required during Domain Controller recovery.

5. Never Testing Restoration

A successful backup job does not automatically mean that the recovery
process will work when you need it.

6. Ignoring SYSVOL

Active Directory and SYSVOL are both critical components of a healthy
Domain Controller environment.

Active Directory Backup & Restore Command Reference

Final Thoughts

Active Directory recovery is about more than simply creating a backup.
You need a documented and tested recovery process.

In most Domain Controller rebuild scenarios, a
non-authoritative System State restore is the appropriate
approach when healthy replication partners remain.

Authoritative recovery should be reserved for situations where restored
Active Directory data or SYSVOL needs to become authoritative.

For individual deleted users or groups, Active Directory Recycle
Bin may provide a much simpler recovery option than restoring
an entire Domain Controller.