Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a domain with about 15 users and a single Windows Server 2008 domain controller. Some recent issues with my RAID controller have made me reconsider how I go about securing the AD data.

Currently I run a System State Backup nightly. However, it seems that it is impossible (or at least difficult and unsupported) to restore that to any other machine than the one from which it was taken.

Adding a second DC to the domain seems expensive and overkill for such a small network.

Is there no other way to backup the AD data?

share|improve this question
up vote 3 down vote accepted

System State contains the AD. Since System State restores to different hardware is unsupported by MS (as you've found), you're kind of out of luck.

You could:

  1. Do a full backup and restore to different hardware- that should contain AD and be supported.
  2. You could do LDIFDE or CSVDE exports and then reimport those into a new domain. But you'll have to rebuild all of your file permissions for your fileshares.
  3. You could use a commercial backup product that can do a system state restore to different hardware.

My recommendation

  1. Install a second DC. It's almost irresponsible not to. You don't need server-class hardware - for small businesses, I recommend just installing Server on a decent desktop.
share|improve this answer
I see your point about a second DC, but a proper backup is still needed... – RobM Jan 12 '11 at 16:16
Of course it is - absolutely. If it's his only server, it's got all his company's data too. None of my suggestions are "instead of backups". But a second DC means he doesn't have to worry about trying to do a restore of System State to dissimilar hardware just to have another copy of AD, which is what he is asking about. – mfinni Jan 12 '11 at 16:34
+1 for suggesting a second DC. Doing a full DR of AD on top of a DR of a file server is a pain. Having a second DC isn't backup (so it doesn't help w/ accidental deletion, corruption, etc), but it does help with restoring from catastrophic failure. – Evan Anderson Jan 12 '11 at 17:41
Well, you'll also lose account passwords, and have to rejoin all the workstations to the new domain, and migrate everyone's profile on their local machine - about 15 users? That'll be a few days' worth of work. – mfinni Jan 14 '11 at 11:52
Even if they did, I don't believe the SIDs will mean anything in a new domain. Might be worth investigating anyway, just for academic curiosity - but it's really not a standard practice to do this that way. You need good backups of your AD, and you should really have a second DC. Period. – mfinni Jan 14 '11 at 15:33

Shadowprotect! It's awesome! Image backups. You can set a schedule to take an incremental backup as often as every 15 minutes. If your server crashes, just take your backups to any other computer, install virtualbox on it, then spin up one of your backups as a virtual machine. The time needed to spin up a virtual machine...about 60 seconds...

When you get new hardware in, it has a universal restore option so you can restore it to dissimilar hardware.

share|improve this answer
It does look pretty cool, but at $1000 to solve this particular issue I could buy another copy of Server 2008 and deploy on a virtual machine as a secondary DC. – John Hall Jan 14 '11 at 8:43

I think virtualization would take care of the problem of restoring your system state on a different system, I would look into virtualizing your current enviroment and also I think having a second Domain Controller is a must these days.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.