Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In one site there are 3 domain controllers. There are an additional 3 domain controllers for 3 remote sites.

My question: Is there any reason why you should still backup Active Directory?

If one of the domain controllers fails, you could deploy another server and allow it to replicate with the others.

share|improve this question
up vote 20 down vote accepted

Absolutely. What happens if someone does something silly and deletes all the accounts, or deletes a critical OU, or does a mass-reset of some attribute with a script and gets it wrong?

You might just actually restore the state of the AD to some previous point in time. This is know as an Authoritative Restore.

Usually a full backup is not required to get the AD data. The Active Directory is part of a System State backup. You probably don't need to backup every single domain controller, to get a good backup of the AD you only really should have to backup one of the Domain controllers. If you require event log data or other things that are only on an individual server, then you might want to get that.

People also commonly install other services like DHCP on domain members. You will almost certainly want to be able to recover that. If you only have 3 servers I suspect this is true in your case. It seems likely that you have some other seemingly minor services also running on those boxes. You will want to back those up as well if you don't have them replicated somewhere else.

share|improve this answer
+1 Changes [even bad ones] made by a Domain Admins aren't second-guessed by the DCs, they'll just dutifully replicate them for you. No reason to tempt fate, just make backups and be happy if you never need to restore them to production. – jscott Mar 1 '12 at 0:37
+1 - I once accidentally disabled every single account in our domain, including my own and all other administrators (don't ask), you need these backups! – Matt Mar 1 '12 at 0:43
Excellent points on the mistakes that are made in AD. The question popped in my head when having a discussion about the redundancy around DCs - which doesn't even apply to changes made within AD. – Rowell Mar 1 '12 at 0:51
+1 for all the stupid mistakes that none of us have ever made ;) – Robin Gill Mar 1 '12 at 1:24
I never make stupid mistakes. They're "Active Learning Experiences." – Bart Silverstrim Mar 1 '12 at 5:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.