Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With 389-ds I can export my entire directory using db2ldif and import it into a new directory server using ldif2db without any issues; even in catastrophic failure situations.

Now, the question is with Active Directory; can I do the same thing without taking a full system backup? I want to backup the directory and that's it. Would stopping all AD services, and copying the NTDS files be sufficient?

share|improve this question
I've never met anyone who had to actually do a restore who regretted doing too much work on their backups. I've met lots of people who regretted trying to do clever stuff like this, though. This is a really bad idea. – RobM Apr 23 '12 at 5:28
Why would you want to do that? Backing up system state doesn't take up a lot of backup space. System state doesn't backup everything! – Bryan Apr 23 '12 at 7:01

This is a terrific idea! Terrifically bad!

You'll need to backup your registry, SYSVOL folder, Ntds.dit, Edb.chk, Edb*.log, Res1.log and Res2.log. Oh, but that's not all! If there are other domain controllers in the domain you'll have to worry about non-authoritative versus authoritative restores. Just try doing that without a proper, "Microsoft Sanctioned" backup.

Let's Have Some Fun!

Since no one should ever consider their backups to be good enough until they've performed a fully functioning restoration, you go ahead and back up your Active Directory the way that you proposed above. Then, try and restore it. Tell us how it went.

I mean, you'll be performing full test restorations anyway, right?

We'll wait for your return.

share|improve this answer
Thanks for clarifying this; one reason why our company will not use AD. Microsoft really should have made it more modular. – jersten Jun 27 '12 at 15:54
AD is very modular, you need the right support modules to make it work however. Which is what system state covers. It's <1GB, I'm really not sure why you're trying to mess with individual files. – Chris S Jun 27 '12 at 17:28
@user973917 Obviously, that's your decision to make, but if taking a system state backup is too much, then maybe you just shouldn't have computers at all. – MDMarra Jun 27 '12 at 17:34
@MDMarra, if I had to take a system state backup for MySQL... Postfix... Dovecot... SSH... ahh forget it. Speaking of which, AD is an LDAP based system from Microsoft. I should be able to easily dump the db for a backup. Which btw, what is done with OpenLDAP; I do not have to take entire system dump/image to have a 'stable' restore. Of course, this is one reason why our hosting company does not use Microsoft in anyway shape or form. – jersten Jul 1 '12 at 23:35
You can certainly dump the database with ldifde. There's nothing stopping you from doing that. However, doing a system state backup allows for an authoritative restore. Unlike OpenLDAP which has a master node and slave nodes, AD uses multi-master peers which changes things a little. Honestly, it sounds like you have an anti-MS bias and are looking for an excuse to bash them. Taking a system state backup takes under 1 minute in most cases. It's less complex than backing up any other app you mentioned. Just because it's not what you're used to doesn't mean there's anything wrong with it. – MDMarra Jul 1 '12 at 23:46

Why not just use the built-in backup utility to do a backup of the system state? That will get all the key files that you need. It's not a full system backup, and it shouldn't be too large.

share|improve this answer
wbadmin in server 2008 + – Mark Henderson Apr 23 '12 at 6:16
Ooh, I missed the tag. Thanks! – Bigbio2002 Apr 23 '12 at 6:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.