I have a domain with about 15 users and a single Windows Server 2008 domain controller. Some recent issues with my RAID controller have made me reconsider how I go about securing the AD data.

Currently I run a System State Backup nightly. However, it seems that it is impossible (or at least difficult and unsupported) to restore that to any other machine than the one from which it was taken.

Adding a second DC to the domain seems expensive and overkill for such a small network.

Is there no other way to backup the AD data?


System State contains the AD. Since System State restores to different hardware is unsupported by MS (as you've found), you're kind of out of luck.

You could:

  1. Do a full backup and restore to different hardware- that should contain AD and be supported.
  2. You could do LDIFDE or CSVDE exports and then reimport those into a new domain. But you'll have to rebuild all of your file permissions for your fileshares.
  3. You could use a commercial backup product that can do a system state restore to different hardware.

My recommendation

  1. Install a second DC. It's almost irresponsible not to. You don't need server-class hardware - for small businesses, I recommend just installing Server on a decent desktop.
  • 1
    I see your point about a second DC, but a proper backup is still needed... – Rob Moir Jan 12 '11 at 16:16
  • 2
    Of course it is - absolutely. If it's his only server, it's got all his company's data too. None of my suggestions are "instead of backups". But a second DC means he doesn't have to worry about trying to do a restore of System State to dissimilar hardware just to have another copy of AD, which is what he is asking about. – mfinni Jan 12 '11 at 16:34
  • 1
    +1 for suggesting a second DC. Doing a full DR of AD on top of a DR of a file server is a pain. Having a second DC isn't backup (so it doesn't help w/ accidental deletion, corruption, etc), but it does help with restoring from catastrophic failure. – Evan Anderson Jan 12 '11 at 17:41
  • 2
    Well, you'll also lose account passwords, and have to rejoin all the workstations to the new domain, and migrate everyone's profile on their local machine - about 15 users? That'll be a few days' worth of work. – mfinni Jan 14 '11 at 11:52
  • 1
    Even if they did, I don't believe the SIDs will mean anything in a new domain. Might be worth investigating anyway, just for academic curiosity - but it's really not a standard practice to do this that way. You need good backups of your AD, and you should really have a second DC. Period. – mfinni Jan 14 '11 at 15:33

Shadowprotect! It's awesome! Image backups. You can set a schedule to take an incremental backup as often as every 15 minutes. If your server crashes, just take your backups to any other computer, install virtualbox on it, then spin up one of your backups as a virtual machine. The time needed to spin up a virtual machine...about 60 seconds...

When you get new hardware in, it has a universal restore option so you can restore it to dissimilar hardware.

  • 2
    It does look pretty cool, but at $1000 to solve this particular issue I could buy another copy of Server 2008 and deploy on a virtual machine as a secondary DC. – John Hall Jan 14 '11 at 8:43

I think virtualization would take care of the problem of restoring your system state on a different system, I would look into virtualizing your current enviroment and also I think having a second Domain Controller is a must these days.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.