9

In one site there are 3 domain controllers. There are an additional 3 domain controllers for 3 remote sites.

My question: Is there any reason why you should still backup Active Directory?

If one of the domain controllers fails, you could deploy another server and allow it to replicate with the others.

21

Absolutely. What happens if someone does something silly and deletes all the accounts, or deletes a critical OU, or does a mass-reset of some attribute with a script and gets it wrong?

You might just actually restore the state of the AD to some previous point in time. This is know as an Authoritative Restore.

Usually a full backup is not required to get the AD data. The Active Directory is part of a System State backup. You probably don't need to backup every single domain controller, to get a good backup of the AD you only really should have to backup one of the Domain controllers. If you require event log data or other things that are only on an individual server, then you might want to get that.

People also commonly install other services like DHCP on domain members. You will almost certainly want to be able to recover that. If you only have 3 servers I suspect this is true in your case. It seems likely that you have some other seemingly minor services also running on those boxes. You will want to back those up as well if you don't have them replicated somewhere else.

  • 3
    +1 Changes [even bad ones] made by a Domain Admins aren't second-guessed by the DCs, they'll just dutifully replicate them for you. No reason to tempt fate, just make backups and be happy if you never need to restore them to production. – jscott Mar 1 '12 at 0:37
  • 2
    +1 - I once accidentally disabled every single account in our domain, including my own and all other administrators (don't ask), you need these backups! – Matt Mar 1 '12 at 0:43
  • Excellent points on the mistakes that are made in AD. The question popped in my head when having a discussion about the redundancy around DCs - which doesn't even apply to changes made within AD. – Rowell Mar 1 '12 at 0:51
  • 2
    +1 for all the stupid mistakes that none of us have ever made ;) – Robin Gill Mar 1 '12 at 1:24
  • 2
    I never make stupid mistakes. They're "Active Learning Experiences." – Bart Silverstrim Mar 1 '12 at 5:37

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.