Backing Up Domain Controllers

  • Article

 

It is important to back up your domain controllers to ensure their availability. Backing up a domain controller is like backing up a Microsoft® Exchange member server. The primary difference between backing up a domain controller and backing up an Exchange member server is that you do not have Exchange databases to consider when you back up a domain controller. The method that you use to back up your domain controller depends on the disaster recovery strategy you choose.

Backing Up the System State Data of a Domain Controller

When you use Backup to back up the System State data of a domain controller, you also back up the Active Directory® directory service database. To back up the System State data of a domain controller that is running Active Directory, you can use the same procedure as you would for a server that is not a domain controller. However, you must also back up additional files, such as the Active Directory database and log files, and all other files for the system components and services on which Active Directory depends.

The following Active Directory files are part of a System State data backup of a domain controller. By default, these files are located in the Active Directory folder in %SystemRoot%\Ntds.

Active Directory files to back up

File type Definition

Ntds.dit

The Active Directory database.

Edb.chk

The checkpoint file.

Edb*.log

The transaction log files; each file is 10 megabytes (MB).

Res1.log and Res2.log

The reserved transaction log files.

In addition to the System State data, you must also back up the Microsoft Windows® boot partition and system partition when you perform either a Windows backup or a full computer backup of a domain controller.

Circular logging for Active Directory is enabled on domain controllers and cannot be turned off. If you lose all your domain controllers to a disaster and must restore a backup of Active Directory, you will lose data that was written to Active Directory after the backup set was made. Therefore, make regular backups of Active Directory. It is recommended that you back up one domain controller nightly.

Recommendations for Backing Up a Domain Controller

Consider the following recommendations before you back up a domain controller:

  • Create a Windows backup set of at least one domain controller to preserve the Active Directory information which is vital to your Exchange servers. If you make changes to your Exchange organization such as (but not limited to) adding new servers, moving users, or adding new storage groups and databases, it is highly recommended that you make a new backup of a domain controller to preserve these changes to Active Directory. You can use the backup of a domain controller to restore the domain controller and the version of Active Directory that was on the domain controller at the time that it was backed up. Additionally, you can choose whether this Active Directory information replicates to other domain controllers. By default, the backup utility (Backup) in Windows Server 2003 performs non-authoritative restores of Active Directory information. Active Directory objects that are part of an authoritative restore replicate from the restored domain controller to the other domain controllers on the network. The Active Directory objects from the backup replace the Active Directory objects in the domain, regardless of the update sequence numbers (USNs). For more information about authoritative restores, see Microsoft Knowledge Base article 241594, "HOW TO: Perform an Authoritative Restore to a Domain Controller in Windows 2000."

  • Create Windows backup sets frequently enough to make sure that they are valid backups. If the date of your System State data backup exceeds the maximum age limit set in Active Directory, the backups are not valid, and your Windows Server 2003 operating system prevents you from restoring Active Directory. For more information, see Knowledge Base article 216993, "Useful shelf life of a system-state backup of Active Directory."

  • Re-create the failed domain controller and populate its copy of Active Directory through replication from the unaffected domain controllers in your organization, instead of restoring your data from a backup.

  • Perform a non-authoritative restore of Active Directory from backup, and then allow the other domain controllers on the network to update the restored domain controller. This method is especially useful when you have a slow link over which to replicate data, a large Active Directory database, or both.

For more information about how to back up Active Directory information, see Active Directory Operations Guide Version 1.5.