In short
An Active Directory backup is not the same thing as taking a VM snapshot. For a domain controller, the recovery plan should include an Active Directory-aware backup such as System State, a documented Directory Services Restore Mode (DSRM) path, and a clear decision for when to use Recycle Bin, a non-authoritative restore, an authoritative restore, or a broader forest recovery procedure.
For most administrators, the important decision is not simply "How do I restore AD?" but what failed, what remains healthy, and which recovery scope is actually required.
What failed? | |-- One deleted user / OU | -> Recycle Bin first, if enabled and eligible | |-- One failed DC, other DCs healthy | -> usually replace/rebuild the failed DC after health checks | |-- Need an older directory object/state to win replication | -> authoritative restore may be appropriate | |-- Restoring a DC from System State while healthy partners exist | -> non-authoritative restore, then replication updates it | `-- Forest-wide corruption / compromise / loss -> formal isolated forest recovery plan
This guide owns Active Directory backup and recovery intent: System State backup, backup verification, DSRM recovery concepts, non-authoritative vs authoritative restore, deleted-object recovery choices, and post-restore validation.
It does not replace the generic Windows VPS Backup Strategy for Small Businesses, Snapshot vs Backup, or Active Directory Replication Topology for 2-DC Setups.
Important: Recovery commands in this guide can change or overwrite directory state. Use them only in a controlled recovery plan. For production incidents, follow Microsoft’s current recovery documentation and validate the exact scenario before making changes.
Why Active Directory needs both replication and backup
A business can have two healthy domain controllers and still need backups.
Replication improves availability, but replication also copies changes. If an administrator deletes an OU, modifies a critical directory object, or an attacker makes destructive changes, those changes can replicate to other domain controllers.
That creates three separate requirements:
- Availability — more than one healthy domain controller when the business requires resilience.
- Recovery points — trusted backups that predate the failure or unwanted change.
- Recovery procedure — a documented way to restore only the required scope without creating a larger outage.
This is why Active Directory design should treat a second DC and a backup as complementary controls rather than substitutes.
Understand the recovery paths before taking action
The safest AD recovery starts by classifying the incident.
| Incident | First recovery path to evaluate | Why |
|---|---|---|
| Accidentally deleted user or OU | Active Directory Recycle Bin | Usually less disruptive than restoring a DC from backup |
| One DC is lost, another healthy DC remains | Replace/rebuild the failed DC | Healthy replication partners may already hold the correct directory state |
| Restore a DC and let current directory data replicate back to it | Non-authoritative restore | Restored DC is brought up to date by healthy partners |
| Restore an older object and make that restored version replicate outward | Authoritative restore | The selected restored object or subtree is made authoritative |
| Entire forest is compromised or unusable | Forest recovery | Requires isolated, domain-by-domain recovery planning |
Do not choose an authoritative restore simply because the name sounds stronger. It is more invasive because you are deliberately making restored directory data take precedence over newer replicated copies.
Active Directory Recycle Bin should usually be checked first for deleted objects
Windows Server 2025 supports Active Directory Recycle Bin. When enabled, it can preserve deleted AD objects and their attributes so eligible objects can be restored without rolling a domain controller back to an older System State.
Check whether Recycle Bin is enabled:
Get-ADOptionalFeature -Filter 'Name -like "Recycle Bin Feature"' | Select-Object Name, EnabledScopes
If EnabledScopes contains the forest configuration, Recycle Bin is enabled.
Microsoft documents two important limitations:
- Active Directory Recycle Bin is not enabled by default;
- only objects deleted after Recycle Bin was enabled can be recovered through it.
A discovery command can be used to inspect deleted test objects:
Get-ADObject -Filter 'Name -Like "*RestoreLab*"' -IncludeDeletedObjects
After confirming the exact identity of the intended object, a restore can be performed with Restore-ADObject.
For production, do not pipe a broad search directly into Restore-ADObject until you have reviewed the returned objects. Narrow the filter and confirm identifiers such as DistinguishedName or ObjectGUID first.
System State is the core Active Directory-aware backup
Microsoft’s current Windows Server forest-recovery guidance documents System State backup for domain controllers.
On a domain controller, System State contains the operating-system state required for Active Directory recovery, including AD DS data and related components.
That makes System State different from a generic file copy.
A complete production strategy can also include full-server or bare-metal recovery, platform-level backups, application backups, and copies outside the live server. These layers address different failure modes.
| Protection layer | Primary job |
|---|---|
| AD System State | Active Directory-aware DC recovery |
| Full server / BMR backup | Restore the whole server/OS when required |
| VM/platform backup | Infrastructure-level recovery point |
| Snapshot | Short-lived pre-change rollback |
| AD Recycle Bin | Recover eligible deleted AD objects |
| Second DC | Authentication/DNS availability and replication partner |
A snapshot alone is not an Active Directory recovery strategy.
Step 1 — Record the domain-controller environment
Before creating the backup, record exactly what is being protected.
Run PowerShell as Administrator:
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber hostname Get-Service NTDS,DNS,Netlogon,ADWS | Select-Object Name,Status Get-ADDomain | Select-Object DNSRoot,NetBIOSName,PDCEmulator,RIDMaster,InfrastructureMaster Get-ADForest | Select-Object ForestMode,SchemaMaster,DomainNamingMaster
If you have more than one DC, record them as well:
Get-ADDomainController -Filter * | Select-Object HostName,Site,IsGlobalCatalog,IPv4Address
This matters during recovery because you need to know whether the failed server was the only DC, a DNS server, a Global Catalog, or an FSMO role holder.
Step 2 — Confirm Windows Server Backup is available
Windows Server Backup is not installed by default on every Windows Server installation.
Check the feature:
Get-WindowsFeature Windows-Server-Backup
If the feature is not installed and Windows Server Backup is part of your recovery design:
Install-WindowsFeature Windows-Server-Backup
Verify again:
Get-WindowsFeature Windows-Server-Backup
Step 3 — Choose a backup target that survives the failure you care about
The only recovery copy should not disappear with the domain controller.
A production backup design should consider:
- failure of the OS volume;
- accidental VM deletion;
- administrator compromise;
- ransomware;
- failure of one host or storage path;
- loss of an entire DC;
- the need to recover from an older trusted point.
A second partition on the same virtual disk is useful for limited testing, but it is not an independent production backup target because failure of the underlying VM or disk can remove both the source and the backup.
Where possible, use a separate backup destination such as another protected storage system or supported network share that remains available if the DC is lost.
The generic Raff backup strategy page owns retention, off-server copies, RPO/RTO, and layered backup design. This article focuses specifically on AD-aware backup and recovery decisions.
Step 4 — Create a System State backup with wbadmin
Microsoft documents wbadmin start systemstatebackup for Windows Server.
Example using a deliberately prepared backup volume:
wbadmin start systemstatebackup -backupTarget:E: -quiet
Replace E: with the destination defined by your recovery design.
Windows Server also supports a remote shared folder as a backup target. Example syntax:
wbadmin start systemstatebackup -backupTarget:\\backup-server\ADBackup -quiet
Use a real protected share and appropriate credentials. Do not expose SMB publicly just to make a backup target reachable.
Without -quiet, wbadmin prompts for confirmation.
You can monitor an active job with:
wbadmin get status
Do not treat a command starting successfully as proof that the backup completed successfully. Confirm the final result and then verify the recovery point.
Step 5 — List the available backup versions
After the backup completes, use:
wbadmin get versions
Microsoft documents that this returns information such as:
- backup time;
- backup location;
- version identifier;
- recovery types available from the backup.
If the backup is on a specific local target:
wbadmin get versions -backupTarget:E:
Record the version identifier. wbadmin uses that value when you inspect or restore a specific recovery point.
Inspect the items in a selected backup with:
wbadmin get items -version:<MM/DD/YYYY-HH:MM>
Use the actual version returned by your server. Do not copy an example timestamp into a production recovery command.
Step 6 — Decide whether you actually need to restore this DC
A failed domain controller in a healthy multi-DC domain is not automatically a restore job.
If another writable DC is healthy and replication was healthy before the failure, rebuilding a clean replacement server and promoting it as a new DC may be simpler and safer than restoring an old DC image.
Before restoring one failed DC, inspect the surviving environment:
repadmin /replsummary
dcdiag /e /c
And in PowerShell:
Get-ADDomainController -Filter * | Select-Object HostName,Site,IsGlobalCatalog
The decision changes if:
- this was the only DC;
- the surviving directory contains bad replicated changes;
- the forest was compromised;
- a specific historical directory object/state must be recovered;
- the backup is the only trusted copy.