It is perfectly safe to backup a shutdown AD, as long as it is a single entity. If it is more than one then you shut down the "slaves" first ,then the current "master" & back them all up. (the master goes down last, so it stays the master for timestamps) Then restart the master (time sync) then slaves , so it just looks like a network outage. To restore you MUST shut them all down and restore them all ,or things will break very very very badly (timestamps will be all over the place) I generally do this once a week for the last 8 years. And I have done several test restores as well as at least one full 3 site recovery and it was fine. It only goes bad if you try and get smart. The first issue you will have , is with a restore, that the clocks are "bad" and on initial restore the certs issued to clients are bad, until the times all sync (keeping in mind that if it is a VM, it's gonna screw with your network clocks , so its better to pull the network cables, until it catches up.) It's not something you should be doing randomly, for recovery from small changes. Get the master up first, ideally off the network if it's being used as a time server (which it should be anyway...) ?On 6/4/2026, 2:33 AM, "samba on behalf of Peter Milesson via samba" <samba-bounces at lists.samba.org <mailto:samba-bounces at lists.samba.org> on behalf of samba at lists.samba.org <mailto:samba at lists.samba.org>> wrote: Hi folks, Is it possible to back up a Windows 2022 AD DC with samba-tool? And how could I restore it, if it's possible? Running "sudo samba-tool domain backup online --targetdir=/home/<some user>/<backupdir> --server=DC1.mydomain.talps -UAdministrator" gives me 2 compressed archives, one with the domain data, and one with sysvol information. The reason I ask is, that backing up the domain of a AD DC under Windows take ages, while the Samba version finishes within a few seconds. Best regards, Peter -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba <https://lists.samba.org/mailman/options/samba>
On Wed, 8 Apr 2026 03:18:09 +0000 itdept_head via samba <samba at lists.samba.org> wrote:> > It is perfectly safe to backup a shutdown AD, as long as it is a > single entity. If it is more than one then you shut down the "slaves" > first ,then the current "master" & back them all up. (the master goes > down last, so it stays the master for timestamps) > > Then restart the master (time sync) then slaves , so it just looks > like a network outage. To restore you MUST shut them all down and > restore them all ,or things will break very very very badly > (timestamps will be all over the place) > > I generally do this once a week for the last 8 years. > > And I have done several test restores as well as at least one full 3 > site recovery and it was fine. It only goes bad if you try and get > smart. > > The first issue you will have , is with a restore, that the clocks > are "bad" and on initial restore the certs issued to clients are bad, > until the times all sync (keeping in mind that if it is a VM, it's > gonna screw with your network clocks , so its better to pull the > network cables, until it catches up.) > > It's not something you should be doing randomly, for recovery from > small changes. Get the master up first, ideally off the network if > it's being used as a time server (which it should be anyway...)First, there is no concept of master and slaves in AD, all DC are equal and hold the same AD database, it is just that there also the FSMO roles and they can be on any DC. You should not backup an individual DC, what you actually backup is the AD database and this can be backed up on any DC and you can do it while the DC is running. You should only require such a backup in the event of a total DC failure, that is if you have no DCs left running. If an individual DC dies, you should demote it (forcibly if required) and replace it with another one. Rowland
On 4/8/26 5:18 AM, itdept_head via samba wrote:> It is perfectly safe to backup a shutdown AD, as long as it is a single entity. > If it is more than one then you shut down the "slaves" first ,then the current "master" & back them all up. (the master goes down last, so it stays the master for timestamps) > > Then restart the master (time sync) then slaves , so it just looks like a network outage. > To restore you MUST shut them all down and restore them all ,or things will break very very very badly (timestamps will be all over the place) > > I generally do this once a week for the last 8 years. > > And I have done several test restores as well as at least one full 3 site recovery and it was fine. > It only goes bad if you try and get smart. > > The first issue you will have , is with a restore, that the clocks are "bad" and on initial restore the certs issued to clients are bad, until the times all sync > (keeping in mind that if it is a VM, it's gonna screw with your network clocks , so its better to pull the network cables, until it catches up.) > > It's not something you should be doing randomly, for recovery from small changes. > Get the master up first, ideally off the network if it's being used as a time server (which it should be anyway...) > > > > ?On 6/4/2026, 2:33 AM, "samba on behalf of Peter Milesson via samba" <samba-bounces at lists.samba.org <mailto:samba-bounces at lists.samba.org> on behalf of samba at lists.samba.org <mailto:samba at lists.samba.org>> wrote: > > > Hi folks, > > > Is it possible to back up a Windows 2022 AD DC with samba-tool? And how > could I restore it, if it's possible? > > > Running "sudo samba-tool domain backup online --targetdir=/home/<some > user>/<backupdir> --server=DC1.mydomain.talps -UAdministrator" gives me > 2 compressed archives, one with the domain data, and one with sysvol > information. > > > The reason I ask is, that backing up the domain of a AD DC under Windows > take ages, while the Samba version finishes within a few seconds. > > > Best regards, > > > Peter > >Thanks for your input itdept, but that's not really what I have got in mind. Best regards, Peter