On 4/8/26 7:23 AM, Rowland Penny via samba wrote:> On Wed, 8 Apr 2026 03:18:09 +0000 > itdept_head via samba <samba at lists.samba.org> wrote: > >> It is perfectly safe to backup a shutdown AD, as long as it is a >> single entity. If it is more than one then you shut down the "slaves" >> first ,then the current "master" & back them all up. (the master goes >> down last, so it stays the master for timestamps) >> >> Then restart the master (time sync) then slaves , so it just looks >> like a network outage. To restore you MUST shut them all down and >> restore them all ,or things will break very very very badly >> (timestamps will be all over the place) >> >> I generally do this once a week for the last 8 years. >> >> And I have done several test restores as well as at least one full 3 >> site recovery and it was fine. It only goes bad if you try and get >> smart. >> >> The first issue you will have , is with a restore, that the clocks >> are "bad" and on initial restore the certs issued to clients are bad, >> until the times all sync (keeping in mind that if it is a VM, it's >> gonna screw with your network clocks , so its better to pull the >> network cables, until it catches up.) >> >> It's not something you should be doing randomly, for recovery from >> small changes. Get the master up first, ideally off the network if >> it's being used as a time server (which it should be anyway...) > First, there is no concept of master and slaves in AD, all DC are equal > and hold the same AD database, it is just that there also the FSMO > roles and they can be on any DC. > > You should not backup an individual DC, what you actually backup is the > AD database and this can be backed up on any DC and you can do it > while the DC is running. > > You should only require such a backup in the event of a total DC > failure, that is if you have no DCs left running. If an individual DC > dies, you should demote it (forcibly if required) and replace it with > another one. > > Rowland >Hi Rowland, A live domain backup for disaster recovery is what I'm interested in. If I could use samba-tool, even if the domain is on Windows DCs, that would be great. I don't use Exchange and other M$ dinosaurs, so it's really the domain structure, users, computers, and a few GPOs that I want to have backed up. Thanks for clarify (for the nth time), that all DCs are equal ;-) Best regards, Peter
On Wed, 8 Apr 2026 10:49:28 +0200 Peter Milesson via samba <samba at lists.samba.org> wrote:> > On 4/8/26 7:23 AM, Rowland Penny via samba wrote: > > On Wed, 8 Apr 2026 03:18:09 +0000 > > itdept_head via samba <samba at lists.samba.org> wrote: > > > >> It is perfectly safe to backup a shutdown AD, as long as it is a > >> single entity. If it is more than one then you shut down the > >> "slaves" first ,then the current "master" & back them all up. (the > >> master goes down last, so it stays the master for timestamps) > >> > >> Then restart the master (time sync) then slaves , so it just looks > >> like a network outage. To restore you MUST shut them all down and > >> restore them all ,or things will break very very very badly > >> (timestamps will be all over the place) > >> > >> I generally do this once a week for the last 8 years. > >> > >> And I have done several test restores as well as at least one > >> full 3 site recovery and it was fine. It only goes bad if you try > >> and get smart. > >> > >> The first issue you will have , is with a restore, that the clocks > >> are "bad" and on initial restore the certs issued to clients are > >> bad, until the times all sync (keeping in mind that if it is a VM, > >> it's gonna screw with your network clocks , so its better to pull > >> the network cables, until it catches up.) > >> > >> It's not something you should be doing randomly, for recovery from > >> small changes. Get the master up first, ideally off the network if > >> it's being used as a time server (which it should be anyway...) > > First, there is no concept of master and slaves in AD, all DC are > > equal and hold the same AD database, it is just that there also the > > FSMO roles and they can be on any DC. > > > > You should not backup an individual DC, what you actually backup is > > the AD database and this can be backed up on any DC and you can do > > it while the DC is running. > > > > You should only require such a backup in the event of a total DC > > failure, that is if you have no DCs left running. If an individual > > DC dies, you should demote it (forcibly if required) and replace it > > with another one. > > > > Rowland > > > Hi Rowland, > > A live domain backup for disaster recovery is what I'm interested in. > If I could use samba-tool, even if the domain is on Windows DCs, that > would be great. I don't use Exchange and other M$ dinosaurs, so it's > really the domain structure, users, computers, and a few GPOs that I > want to have backed up.The problems with backing up a Windows domain with Samba-tool are: Does it work ? I do not know, never tried. How would you use the resultant backup to restore a Windows domain ? I suppose you could possibly use it to create a Samba domain, join a Windows server to the domain and then demote the Samba DC, but again, I have never tried this.> > Thanks for clarify (for the nth time), that all DCs are equal ;-)I keep saying this, but people keep referring to 'master' and 'slaves' ;-) Rowland
?On 8/4/2026, 4:50 PM, "samba on behalf of Peter Milesson via samba" <samba-bounces at lists.samba.org <mailto:samba-bounces at lists.samba.org> on behalf of samba at lists.samba.org <mailto:samba at lists.samba.org>> wrote: On 4/8/26 7:23 AM, Rowland Penny via samba wrote:> On Wed, 8 Apr 2026 03:18:09 +0000 > itdept_head via samba <samba at lists.samba.org <mailto:samba at lists.samba.org>> wrote: > >> It is perfectly safe to backup a shutdown AD, as long as it is a >> single entity. If it is more than one then you shut down the "slaves" >> first ,then the current "master" & back them all up. (the master goes >> down last, so it stays the master for timestamps) >> >> Then restart the master (time sync) then slaves , so it just looks >> like a network outage. To restore you MUST shut them all down and >> restore them all ,or things will break very very very badly >> (timestamps will be all over the place) >> >> I generally do this once a week for the last 8 years. >> >> And I have done several test restores as well as at least one full 3 >> site recovery and it was fine. It only goes bad if you try and get >> smart. >> >> The first issue you will have , is with a restore, that the clocks >> are "bad" and on initial restore the certs issued to clients are bad, >> until the times all sync (keeping in mind that if it is a VM, it's >> gonna screw with your network clocks , so its better to pull the >> network cables, until it catches up.) >> >> It's not something you should be doing randomly, for recovery from >> small changes. Get the master up first, ideally off the network if >> it's being used as a time server (which it should be anyway...) > First, there is no concept of master and slaves in AD, all DC are equal > and hold the same AD database, it is just that there also the FSMO > roles and they can be on any DC. > > You should not backup an individual DC, what you actually backup is the > AD database and this can be backed up on any DC and you can do it > while the DC is running. > > You should only require such a backup in the event of a total DC > failure, that is if you have no DCs left running. If an individual DC > dies, you should demote it (forcibly if required) and replace it with > another one. > > Rowland >Hi Rowland, A live domain backup for disaster recovery is what I'm interested in. If I could use samba-tool, even if the domain is on Windows DCs, that would be great. I don't use Exchange and other M$ dinosaurs, so it's really the domain structure, users, computers, and a few GPOs that I want to have backed up. Thanks for clarify (for the nth time), that all DCs are equal ;-) Best regards, Peter I should clarify a few things: "master" is where we generally make changes: "slave" is satellite offices. This is VM's Going to disagree about the backup at any location. The AD's are not perfectly synced in the real world, we can see delays of upto 5-10 minutes for changes to propagate... or in several cases... days. We have offices in some really distant locations with really flaky connections, and very strict government rules about what you can connect to (NTP) or equipment for time sync (GPS), No satellite ,no starlink... Tried just doing the database, and it always lead to problems, specifically because , we found it does not deal with all aspects of the complete AD. GPO's etc. As regards "AD" all being the "same", only in a zero latency mind , yes they all have the same rights, and they can all do the same things, and in the ideal world they are identical but It's like saying all the identical twins called "bob" in different geolocated environments are the same. We don't have the luxury of cloud systems for storing the AD's nor the guaranteed uptime of connections, we operate in an environment where many things most people consider normal are considered outright illegal by the governments plus some farmer digging up a network connection can take 3 days to fix... So in our specific situation we require a very structured way of working, communication and systems are critical, because down time at a single location costs tens of thousands a day. Sadly...sometimes you cannot always get exactly what you want and you have to consider alternatives. -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba <https://lists.samba.org/mailman/options/samba>