Active Directory backup

Active Directory services use a database located on the file system of a domain controller. If the domain has two or more domain controllers, the information stored in the database is constantly replicated between them.

Volumes to back up

To back up Active Directory, back up the following volumes of a domain controller:

• The system volume and the boot volume
• The volumes where the Active Directory database and the transaction logs are located
• The volume with the SYSVOL folder. The default location of this folder is %SystemRoot%\SYSVOL. To determine the current location of this folder, examine the Sysvol value in the following registry key:

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters

Considerations for backup

When setting up and performing Active Directory backup, make sure that:

• You perform a backup at least monthly. If your domain has only one domain controller, we recommend creating a backup at least daily.
• Your most up-to-date backup is no older than half the tombstone lifetime. Depending on the operating system where your domain has been created, the default tombstone lifetime is 60 days or 180 days. It does not matter whether the latest backup is full or incremental; you can perform a successful recovery from either one.
• You create an additional backup upon any of the following events:
  • The Active Directory database and/or transaction logs were moved to a different location.
  • An operating system on the domain controller was upgraded, or a service pack was installed.
  • A hotfix that changes the Active Directory database was installed.
  • The tombstone lifetime was changed administratively.

  The reason for this additional backup is that a successful recovery of Active Directory from the previous backups might not be possible.