Backup Types
Each backup policy sets one of two backup types. The type decides which kinds of restore the backup can support later, so choose it with recovery in mind rather than storage alone.
Full system
A full system backup (shown in the console as Full system) captures every critical volume of the domain controller: the operating system volume and every volume that holds the directory database, its logs, or SYSVOL. That includes Windows, applications, and DC state. It is taken with wbadmin start backup -allCritical. A full system backup supports both kinds of restore:
- DC state recovery—Puts Active Directory back on a domain controller whose Windows still starts.
- Full system recovery—Puts the whole server back, operating system included, on a physical machine or VM from a recovery image: either the same machine or a replacement machine.
Full system is the default type for a new backup policy.
DC state
A DC state backup (DC state) captures Active Directory and the domain controller's Windows system state: the directory database, SYSVOL, the registry, and the boot files. It is smaller and faster than a full system backup, but it supports DC state recovery only, on a domain controller that still boots. It cannot restore a server whose operating system is gone, and it cannot be restored onto another machine.
Comparing the types
| Full system | DC state | |
|---|---|---|
| DC state recovery | Yes | Yes |
| Full system recovery, in place or onto a candidate | Yes | No |
| First restored DC in a forest or domain recovery | Yes, by either method | Yes, by DC state recovery in place only |
| Relative size | Larger: the used space on every critical volume | Smaller |
| Counts toward a domain's full system recovery coverage | Yes | No |
A full system backup is roughly the used space on the machine's critical volumes, less the page file, hibernation file, and shadow copy storage, plus some image overhead. To estimate the storage your estate needs before you install, see Sizing Backup Storage.
Choosing a type
- Use full system for the domain controllers you would restore first—A lost or encrypted machine needs a full system recovery, and only a full system backup provides one. A domain whose writable domain controllers have only DC state backups shows No full system recovery on the Domains screen.
- Cover at least two writable domain controllers in each domain—The coverage rule is two full system backups per domain, so that one bad or post-compromise backup still leaves another to restore from. A domain with only one shows Single recovery option.
- Consider DC state where storage is tight and full system recovery is not needed—For example, for additional domain controllers that you would rebuild by promotion rather than restore if they were lost.
Note: A DC state recovery can only put a backup back onto the same Windows build and revision the machine runs now. After Windows Update patches a domain controller, its older backups can no longer be restored onto it this way until a new backup is taken. Back up soon after patching. A full system recovery is not affected, because it restores the operating system along with the directory.
For how each type is used during recovery, see Restore Methods.
Read-only domain controllers
A read-only domain controller (RODC) is never restored from backup. It is rebuilt instead: its old metadata is removed and a fresh RODC is promoted. A forest or domain recovery plan can only mark an RODC for rebuild or exclusion, and a single-DC restore of an RODC is refused. A backup of an RODC therefore cannot start or contribute to a recovery, and coverage ignores it: a domain whose only restorable backups are of RODCs is reported as Unrecoverable.
Install the DC agent on RODCs anyway, so that the inventory, coverage figures, and recovery plans include them.
