Choosing Which Domain Controllers to Back Up
You install the DC agent on every domain controller, but you don't need to back up every one. A recovery restores one writable domain controller in each domain and rebuilds the others by promoting them again. This topic explains which domain controllers to back up, what you give up for the ones you don't, and how to keep the dashboard accurate.
Why not back up every domain controller
Every backup is a full copy, so storage grows with each domain controller you back up and each version you keep. In a large forest, backing up every domain controller multiplies the storage you need many times over, for backups a recovery would never use.
What Microsoft recommends
Microsoft's Active Directory Forest Recovery Guide advises you to "Back up at least two writeable DCs for each domain regularly," so that you have more than one backup to choose from. It also recommends a dedicated domain controller in each domain that is the preferred one to restore. When several backups are available, you restore only one of them. See Determine how to recover the forest (Microsoft Learn, updated September 11, 2025).
A recommended backup set
For each domain, back up:
- At least two writable domain controllers—If one backup turns out to be unusable or compromised, you have another to restore from.
- The PDC emulator—Its backup is typically the best source for SYSVOL.
- One dedicated restore domain controller—Choose one domain controller as the preferred source for a restore, and keep its backups current.
- Full system backups—A full system backup supports every recovery method, including a restore onto different hardware. See Backup Types.
Where you can, follow Microsoft's other criteria for the domain controllers you choose: prefer ones that are DNS servers, so that name resolution comes back with the directory, and ones that are global catalog servers.
Never rely on backups of read-only domain controllers (RODCs). An RODC backup cannot restore a writable domain controller, so a recovery always starts from a writable one, and RODCs are rebuilt.
What a backup of a domain controller gives you
| Domain controller | What you can do |
|---|---|
| Backed up | Restore it with DC state recovery. Recover the whole server in place or onto a candidate machine. Use it as the source for a domain or forest recovery. |
| Not backed up | Rebuild it by promotion during a domain or forest recovery. It cannot be restored by DC state recovery or full system recovery, because both need that domain controller's own backup. |
For the recovery methods, see Recovery Scopes.
A sizing example
Consider a forest of 10 domains in which you back up two domain controllers per domain, each full system backup is about 50 GB, and the vault keeps 2 versions of each, the product default:
- Retained backups—10 domains × 2 domain controllers × 50 GB × 2 versions = about 2 TB.
- Backups in progress—4 backups running at once, the default, at 50 GB each plus the 20% margin = about 240 GB.
- Free-space reserve—10 GB.
That gives a required size of about 2.25 TB, and a recommended size, with the 25% growth allowance, of about 2.8 TB. Every domain controller you add to the backup set adds its full size for each version kept. For how the figures are calculated, see Sizing Backup Storage.
Estimating your own backup set
To size a backup set of a fixed number of domain controllers per domain, run cdr repository estimate with --per-domain. Each domain is sized as that many domain controllers at the average backup size of the domain's domain controllers. A domain with fewer domain controllers backs up all it has. For example, for two domain controllers per domain:
cdr repository estimate --per-domain 2
--per-domain cannot be combined with --dc. For every option, see Storage and Media Commands.
How the console treats the domain controllers you do not back up
A domain controller with an enabled backup policy is a backup target. One with no enabled policy and nothing in the vault has the Rebuilt on recovery verdict: it is information, not a finding, and raises no alert. You do not need to exclude it. The counts show it beside the protected domain controllers, for example 2 protected · 4 rebuilt on recovery, not as a shortfall.
Whether a domain can be recovered is decided by the domain's own verdict, which turns critical when no writable domain controller has a restorable backup, whatever the other domain controllers read.
A global catalog in a forest with more than one domain needs the DC agent even when you do not back it up. A recovery of another domain in the forest reconciles each global catalog through its agent, and the console raises Global catalogs with no agent until each has one.
Keep exclusions for objects that are really out of scope, such as a forest reached across a trust, not for domain controllers that recovery rebuilds.
For the full rules, see Backup Targets and Rebuilt Domain Controllers. For how verdicts are decided, see Coverage and Readiness.
