Back up a domain controller's system state with Windows Server Backup

If a domain controller dies, a recent system state backup is what lets you bring Active Directory back without rebuilding the domain from memory. Windows Server has a free tool for this built in: Windows Server Backup. This tutorial installs it, takes a one-off system state backup from the console, shows the one-line command version, and checks the backup is really there.

Before you start

You need to be a member of Administrators or Backup Operators on the server (or have the right permissions delegated).
Have somewhere to put the backup: a separate local drive (for example E:) or a network share that the account you use can write to.
Microsoft's steps here apply to Windows Server 2016, 2019, 2022 and 2025.

A system state backup does not include users' registry hives (HKEY_CURRENT_USER). It's for recovering the server and Active Directory, not users' profiles.

Part 1: Install Windows Server Backup

On the domain controller, right-click Start and open Windows PowerShell (Admin) or Terminal (Admin). Select Yes at the User Account Control prompt.
Run:
```
Install-WindowsFeature Windows-Server-Backup
```
When it finishes, the Success column should say True. If it's already installed, you'll see NoChangeNeeded, which is fine.

Part 2: Take a system state backup from the console

Open Server Manager, select Tools, then Windows Server Backup.
If User Account Control asks, give Backup Operator or admin credentials and select OK.
In the left pane, select Local Backup.
On the Action menu, select Backup once.
In the Backup Once Wizard, on Backup options, select Different options, then Next.
On Select backup configuration, select Custom, then Next.
On Select Items for Backup, select Add Items, tick System State, then select OK and Next.
On Specify destination type, choose Local drives or Remote shared folder, then Next.
- For a shared folder: type the path (for example \\FS01\Backups\DC01), choose Do not inherit or Inherit under Access Control, select Next, then enter a user name and password that can write to that share and select OK.
On Select Backup Destination, pick the drive or confirm the share.
On the confirmation page, check the items and destination, then select Backup.
Wait for the progress screen to finish. A system state backup can take a while. When it's done, select Close.

If you choose a local drive, use a drive that is only for backups. Backups that sit on the same server are lost if that server's disks fail or it's hit by ransomware, so copy them somewhere else as well, or use a share on another server.

Part 3: The command line version

The same backup in one line is handy for scripts or Server Core. Open an elevated Command Prompt (right-click Command Prompt, then Run as administrator) and run, changing E: to your backup drive:

wbadmin start systemstatebackup -backupTarget:E:

To back up to a share instead:

wbadmin start systemstatebackup -backupTarget:\\FS01\Backups\DC01\

Type Y when asked to start. Add -quiet to the end to skip the prompt, which is what you want in a scheduled script.

Check it worked

In Windows Server Backup, select Local Backup. The Messages list should show your backup with a status of Successful. Double-click it to see the details.
In an elevated Command Prompt, run:
```
wbadmin get versions
```
You should see an entry with today's date and time, the backup target, and a Version identifier. That identifier is what you'd use for a restore.
Look at the destination drive or share. You should see a WindowsImageBackup folder with a subfolder named after the server.

A backup you've never restored is only a hope. In a lab, practise restoring a domain controller from system state at least once, so you know the steps before you need them for real.

Sources

← All tutorials