CHAPTER 14
Intermediate
Backup and Recovery
Updated: May 16, 2026
30 min read
# CHAPTER 14
Backup and Recovery
1. Introduction
There are two types of system administrators: those who have lost critical data, and those who are *about* to lose critical data. Hard drives possess a 100% failure rate; it is only a matter of *when*. Furthermore, the modern enterprise faces threats far worse than hardware degradation: Ransomware. If a cryptographic virus encrypts the Domain Controller and the File Server, the entire corporation ceases to exist. In this chapter, we will shift our mindset from daily administration to catastrophic survival. We will master the industry-standard 3-2-1 Backup Rule, utilize the native Windows Server Backup utility to capture the System State, and prepare for the ultimate worst-case scenario: Bare Metal Recovery.2. Learning Objectives
By the end of this chapter, you will be able to:- Define and implement the 3-2-1 Backup Rule for enterprise data security.
- Install and configure the Windows Server Backup feature.
- Differentiate between File-Level backups, System State backups, and Bare Metal Recovery.
- Schedule autonomous, recurring backup operations.
- Understand the architectural necessity of off-site and air-gapped storage.
3. The 3-2-1 Backup Rule
The absolute golden rule of IT Disaster Recovery. If you do not follow this, you do not have a real backup.- 3 Copies of Data: The original production data, plus two backups.
- 2 Different Media Types: Do not put both backups on the same brand of hard drive or the same physical server. Use a local NAS (Network Attached Storage) and a cloud bucket.
- 1 Off-site (Air-gapped): At least one backup MUST be physically disconnected from the network or sitting in an immutable cloud vault. If Ransomware infects your network, it will aggressively seek out and encrypt your local backup drives. If the backup is air-gapped, the hackers cannot reach it.
4. Windows Server Backup (WSB)
Windows Server does not come with backup tools installed by default. You must open Server Manager and install the Windows Server Backup *Feature*. Once installed, WSB allows you to execute different tiers of protection:1. File/Folder Level:
Backing up specific folders (like the HR-Payroll shared drive). This is fast, but it only saves data; it does not save the server's operating system or configurations.
2. System State Backup: Crucial for Domain Controllers. This backs up the entire Active Directory database, the Registry, and system files. If the AD database corrupts, you can restore the System State to bring the domain back to life without reinstalling Windows.
3. Bare Metal Recovery (BMR): The ultimate backup. It takes a complete image of the entire hard drive (OS, data, programs, everything). If the physical server catches fire and melts, you can buy a completely blank piece of metal (Bare Metal), insert the BMR backup drive, and Windows will entirely reconstruct the dead server onto the new hardware.
5. Recovery Time vs. Recovery Point
When architecting a backup strategy, management will demand answers to two metrics:- Recovery Point Objective (RPO): How much data are we willing to lose? If you backup every night at midnight, and the server crashes at 4:00 PM, you lose 16 hours of data. Is that acceptable to the business?
- Recovery Time Objective (RTO): How long can the business survive being offline? Restoring a 5 Terabyte Bare Metal backup over a slow network might take 3 days. Can the business halt operations for 3 days? If not, you must invest in faster network storage or failover clustering.
6. Diagrams/Visual Suggestions
*Visual Concept: The 3-2-1 Rule Matrix* Draw a large box divided into three columns. Column 1:Production Data (Draw a physical server).
Column 2: Local Backup (Media 1) (Draw an external USB drive or local NAS unit attached via cable).
Column 3: Off-site Air-Gap (Media 2) (Draw a cloud icon with a padlock, completely disconnected from the other two).
This visual cleanly demonstrates the physical separation required to survive a site-wide disaster like a fire or ransomware infection.
7. Best Practices
- Test Your Restores! A backup is Schrodinger's Cat. Until you actually attempt to restore data from it, you must assume the backup is corrupted and useless. Professional administrators schedule mandatory "Fire Drills" every quarter where they purposely restore a backup to an isolated test server to mathematically prove the backup file is healthy and functional.
8. Common Mistakes
-
Backing up to the same physical drive: A catastrophic beginner mistake is creating a
C:\Backupsfolder and using Windows Server Backup to save the server's data into that folder. If the physical hard drive fails, you lose the operating system AND the backups simultaneously! Backups must *always* be saved to a completely separate physical disk or network location.
9. Mini Project: Configure a Daily System State Backup
Let's use PowerShell to install the tool and run a critical Active Directory backup.- 1. Open PowerShell as Administrator.
- 2. Install the Windows Server Backup Feature:
powershell
- 3. Open the graphical Windows Server Backup console via Administrative Tools.
- 4. Click Backup Schedule... on the right side.
- 5. Select Custom (We don't want the full server, just the AD database).
- 6. Click Add Items and check System State.
-
7.
Specify the backup time:
11:00 PM.
-
8.
Specify Destination Type: Back up to a shared network folder. (Enter the path to your secure NAS, e.g.,
\\NAS-01\Backups\DC01).
- 9. Click Finish. The Domain Controller is now autonomously securing the company's identity database every single night!
10. Practice Exercises
- 1. Define the parameters of the 3-2-1 Backup Rule and explain why it is the industry standard for surviving Ransomware attacks.
- 2. Differentiate between a "System State" backup and a "Bare Metal Recovery" (BMR) backup. In what specific disaster scenario is BMR an absolute requirement?
11. MCQs with Answers
Question 1
An organization performs a backup of their massive database server every night at 12:00 AM. A catastrophic hardware failure destroys the server's RAID array at 3:00 PM the following day. The company permanently loses 15 hours of critical financial data. Which Disaster Recovery metric defines this 15-hour window of acceptable or unacceptable data loss?
Question 2
To ensure a Domain Controller can be recovered in the event that the Active Directory database becomes completely corrupted, but without requiring the massive storage space of copying the entire C: drive, which specific type of backup must be scheduled within Windows Server Backup?
12. Interview Questions
- Q: A junior administrator proudly states they have secured the enterprise by scheduling a daily Bare Metal Recovery backup of the main File Server to an external USB hard drive physically resting on top of the server. Explain why this violates the 3-2-1 Backup Rule, and describe the specific physical threats that could destroy both the server and the backup simultaneously.
- Q: Walk me through the operational difference between Recovery Time Objective (RTO) and Recovery Point Objective (RPO). If a CEO demands an RPO of exactly 5 minutes, how does this drastically change your technical backup architecture compared to a daily midnight backup?
- Q: Explain the necessity of "Air-Gapped" or "Immutable" backups in the context of modern cybersecurity. If a Domain Administrator's account is compromised by a hacker deploying ransomware, why does a standard, connected network backup drive fail to protect the company?