A backup strategy that has never been tested is not a backup strategy — it is a hope. Windows Server has built-in backup tools that cover most scenarios from accidental file deletion to full bare-metal recovery. This guide covers Windows Server Backup, Volume Shadow Copy Service, and the recovery procedures you need to practice before you need them in an emergency.
Windows Server Backup vs Third-Party Solutions
Windows Server Backup (WSB) is free, built-in, and covers the essentials: full server backup, system state backup, individual volume backup, and BMR (Bare Metal Recovery). Its limitations include no backup scheduling granularity below once per day, no deduplication, and basic reporting. For environments requiring more granular schedules, offsite replication, or application-aware backups for SQL/Exchange, third-party solutions (Veeam, Acronis, Backup Exec) are worth the cost. For smaller environments, WSB is perfectly adequate.
Installing Windows Server Backup
Install-WindowsFeature -Name Windows-Server-Backup -IncludeManagementToolsAfter installation, open Windows Server Backup from Server Manager > Tools, or run wbadmin from an elevated command prompt.
Configuring a Scheduled Full Server Backup
In the WSB console, click Backup Schedule in the right panel. The wizard asks:
- Backup configuration: Select Full Server to back up everything including system state and all volumes
- Backup time: Choose at least once daily; schedule it during low-activity periods (e.g., 02:00)
- Destination type: Back up to a hard disk dedicated to backups is most reliable — WSB formats the destination disk exclusively for backup use. Alternatively, back up to a volume or network share.
Network share backup via PowerShell:
$policy = New-WBPolicy
$fileSpec = New-WBFileSpec -FileSpec "C:"
Add-WBVolume -Policy $policy -Volume (Get-WBVolume -AllVolumes | Where-Object {$_.MountPath -eq "C:"})
$backupTarget = New-WBBackupTarget -NetworkPath "\backup-serverackupssrv-web01" -Credential (Get-Credential)
Add-WBBackupTarget -Policy $policy -Target $backupTarget
Set-WBSchedule -Policy $policy -Schedule 02:00
Set-WBPolicy -Policy $policySystem State Backup
System State is a critical component that includes the registry, boot files, COM+ class registration database, and — on domain controllers — the Active Directory database and SYSVOL. Always include System State when backing up DCs. A System State backup of a domain controller allows you to perform an authoritative restore of AD objects.
wbadmin start systemstatebackup -backuptarget:D: -quietVolume Shadow Copy Service (VSS)
VSS creates point-in-time snapshots of volumes, enabling users to restore previous versions of files without admin involvement. Enable VSS on file server volumes in File Explorer: right-click a volume > Properties > Shadow Copies tab. Set the schedule and maximum storage size.
Users access previous versions by right-clicking any file or folder > Properties > Previous Versions. This self-service recovery capability significantly reduces helpdesk tickets for accidental file deletions.
# List existing shadow copies
vssadmin list shadows
# Create a shadow copy immediately
vssadmin create shadow /for=D:Restoring Individual Files
To restore specific files from a WSB backup without a full recovery:
# List available backup versions
wbadmin get versions
# Restore a specific file
wbadmin start recovery -version:MM/DD/YYYY-HH:MM -itemtype:file -items:"C:Data
eport.xlsx" -recoveryTarget:"C:Restored" -quietBare Metal Recovery
BMR restores the entire server to a new or replaced disk. Boot the server from Windows Server installation media, choose Repair your computer (not Install), then select Troubleshoot > System Image Recovery. Point the wizard at your backup location (local disk or network share) and let it restore. The process typically takes 20-60 minutes depending on backup size and storage speed.
Practice BMR in a lab before you need it in production. Discovering that your backup is incomplete or the recovery process has an unexpected step during an actual outage is a situation to avoid absolutely.
Verifying Backup Integrity
A backup that cannot be restored is worthless. Build verification into your process:
# Check backup job status
wbadmin get status
# Verify the last backup completed successfully — check event logs
Get-WinEvent -LogName "Microsoft-Windows-Backup" | Where-Object {$_.Id -eq 4} | Select-Object -First 5 TimeCreated, MessageEvent ID 4 in the Microsoft-Windows-Backup log indicates a successful backup completion. Set up email alerting on backup failures by creating a scheduled task that monitors this log and sends an alert when a failure event (ID 5) is detected.