How to Configure Windows Server 2019 Backup and Recovery

Data protection and disaster recovery are critical responsibilities for any server administrator. Windows Server 2019 includes Windows Server Backup (WSB), a built-in backup solution that supports full server backups, bare-metal recovery (BMR), system state backups, and individual volume or file backups. For enterprise environments, WSB can be supplemented with System Center Data Protection Manager, Azure Backup, or third-party solutions. This guide focuses on configuring Windows Server Backup for reliable local and network-based backup and recovery.

Installing Windows Server Backup

Windows Server Backup is an optional feature that must be installed before use:

# Install Windows Server Backup feature
Install-WindowsFeature -Name Windows-Server-Backup -IncludeManagementTools

# Verify installation
Get-WindowsFeature -Name Windows-Server-Backup

# Import the backup module
Import-Module WindowsServerBackup

Creating a Backup Policy

A backup policy (schedule) defines what to back up, when to back up, and where to store backups. Configure backup policies using PowerShell for automation and repeatability:

# Create a new backup policy
$policy = New-WBPolicy

# Add system state (includes AD database if DC, registry, COM+ databases, boot files)
Add-WBSystemState -Policy $policy

# Add bare metal recovery (ensures full server can be recovered from scratch)
Add-WBBareMetalRecovery -Policy $policy

# Add specific volumes (C: drive - OS volume)
$volume = Get-WBVolume -AllVolumes | Where-Object {$_.DriveLetter -eq "C"}
Add-WBVolume -Policy $policy -Volume $volume

# Add a second data volume
$dataVolume = Get-WBVolume -AllVolumes | Where-Object {$_.DriveLetter -eq "D"}
Add-WBVolume -Policy $policy -Volume $dataVolume

# Set backup destination to a dedicated local disk
$backupDisk = Get-WBDisk | Where-Object {$_.DiskNumber -eq 1}
$backupTarget = New-WBBackupTarget -Disk $backupDisk -Label "BackupDrive" -PreserveExistingBackups $false
Add-WBBackupTarget -Policy $policy -Target $backupTarget

# Configure backup schedule (daily at 11 PM and 3 AM)
Set-WBSchedule -Policy $policy -Schedule 23:00, 03:00

# Apply the policy
Set-WBPolicy -Policy $policy

# Verify the policy
Get-WBPolicy

Configuring Network Share Backups

Backup to a network share for off-host storage. This protects against disk failure on the backup server itself but requires sufficient network bandwidth and share permissions:

# Create a backup policy targeting a network share
$policy = New-WBPolicy

# Add items to back up
Add-WBSystemState -Policy $policy
Add-WBBareMetalRecovery -Policy $policy

$volume = Get-WBVolume -AllVolumes | Where-Object {$_.DriveLetter -eq "C"}
Add-WBVolume -Policy $policy -Volume $volume

# Set network share as destination
# Using credentials for the network share
$credential = Get-Credential "CORPbackup-agent"
$networkTarget = New-WBBackupTarget `
    -NetworkPath "\backupnas01ServerBackups$(hostname)" `
    -Credential $credential

Add-WBBackupTarget -Policy $policy -Target $networkTarget

# Set schedule
Set-WBSchedule -Policy $policy -Schedule 02:00

# Apply policy
Set-WBPolicy -Policy $policy -Force

Running Manual Backups

Run immediate backups on demand outside the scheduled window, such as before applying updates or making significant configuration changes:

# Start a manual backup using the existing policy
Start-WBBackup -Policy (Get-WBPolicy)

# Start a manual backup to a specific target (not using the schedule)
$policy = New-WBPolicy
Add-WBSystemState -Policy $policy
Add-WBBareMetalRecovery -Policy $policy
$volume = Get-WBVolume -AllVolumes | Where-Object {$_.DriveLetter -eq "C"}
Add-WBVolume -Policy $policy -Volume $volume
$target = New-WBBackupTarget -NetworkPath "\backupnas01ServerBackups$(hostname)Manual"
Add-WBBackupTarget -Policy $policy -Target $target

Start-WBBackup -Policy $policy

# Monitor backup progress
Get-WBJob -Previous 1 | Select-Object JobType, StartTime, EndTime, JobState

Checking Backup Status and History

# View backup summary
Get-WBSummary

# View last backup details
Get-WBJob -Previous 1

# View backup history (last 20 jobs)
Get-WBJob -Previous 20 | Select-Object StartTime, EndTime, JobType, JobState, ErrorDescription | Format-Table

# Check for backup failures in event log
Get-WinEvent -LogName "Microsoft-Windows-Backup" | `
    Where-Object {$_.LevelDisplayName -eq "Error"} | `
    Select-Object -First 10 | `
    Select-Object TimeCreated, Message

# View backup storage utilization
Get-WBDisk | Select-Object DiskNumber, TotalSpace, UsedSpace

Recovering Files and Folders

Restore individual files or folders from a backup without needing to do a full recovery:

# List available backup versions
Get-WBBackupSet -BackupTarget (Get-WBBackupTarget)

# Get the most recent backup
$backupSet = Get-WBBackupSet -BackupTarget (Get-WBBackupTarget) | Sort-Object BackupTime -Descending | Select-Object -First 1

# List volumes in the backup
Get-WBVolume -BackupSet $backupSet

# Create a recovery object for the files/folder
$recoveryItems = New-WBFileSpec -FileSpec "D:DataImportantFile.xlsx"

# Start file recovery
Start-WBFileRecovery `
    -BackupSet $backupSet `
    -FileRecoveryPath "C:Recovery" `
    -SourceVolumePath "D:" `
    -FileSpec $recoveryItems `
    -Overwrite $true

Performing System State Recovery

System state recovery restores critical system components including the registry, COM+ class registration, boot files, and Active Directory Domain Services (on domain controllers):

# Start a system state recovery (run from elevated PowerShell)
# WARNING: This is disruptive and requires a reboot

# List available system state backups
$backupSet = Get-WBBackupSet | Sort-Object BackupTime -Descending | Select-Object -First 1

# Perform system state recovery
Start-WBSystemStateRecovery `
    -BackupSet $backupSet `
    -AuthoritativeSysvolRecovery $false `
    -Force

# For authoritative Active Directory restore (use when restoring deleted AD objects):
Start-WBSystemStateRecovery `
    -BackupSet $backupSet `
    -AuthoritativeSysvolRecovery $true `
    -Force

Performing Bare Metal Recovery

Bare metal recovery (BMR) rebuilds a server from scratch using the Windows Recovery Environment (WinRE). To perform a BMR:

Boot from the Windows Server 2019 installation media. On the Install now screen, click “Repair your computer.” Navigate to Troubleshoot > System Image Recovery. The wizard will locate backup sets on connected media or network shares. Select the target backup and follow the prompts. The recovery process will partition the disk, restore the OS image, and restore all backed-up volumes.

# Pre-BMR: document which backup to use
Get-WBBackupSet | Sort-Object BackupTime -Descending | Select-Object BackupTime, VolumesInfo | Format-List

# Verify backup integrity before disaster occurs
# Check that backup can be read:
$backupSet = Get-WBBackupSet | Sort-Object BackupTime -Descending | Select-Object -First 1
$backupSet.VolumesInfo | Select-Object VolumeName, VolumeSpec

Configuring Azure Backup for Cloud-Based Protection

For offsite protection, integrate Windows Server Backup with Azure Backup using the Microsoft Azure Recovery Services (MARS) agent:

# Download and install the MARS agent from the Azure portal
# (Azure Recovery Services Vault > Backup > Windows Server/Client > Download Agent)

# After installation, register the server with the vault
# Run MARSAgentInstaller.exe and complete the registration wizard

# Or configure via PowerShell after MARS agent is installed
# (Registration requires vault credentials file downloaded from Azure portal)
$MARSInstaller = "C:DownloadsMARSAgentInstaller.exe"
Start-Process -FilePath $MARSInstaller -Wait

# Schedule backup via the MARS agent GUI or:
# C:Program FilesMicrosoft Azure Recovery Services Agentbinwabadmin.exe

Testing Backup Recovery

A backup is only valuable if recovery works. Test recovery procedures regularly in a lab environment:

# Test file recovery from a recent backup
$backupSet = Get-WBBackupSet | Sort-Object BackupTime -Descending | Select-Object -First 1
$recoveryPath = "C:RecoveryTest-$(Get-Date -Format 'yyyyMMdd')"
New-Item -Path $recoveryPath -ItemType Directory

Start-WBFileRecovery `
    -BackupSet $backupSet `
    -FileRecoveryPath $recoveryPath `
    -SourceVolumePath "C:" `
    -Overwrite $false

# Verify recovered files
Get-ChildItem -Path $recoveryPath -Recurse | Measure-Object -Property Length -Sum

Implement the 3-2-1 backup rule: maintain at least 3 copies of data, on 2 different types of media, with 1 copy offsite. Windows Server Backup combined with Azure Backup or an offsite network share provides this level of protection. Document recovery procedures and test them quarterly to ensure your team can execute them under pressure when a real disaster occurs.

Links

Newsletter

Contact