Introduction to Windows Server Backup
Windows Server Backup (WSB) is the built-in backup and recovery solution included with Windows Server 2022. It provides volume-level backup, system state backup, and bare metal recovery capabilities without requiring third-party software. While enterprise environments often use more feature-rich backup solutions, Windows Server Backup is reliable, well-integrated with the OS, and particularly valuable for smaller environments, offsite branch servers, or as a secondary backup alongside other solutions.
Windows Server Backup uses Volume Shadow Copy Service (VSS) to create consistent snapshots of volumes even while they are in use. This means databases, open files, and active system files are captured in a transactionally consistent state without requiring downtime. Backups can be written to a dedicated local disk, a remote shared folder (UNC path), or optical media.
Installing the Windows Server Backup Feature
Windows Server Backup is a Windows feature that must be installed before use. Install it along with its command-line tools using PowerShell:
Install-WindowsFeature -Name Windows-Server-Backup -IncludeManagementToolsThis installs three components: the Windows Server Backup MMC snap-in (wbadmin.msc), the wbadmin command-line tool, and the PowerShell cmdlets from the WindowsServerBackup module. Verify the PowerShell module is available:
Get-Module -ListAvailable -Name WindowsServerBackupImport the module for the current session if it is not already loaded:
Import-Module WindowsServerBackupCreating a Backup Policy with PowerShell
The core of Windows Server Backup PowerShell management is the WBPolicy object. You build a backup policy by creating a new policy object, adding volumes to back up, specifying the backup target, and then registering the policy as a scheduled job.
Create a new backup policy and add the C: volume:
$policy = New-WBPolicy
$vol = Get-WBVolume -AllVolumes | Where-Object { $_.DriveLetter -eq 'C' }
Add-WBVolume -Policy $policy -Volume $volAdd the system state to the policy (this includes the registry, AD DS database if applicable, SYSVOL, certificate services, and other critical system components):
Add-WBSystemState -Policy $policyEnable bare metal recovery, which allows the server to be restored to dissimilar hardware:
Add-WBBareMetalRecovery -Policy $policyConfiguring the Backup Target
Backup targets can be a dedicated local disk, a volume on a local disk, or a remote shared folder. Using a dedicated disk is preferred because Windows Server Backup formats it as a VHD backup target, hiding it from normal use to prevent accidental modification.
List available disks for use as a backup target:
Get-WBDiskAdd a dedicated local disk as the backup target (this will format the disk — ensure it is empty):
$disk = Get-WBDisk | Where-Object { $_.DiskNumber -eq 1 }
$target = New-WBBackupTarget -Disk $disk
Add-WBBackupTarget -Policy $policy -Target $targetAlternatively, use a network share as the backup target:
$cred = Get-Credential
$target = New-WBBackupTarget -NetworkPath "\backupserverBackupsServer01" -Credential $cred
Add-WBBackupTarget -Policy $policy -Target $targetNote: Network share targets create a single backup set that is overwritten each time. Unlike disk targets, network targets do not support multiple versions or incremental backups through the Windows Server Backup GUI.
Scheduling Backups
Set the backup schedule within the policy. The schedule accepts one or more TimeSpan objects representing times of day:
Set-WBSchedule -Policy $policy -Schedule 02:00, 14:00This schedules backups at 2:00 AM and 2:00 PM daily. After building the complete policy, register it with the system (this creates the scheduled task):
Set-WBPolicy -Policy $policyVerify the registered policy:
Get-WBPolicyThe output shows the full policy configuration including volumes, targets, schedule, and whether system state and bare metal recovery are included.
Running a Manual Backup Immediately
To run a backup immediately outside the schedule, use the Backup-WBVolume cmdlet or the wbadmin command. The PowerShell approach using the current policy:
Start-WBBackup -Policy (Get-WBPolicy)Using wbadmin to start a backup of the C: volume to a network share immediately:
wbadmin start backup -backupTarget:\backupserverBackupsServer01 -include:C: -allCritical -systemState -quietThe -allCritical flag includes all volumes that contain operating system components. The -systemState flag adds the system state. The -quiet flag suppresses the confirmation prompt.
Full Server Backup vs Volume Backup
A full server backup captures all volumes on the server plus the system state and bare metal recovery components. It is sufficient to restore the entire server to the same or different hardware. Use -allCritical with wbadmin to ensure all OS-critical volumes are included even if you do not enumerate them explicitly.
A volume backup captures only specified volumes. It is faster and uses less storage space but cannot be used for bare metal recovery. It is suitable for data drives that change frequently and need frequent backups independent of the OS backup schedule.
Back up only the D: data volume:
wbadmin start backup -backupTarget:\backupserverBackupsDataBackup -include:D: -quietSystem State Backup
The system state is a collection of critical OS components that together define the server’s identity and configuration. For a domain controller, system state includes the Active Directory database (NTDS.dit), SYSVOL, and the AD registry hive. For a standalone server, it includes the registry, boot files, COM+ class registration database, and certificate services database.
Run a system state backup explicitly with wbadmin:
wbadmin start systemstatebackup -backupTarget:D: -quietSystem state backups can only be restored locally on the same machine. They are used for authoritative and non-authoritative AD restores, certificate services recovery, and registry recovery — not for bare metal restore scenarios.
Restoring Data from Backup
List available backup versions on a target to find the version identifier:
wbadmin get versions -backupTarget:\backupserverBackupsServer01The output shows version identifiers in the format MM/DD/YYYY-HH:MM. Restore a volume from a specific backup version:
wbadmin start recovery -version:05/17/2026-02:00 -itemType:Volume -items:C: -backupTarget:\backupserverBackupsServer01 -recoveryTarget:D: -quietRestore specific files or folders from a backup:
wbadmin start recovery -version:05/17/2026-02:00 -itemType:File -items:C:UsersData -recursive -backupTarget:\backupserverBackupsServer01 -recoveryTarget:C:Restored -quietUsing PowerShell to start a volume recovery:
$version = Get-WBBackupSet | Sort-Object BackupTime | Select-Object -Last 1
Start-WBVolumeRecovery -BackupSet $version -VolumeInBackup (Get-WBVolume -BackupSet $version | Where-Object { $_.DriveLetter -eq 'C' }) -TargetVolume (Get-WBVolume -AllVolumes | Where-Object { $_.DriveLetter -eq 'E' })Bare Metal Recovery Overview
Bare metal recovery (BMR) restores the entire server from backup onto new or replacement hardware, including the OS, installed roles, and all data. To perform a BMR, boot the server from a Windows Server 2022 installation ISO or WinPE media, select Repair Your Computer, then Troubleshoot > System Image Recovery. Point the wizard to the backup location (local disk or network share) and follow the prompts. The target disk will be completely overwritten with the backup’s partition layout and data. BMR is the fastest path to recovering a failed server when the original hardware is unavailable or the OS is corrupted beyond repair.
For BMR to succeed, the backup must have been created with bare metal recovery enabled (Add-WBBareMetalRecovery or -allCritical flag). The target machine must have at least as much disk space as the original system disk.
Monitoring Backup Jobs
Check the status of the most recent backup job:
Get-WBJob -Previous 1View all recent backup history:
Get-WBJob -Previous 10Windows Server Backup events are logged to the Windows Event Log under Microsoft-Windows-Backup. Query for backup events:
Get-WinEvent -LogName 'Microsoft-Windows-Backup' |
Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-7) } |
Select-Object TimeCreated, LevelDisplayName, Message |
Format-ListFor automated monitoring, create a scheduled task or script that runs Get-WBJob, checks the JobState property for Failed, and sends an alert email if a backup failure is detected. Successful backup job output shows JobState as Completed with no errors.
To check disk space consumed by backups on the backup target disk:
wbadmin get disksThis lists all backup-configured disks along with their total capacity and the space allocated for backup storage, helping you anticipate when older backup versions will be automatically pruned to reclaim space.
