Windows Server backup best practices — what to do now

Use immutable, air-gapped backups, test full restores regularly, and separate backup admin access; for Microsoft Windows Server (2022/2019) start with a single full restore test and one file-level check each month. The NCSC’s backing-up guidance is a useful reference for scope and retention.

Backups appear successful but restores fail — run full restore drills

Problem: Many teams only monitor job completion and disk usage, so backup software shows “successful” while the data is unusable at recovery time. Diagnosis: Silent failures include catalogue corruption, excluded system state, or mismatched application-consistent snapshots for SQL/Exchange. In our experience a successful backup job does not guarantee a successful restore unless you verify the restored data.

What to do: schedule a full VM or bare-metal restore at least quarterly and a targeted file restore monthly. Make those drills realistic: restore to a separate test host, boot the OS, and validate application integrity. Use this quick checklist during a drill:

Restore a full system image to a spare server or VM.
Boot the restore and confirm services start (IIS, SQL, Exchange where applicable).
Open and validate a sample of business-critical files and databases.

Document the time taken and any gaps. If a full restore exceeds your recovery time objective (RTO), that has to change — faster storage, different retention, or application-consistent agents will be required. For guidance on what to include in retention and scheduling, consult the NCSC’s backing-up guidance.

Backups are just file copies — move to immutable or isolated snapshots

Problem: A lot of small IT teams rely on simple file-copy jobs or foldersync to a NAS. Diagnosis: those copies are reachable by the same administrator account and are vulnerable if that account is compromised. In our experience, ransomware-specific backup design is different from ordinary backup — the key is not more copies, it is an air gap (physical or immutability-guaranteed) that a compromised administrator account cannot reach. Standard file-copy backup routinely fails that bar.

What to do: Replace or augment file-copy processes with backup products that offer immutability (WORM/immutable object storage) or physically air-gapped media for long-term retention. Where possible, use snapshot-based backups that integrate with Windows Server VSS for application consistency and store copies in a location that does not accept standard administrative writes. If you need further reading on product options and architectures, our overview of data backup options for business summarises common approaches and trade-offs.

All backups on-site only — introduce an off-site, isolated retention tier

Problem: Backups kept only at a single site are lost to fire, theft, or ransomware that spreads laterally. Diagnosis: Local replication is helpful but often synchronised; if attackers gain a foothold they may be able to delete replicated copies. The risk grows with longer retention windows that remain locally accessible.

What to do: Create a multi-tier retention plan: short-term local snapshots for quick recovery, and a secondary off-site tier that is either immutable or physically disconnected. Keep at least one copy with immutable retention for 30+ days so you can recover from delayed detection. For small businesses, cloud archive with immutability or periodic offline tape rotation are viable options — choose the approach that meets your recovery point objective (RPO) and budget.

Backup credentials are over-privileged — separate access and harden restore paths

Problem: Backup services run with domain admin-level credentials or store credentials in scripts. Diagnosis: Those credentials can be used by attackers to delete, encrypt, or export backups. We routinely find backup admin accounts that also have wide-ranging access to production systems.

What to do: Apply the principle of least privilege to backup accounts: give them only the permissions required to read/write the backup target and not normal domain admin operations. Use dedicated service accounts, limit logon hosts, and protect secrets in a vault. Additionally, ensure that restore operations require a secondary authentication step or are handled through a management appliance isolated from general admin tools. Run a permissions audit and remediate any account that can delete immutable snapshots.

Concrete next step: book a one-hour restore test this week: pick a critical server, perform a full restore to a test VM, and confirm application functionality. Record the elapsed time and any missing components; that single exercise will expose the biggest misconfigurations.

FAQ

How often should I test restores for Windows Server?

Run a full restore drill every quarter (every 3 months) and perform file-level spot checks monthly; more frequent checks are prudent if you host critical services like mail or accounting systems.

Can I rely on a single NAS copy for disaster recovery?

No — a single on-site NAS copy is insufficient because it can be deleted, corrupted, or encrypted by the same attacker; keep an off-site immutable or physically separated copy instead.

Do cloud backup providers meet UK data rules for business backups?

Many do, but check provider contractual terms on data handling, retention and deletion; ensure contractual controls and encryption keys meet your compliance requirements and the ICO’s guidance where applicable.