Bare Metal Backup Test on a VM (Prove the Backup Actually Restores)

An untested backup is not a backup. This post is the test. We’ll create a bare-metal backup of a disposable lab VM — not just system state, but the full machine including the system reserved partition and the OS volume — verify the artifact landed on disk in the right shape, and prepare for Part 4 where we wipe the VM and restore it.

This is Part 3 in the AD Backup & Disaster Recovery pathway. Parts 1 and 2 covered system-state backups (manual and scheduled). System state is enough for AD object recovery, but for a dead host or destroyed VM you need bare-metal recovery — the full image that WinRE can restore from inside the Windows Recovery Environment without any working Windows install on the box.

Why bare-metal as a test target

Three reasons we use bare-metal backup for the test rather than system state alone:

It’s the worst-case backup — if bare-metal works, system state restore works trivially.
It exercises WinRE — the Windows Recovery Environment boot path is where most real restores hit unexpected gotchas (driver mismatches, missing NIC drivers, wrong UEFI / BIOS firmware mode). Testing now flushes those out.
It produces the artifact for Part 4 — the restore walkthrough uses the backup we make here.

Step 1 — Pick a disposable VM

Hyper-V Manager showing the lab VM that will be used for the bare metal backup and restore test — The lab VM we’ll bare-metal back up. **Use a disposable test VM** — never run this test on a production DC. The whole point is to verify procedure on a VM you can wipe.

Use a lab VM you can delete — not a production DC. We’ll wipe this VM in Part 4 to prove the restore works. Test on production first and you’ll regret it.

Step 2 — Add a dedicated backup VHDX

VM Settings dialog SCSI Controller selected with Hard Drive add option highlighted — Open the VM Settings > **SCSI Controller > Hard Drive > Add**. We’re attaching a new dedicated disk that WSB will format and own as the backup target.

New Virtual Hard Disk Wizard before you begin and New button visible — Click **New** to create a fresh VHDX. Don’t reuse an existing data disk — WSB will format whatever it’s pointed at.

Choose Disk Format step with VHDX selected and Next button visible — Disk format: **VHDX**. Modern default; supports disks > 2 TB and is safer for unexpected power loss than legacy VHD.

Choose Disk Type step with Fixed size option selected — **Fixed size**. Pre-allocates the whole VHDX on the host. Slower to create but predictable I/O during backup and no thin-provisioning surprises.

Specify Name and Location step with the new VHDX file name entered — Name the VHDX clearly: e.g. `DC01-BACKUP.vhdx`. Future-you grepping a Hyper-V config to find which disk holds what will thank you.

Configure Disk step showing size selector for the small lab backup disk — Size: keep this small for the lab. **For production, size = full server backup size × (1 + retention multiplier)**. WSB needs room for the full plus all incrementals in its rolling 1+14 cycle.

Completing New Virtual Hard Disk Wizard summary page with Finish button visible — Finish to create the disk. Hyper-V allocates the file on the host — this takes a minute or two for a fixed-size disk.

VM Settings dialog confirming the new hard drive is attached with Apply and OK buttons — Back at VM Settings: new disk attached on SCSI > Apply > OK. Lab VM is now visible to the new dedicated backup VHDX.

VM Settings > SCSI Controller > Hard Drive > Add > New > VHDX, Fixed size, sized for one full server backup. Lab can be small (20–40 GB). Production should be at least full backup size × 1.5 to cover the 1-full + 14-incremental rolling window.

Don’t reuse an existing data disk — WSB will format the destination during schedule creation.

Step 3 — Online and initialize the disk inside the VM

Server Manager dashboard inside the lab VM after logging in showing local server view — Log into the lab VM. We’ll prep the disk and install Windows Server Backup inside the VM next.

Disk Management console showing the new offline disk highlighted with Online context menu option — Open `diskmgmt.msc`. The new disk appears as offline. **Right-click > Online**.

Disk Management with the new disk online and the Initialize Disk dialog open — Right-click the now-online disk > **Initialize Disk**.

Initialize Disk dialog with GPT partition style selected and OK button visible — Pick **GPT**. MBR caps at 2 TB and has nothing else going for it on a modern OS. GPT is the right answer for any new disk.

Log into the lab VM > diskmgmt.msc > right-click the new disk > Online > right-click again > Initialize Disk > GPT.

Don’t create a volume on it yet. WSB will format the entire disk when we point a Backup Schedule at it — any volume you create now gets blown away.

Step 4 — Install Windows Server Backup

Server Manager Add Roles and Features wizard showing Windows Server Backup feature being added — Add the **Windows Server Backup** feature (Server Manager > Add Roles and Features > Features). Or one-liner: `Install-WindowsFeature Windows-Server-Backup`. No reboot.

Same as Part 1: Server Manager > Add Roles and Features > Features > Windows Server Backup. Or PowerShell: Install-WindowsFeature Windows-Server-Backup.

Step 5 — Configure the Backup Schedule (yes, Schedule, not Backup Once)

Server Manager Tools menu open with Windows Server Backup option highlighted — Server Manager > **Tools > Windows Server Backup**.

Windows Server Backup console with Backup Schedule action selected and Custom configuration chosen — Action pane > **Backup Schedule**. Why Schedule and not Backup Once? Because *Backup Once* doesn’t let you pick a dedicated disk as destination — only Schedule does. We’ll trigger the scheduled run manually right after we configure it.

Open WSB > Backup Schedule > Custom > Next.

Why Backup Schedule for a one-shot test? Because Windows Server Backup’s Backup Once path does not let you pick a dedicated disk as the destination — only Backup Schedule does. We’ll configure the schedule, then trigger a one-shot run from Backup Once > Scheduled backup options. That hybrid is the workaround for the dedicated-disk + immediate-run combination.

Step 6 — Pick Bare Metal Recovery

Select Items for Backup page with Add Items button visible — Add Items.

Select Items dialog with Bare metal recovery checkbox ticked to include OS volume and system state — Tick **Bare metal recovery** > OK. This is the critical pick for a bare-metal backup — it auto-includes the system reserved partition, the OS volume, and system state in one bundle that lets WinRE drive a full machine restore.

Select Items for Backup page with Bare metal recovery now in the items list and Advanced Settings button visible — Bare metal recovery now in the list. Click **Advanced Settings**.

Add Items > tick Bare metal recovery > OK.

The Bare Metal Recovery checkbox auto-includes:

System Reserved partition (~500 MB UEFI boot data)
OS volume (C:)
System State (NTDS.DIT, SYSVOL, registry, etc.)
EFI partition (UEFI machines)

Tick only system state instead and you get an AD recovery, but you can’t do a true bare-metal restore from WinRE. Always pick Bare Metal Recovery for the full-machine recovery scenario.

Step 7 — VSS Full Backup

Advanced Settings dialog VSS Settings tab with VSS full backup option selected — **VSS Settings > VSS full backup**. (See Part 1 for the full vs copy explanation.) For your primary backup tool, always Full.

Select Items page after Advanced Settings closed showing items confirmed with Next button visible — Back to Select Items page > Next.

Advanced Settings > VSS Settings > VSS full backup. (Full = primary backup tool, Copy = secondary tool. See Part 1.)

Step 8 — Schedule time and destination

Specify Backup Time page with default daily schedule retained for the test backup — Schedule time — keep default for the test. We’ll trigger a manual run in a moment.

Specify Destination Type page with Back up to a hard disk that is dedicated for backups selected — **Back up to a hard disk that is dedicated for backups**. The newly attached VHDX is what we picked here.

Select Destination Disk page with Show All Available Disks button highlighted — Show All Available Disks.

Show Available Disks dialog with the newly attached backup VHDX checked — Tick the new backup VHDX. WSB will format it and own it exclusively after this confirmation.

Select Destination Disk page now showing the chosen disk in the list — Confirm the chosen disk > Next.

Confirmation page showing summary of bare metal backup schedule with Finish button — Final summary > **Finish**. WSB formats the disk and creates the scheduled task.

Summary success page showing You have successfully created the backup schedule — Schedule created. Backup will run on the schedule we set, but we want to test *now*.

Schedule time: keep default for the test — we’re going to run it manually anyway. Destination: Back up to a hard disk that is dedicated for backups. Show All Available Disks > tick the new VHDX. Confirm > Finish.

WSB formats the disk and creates the scheduled task. Close.

Step 9 — Trigger the test run immediately

Windows Server Backup console with Backup Once action selected and Scheduled backup option chosen for immediate run — **Backup Once** > pick *Scheduled backup options* > Next. This reuses the schedule we just configured (so it knows the destination and the items) but runs immediately. The pure Custom Backup Once path can’t target a dedicated disk — this hybrid is the workaround.

Confirmation page for Backup Once with Backup button highlighted to start the run — Confirmation > **Backup**. Backup runs — capturing the OS volume, system state, and system reserved partition.

Backup completed page showing successful bare metal backup with Close button — **Completed**. Close. Duration depends on VM size — expect 5–15 minutes for a typical lab DC.

Actions pane > Backup Once > Scheduled backup options > Next. This is the “run my scheduled backup now” path — reuses the schedule we just configured but kicks off immediately. Click Backup.

Backup runs. Time: 5–15 min for a small lab DC, longer for production. Status: Completed.

Windows Server Backup console showing the new bare metal backup in the recent activity pane with backup details — Backup details in the recent activity pane: timestamp, status, size, items captured. This is where you confirm the test backup is the right shape (Bare metal recovery, not just System State).

Check the recent activity pane. Confirm: Bare Metal Recovery, completed timestamp, no warnings.

Step 10 — Verify the backup artifact on disk

This is the verification step that everyone skips. Don’t skip it.

Disk Management console with the backup destination disk right click menu showing Change Drive Letter and Paths option — Now verify the backup artifact on disk. Disk Management > right-click the backup disk > **Change Drive Letter and Paths**. WSB unmounts the disk between runs to prevent accidental writes; we temporarily mount it to peek inside.

Change Drive Letter and Paths dialog with Add button visible to assign a temporary drive letter — Add a drive letter.

Add Drive Letter dialog with letter selected and OK button visible — Pick any free letter > OK.

Disk Management > right-click the backup disk > Change Drive Letter and Paths > Add > pick a free letter (we used T:). This temporarily mounts the disk so we can browse it. WSB normally keeps its dedicated disk un-mounted to prevent accidental writes.

File Explorer showing WindowsImageBackup folder on the temporarily mounted backup disk — File Explorer to the new drive letter. You should see `WindowsImageBackup` at root — this is the standard WSB layout. Inside: per-server folders, then per-version timestamped folders, then the actual VHD-format backup files.

File Explorer showing the contents of the WindowsImageBackup folder including the per server subfolder with VHD files — Drill into `WindowsImageBackup\<SERVERNAME>\Backup <date>`. The `.vhd` files are the per-volume snapshots; WSB structures these so WinRE can stream them back during a bare-metal restore.

Open the new drive letter in File Explorer. You should see:

T:\
└─ WindowsImageBackup\
   └─ <SERVERNAME>\
      └─ Backup <YYYY-MM-DD HHMMSS>\
         ├─ <system-reserved-vhd>.vhd
         ├─ <OS-volume-vhd>.vhd
         └─ BackupSpecs.xml + catalog files

The .vhd files are virtual hard disks — one per source volume. You can actually mount these in another machine to confirm they’re readable, but for a routine verification, presence + size + timestamp is enough.

Step 11 — Remove the drive letter (important)

Change Drive Letter and Paths dialog reopened to remove the temporary drive letter — Important: **remove the drive letter** when done inspecting. Disk Management > Change Drive Letter and Paths.

Remove Drive Letter confirmation dialog with Yes button to unassign and re lock the disk — Remove > Yes. The disk drops back to no-letter / WSB-only state. Without this step, the disk stays mounted and the next scheduled backup may fail because the disk isn’t in expected exclusive state.

Disk Management > Change Drive Letter and Paths > Remove > Yes.

If you leave the drive letter assigned, the next scheduled backup may fail because the disk isn’t in WSB’s expected exclusive state. Always remove the letter after inspecting.

Things that bite people

Testing on a production DC

The test in Part 4 wipes the VM. If that’s a production DC, you’re recovering for real. Always use a disposable lab VM. If you don’t have one, build one — this is one of the most valuable lab exercises in AD admin.

Using Backup Once with Custom for a dedicated disk

Doesn’t work. Backup Once Custom can only target a local drive with a letter or a remote share — not a dedicated WSB-owned disk. The Schedule + run-now hybrid we used is the workaround. Be aware: this confuses anyone reading docs that say “just Backup Once.”

Picking System State instead of Bare Metal Recovery

Both checkboxes exist. System State gives you AD recovery only. Bare Metal Recovery gives you full-machine recovery and System State. For this test (and any disaster scenario), always pick Bare Metal Recovery.

Backup disk too small

WSB doesn’t fail upfront if the disk can’t fit the backup — it starts the backup, then runs out of space mid-run and errors. Rule of thumb: dedicated backup disk ≥ 1.5× the full backup size of the source.

Forgot to remove the drive letter after inspecting

WSB expects exclusive control of the dedicated disk. Leave a letter assigned and the next scheduled run may fail with event log errors about the disk not being in expected state. Always remove the letter.

Verifying by checking only the Recent Activity pane

The pane shows what WSB thinks happened. It doesn’t show whether the artifact is actually intact on disk. Always mount + browse + confirm the WindowsImageBackup folder structure exists with sensibly-sized .vhd files.

What’s next

You have a verified bare-metal backup of the lab VM. Part 4 deletes the VM and restores it from this exact backup using the Windows Recovery Environment + System Image Recovery. We’ll boot the replacement VM from the 2019 ISO, jump into WinRE, point at the backup disk, and watch the machine come back.

Tags: #Active Directory #Backup #Bare Metal Recovery #Disaster Recovery #Hyper-V #Windows Server