Active Directory and LDAP Recovery with Bacula Enterprise

Home > Corporate Data Backup > Enterprise Data Backup Tools > Backup Active Directory & LDAP

LDAP and Active Directory are directory solutions that store information about computers and devices on the network, including but not limited to user and software configurations. Their installation and implementation may contain replicas on various computers in the organization located in local or remote areas. Backup of Active Directory is vital for an organization’s business continuity should a directory object get deleted, corrupted, or misconfigured.

When an administrator deletes the wrong user account, for instance, or corrupts an object’s attributes, the damage is narrow but the standard fix is not. A conventional backup tool cannot reach inside the directory to pull back a single object, because it copies the entire database file and restores it as one sealed unit. As a result, you are only left with rolling the entire directory back to its last copy, which also discards every legitimate change made since that copy was taken. Bacula attributes roughly 90% of all LDAP-related data loss to operator error and software failure, which is what most teams face, as opposed to full-server disasters.

To counter and prevent these types of incidents, Bacula Enterprise utilizes the Directory Server Module, which ships with two plugins. The LDAP Plugin backs up and restores individual objects on any LDAP directory, including OpenLDAP, Novell/SUSE eDirectory, and DS389. The MSAD Plugin does the same for Active Directory, and it adds handling for the attributes specific to AD, such as SID, objectGUID, memberOf, and userAccountControl. With Bacula Enterprise’s LDAP and AD plugins, you recover the one object that was lost or altered, and the rest of the directory keeps running untouched.

Download Trial Directory Server / LDAP whitepaper

Key Benefits of Bacula Enterprise’s LDAP and AD Plugins

LDAP Directory Recovery

Single-Object Restore – Pull back one deleted user or organizational unit from any LDAP directory, including OpenLDAP, eDirectory, and DS389, without rolling the whole directory back to last night. The LDAP Plugin saves every object as its own catalog item, which is what makes single-object recovery feasible.
Backup Level Support – The LDAP Plugin runs Full, Differential, and Incremental backup jobs against any LDAP directory, so you can tune your backup schedule and retention window to match the directory’s rate of change.
Accurate Mode – Delete an entry between two scheduled backups and Accurate mode still catches the deletion, because the LDAP Plugin compares the live directory against the catalog instead of trusting timestamps.
Object Relocation – Restore a recovered object into a staging branch like ou=staging instead of its live location by setting one relocation DN, so you inspect it before it rejoins production.
Replace Control – Four modes (always, never, ifnewer, and ifolder) decide how the LDAP Plugin handles an existing object at restore, so a recovery never overwrites a newer live object by accident.

Active Directory (MSAD) Recovery

Tombstone Recovery – When you restore a deleted AD object, the MSAD Plugin pulls its tombstone to recover system attributes like SID and objectGUID, which no other restore method can bring back.
Group Membership Recovery – Group memberships come back on their own. The MSAD Plugin reads the restored object’s memberOf attribute and re-adds it to every group it belonged to, so you never rebuild memberships by hand.
Account State Reporting – Permissions to write userAccountControl are checked during restore, and the outcome lands in the job log. You know immediately if a recovered account needs a permissions fix.

Operational Simplicity

Catalog-Tracked Objects – Every object’s size and modification time is recorded in the Bacula Catalog, which is what makes incremental and differential backups of the directory possible.
Console Object Browsing – Browse the directory tree directly in the Bacula console with listing mode and confirm the exact object before you restore it.
Fast Setup – Point either plugin at a directory with four parameters: the LDAP URI, base DN, bind DN, and password. The backup is ready to run.

All LDAP and AD Plugin Features by Bacula Enterprise

The MSAD plugin required a complete rewrite of the query logic and code to correspond to Microsoft’s specific fields, structures, and Active Directory Schema, which is why it exists as a separate sub-module from the LDAP plugin.

LDAP and AD Backup Capabilities

Object-Level Backup – The LDAP and MSAD plugins back up each directory object as a separate item rather than capturing the directory database as one file. Each object is stored under a virtual namespace in the Bacula Catalog, prefixed with ldap: or msad:, with the directory information tree represented as a directory structure.
Backup Levels – Both plugins support Full, Differential, and Incremental backup levels (Differential and Incremental jobs rely on the object modification time recorded in the Catalog at backup).
Accurate Mode – The LDAP and MSAD plugins detect objects deleted between backups by comparing the live directory against the Bacula Catalog.
Single Base Query – Each backup runs a single base query from the BASEDN parameter to enumerate every object in the subtree, using a paged control response to retrieve all available objects from the server.
Full Attribute Capture – The plugins save every standard and extended attribute returned by the server, including system and dynamic attributes. Attributes that cannot be restored later, such as read-only attributes, are still captured at backup time.
Encrypted Transport – The LDAP plugin connects to the directory over ldaps (SSL) when configured. TLS behavior is controlled through the TLS_CACERT, TLS_CACERTDIR, TLS_CERFILE and TLS_REQCERT parameters in the plugin configuration file.

LDAP and AD Restore Capabilities

Object-Level Restore – Objects are restored to a working LDAP or MSAD server only. The plugins cannot restore objects to a local filesystem, because directory objects hold their data as attributes, not as file contents.
Original-Location Restore – A restore run with the where=/ parameter returns objects to their original position in the directory tree.
Relocation Restore – A restore run with a where= relocation DN places objects into a different subtree. Relocation recovers the whole object subtree path, in the same way that where=/tmp/restores works for regular files.
Restore Options Interface – Option 13 in the restore modification interface exposes plugin variables that override the restore target. The interface accepts a different basedn, ldapuri, binddn, bind password, and config file, which redirects the restore to a different server or bind user.

Operational Features

Console Object Listing – The .ls command browses LDAP or MSAD objects directly from the Bacula console, using the client, plugin, and path parameters. A path of / displays the server’s default naming context, and a path of a DN displays that DN’s child objects.
FileSet Testing – The estimate listing command tests a FileSet before a real backup runs, displaying the objects the plugin would capture under the configured BASEDN.
Flexible Configuration – Connection parameters can be supplied through a per-plugin config file, ldap.conf or msad.conf, or inline on the Plugin= FileSet line. A separate config file can be named per FileSet to point backups at different directory servers.
Password Obfuscation – The bind password can be stored in obscured form using the hbindpass parameter. The bconsole @encode command generates the obscured value, which removes the plaintext password from the configuration file.
Least-Privilege Backup Account – The plugin requires a directory account with permission to query and read objects. This can be a standard account holding a Backup Operator role rather than a full administrator account.

Platform and Version Support

Linux File Daemon – Both plugins run on a Linux File Daemon. The MSAD plugin backs up Microsoft Active Directory over the network from that Linux host, and installation of the MSAD plugin on a Windows Server is not currently supported. This restriction may change in a future release.
Active Directory Versions – The MSAD plugin supports Microsoft Active Directory from Windows Server 2003 onward, and connects to the AD server using the LDAP network protocol.
LDAP Server Compatibility – The LDAP plugin works with any directory reachable over the LDAP protocol, including OpenLDAP, Novell/SUSE eDirectory, and DS389. OpenLDAP is the tested reference server, and directories other than OpenLDAP should be validated before production use.
Bacula Enterprise Version – The LDAP and MSAD plugins apply to Bacula Enterprise version 10 and later. The plugins are not available for earlier Bacula Enterprise versions.

LDAP and Active Directory Backup Security with Bacula Enterprise

Bacula Enterprise secures LDAP and Active Directory backup environments through encrypted transport to the directory server, obscured bind credentials, least-privilege account access, and an agentless architecture that installs nothing on the domain controller itself.

Encrypted Directory Transport – The LDAP plugin connects to the directory server over ldaps (SSL), with transport behavior governed by the TLS_CACERT, TLS_CACERTDIR, TLS_CERFILE and TLS_REQCERT parameters in the plugin configuration file.
Credential Protection – The bind password used to authenticate against the directory can be stored in obscured form using the hbindpass parameter.

Least-Privilege Backup Account – The LDAP and MSAD plugins require only a directory account with read and query permissions; a standard account holding a Backup Operator role is sufficient. Full administrator credentials are not required for backup operations.
Agentless Domain Controller Architecture – The MSAD plugin runs on a separate Linux File Daemon and connects to the Active Directory server over the network using the LDAP protocol; nothing is installed on the domain controller itself.

Bacula Enterprise Backup and Recovery Features Across All Environments

Bacula’s LDAP and Active Directory backup plugins are part of a unified enterprise backup platform. Every capability listed below is available across all Bacula Enterprise installations, regardless of the environment or workload.

Backup Storage and Cost Control

Bacula Enterprise gives administrators direct control over storage costs through data reduction and flexible destination routing.

Block-Level Deduplication – Any data block that appears more than once across the backup catalog is written to storage only once. Storage consumption drops without any change to backup policy or schedule.
Adaptive Compression – Compression algorithms are configurable per job. Administrators tune compression based on data type and available resources.
Multiple Storage Target Types – Backups write to local disk, NAS, SAN, tape libraries, cloud object storage including S3, Azure, and Google Cloud, or any combination within a single policy.
S3-Compatible Object Storage – Bacula connects to any S3-compatible provider for long-term retention without vendor lock-in.
Tiered Storage Workflows – Backup data can be configured to move across storage tiers automatically as it ages. Frequently accessed recovery points stay on fast storage and older data shifts to lower-cost destinations.
Incremental Forever – After an initial full backup, every subsequent job captures only what has changed. Recurring full backup windows are no longer necessary.
Bandwidth-Conscious Transfers – Only modified data crosses the network between backup runs. Production network load stays low without manual throttling or scheduling workarounds.

Backup Security and Compliance

Security and regulatory compliance are built into every layer of the platform, from data transport and storage encryption to access control and audit logging.

AES-256 Encryption – AES-256 encryption covers the full data path from source client to final storage destination. Key management is configurable to fit organizational security policies.
Immutable Backup Copies – WORM-compatible storage locks backup data against modification or deletion once written. Ransomware and insider threats have no path to the recovery point.
Granular Access Controls – User permissions scope to specific jobs, restore workflows, and management functions. Each administrator accesses only what their role requires.
Complete Activity Auditing – Every backup, restore, and configuration change is logged with user identity and timestamp. Compliance and security teams get a full, unbroken audit trail.
Regulatory Framework Support – Platform controls map to GDPR, HIPAA, and SOC 2 requirements through encryption, configurable retention policies, and detailed audit logs.
Privacy-Preserving Architectures – Zero-knowledge deployment options allow backup infrastructure to run without granting administrators any visibility into the protected data.

Backup Management and Administration

Two complementary interfaces and a full suite of management tools provide visibility and control across all backup operations.

Dual Interface – BWeb provides a graphical console for day-to-day job management and monitoring. Bconsole (user agent) gives operators full command-line control for scripting, automation, and advanced configuration.
Scalability Without Limits – The same platform architecture manages environments from a handful of servers to deployments numbering in the thousands, all under a single management plane.
Automatic Resource Discovery – The platform scans infrastructure to identify and catalog backup targets automatically. Protection coverage stays current as the environment grows.
Detailed Reporting – Scheduled reports cover job outcomes, capacity trends, compliance status, and operational performance on a defined cadence.
External System Integration – Bacula connects to monitoring tools, IT ticketing systems, and directory services including LDAP and Active Directory. No custom development is required.

Multi-Environment Backup Coverage

Physical servers, virtual machines, containers, and cloud infrastructure all fall within a single unified backup strategy.

Multi-Platform Virtualization – Native integration for VMware vSphere, Hyper-V, KVM, Red Hat Virtualization, Xen, Azure VM, Proxmox, and Nutanix AHV with consistent policy application across all platforms.
Physical and Virtual Convergence – Physical servers, workstations, and virtual machines are protected through the same management interface with unified backup policies.
Container and Cloud-Native Support – Full protection for Docker, Kubernetes, and OpenShift environments with persistent volume backups and application-consistent snapshots.
Multi-Cloud Storage Integration – Native support for public, private, and hybrid cloud storage including S3, S3-IA, Azure, Google Cloud, Oracle Cloud, and Glacier interfaces with Minimal Restore Cost (MRC) functionality
Database and Application Integration – Hot backup support for Oracle, SQL Server, MySQL, PostgreSQL, SAP HANA, and other mission-critical applications with full transactional consistency.

Predictable Backup Licensing

Licensing is based on environment size, not data volume. LDAP and Active Directory directories can grow without triggering higher licensing costs.

Volume-Independent Licensing – Growing backup capacity does not increase license fees. Data protection costs stay flat as data volumes expand.
Predictable Cost Structure – A fixed pricing model lets teams plan infrastructure budgets without accounting for variable costs tied to storage growth or workload changes.
Workload-Agnostic Pricing – Database sizes, server counts, and storage volumes have no effect on licensing costs.
Large-Scale Cost Benefits – Organizations protecting large or rapidly growing LDAP and Active Directory environments pay the same license fee regardless of how much data they add. The cost advantage over capacity-priced competitors grows as data volumes increase.

Recovery and Business Continuity

Every recovery scenario has a defined path, from single-file restores to full site rebuilds.

System-Level Bare Metal Restore – Bacula Enterprise recovers a complete server from scratch including the operating system, applications, configuration, and data without requiring a prior manual installation.
Cross-Platform Data Movement – Backup data can be recovered to a different operating system than its source. Teams have options when like-for-like hardware is unavailable or a migration is underway.
Geographic Backup Replication – Backup sets are copied to geographically separate storage locations. A site-wide outage does not take recovery points down with it.
Frequent Backup Scheduling – The potential data loss window shrinks to minutes.
Automated Restore Validation – Recoverability is confirmed through automated testing without administrator involvement or a separate validation process.

Frequently Asked Questions

How does the Bacula Enterprise LDAP plugin achieve single-object backup and granular restore?

The LDAP plugin runs a single base query from the configured BASEDN and saves every object it finds as a separate item in the Bacula Catalog. Each object is stored under a virtual namespace prefixed with ldap: and represented as a directory tree. At restore time, you navigate that tree in the Bacula console, select the exact object you need, and restore it directly to the live directory without touching anything else.

What configuration parameters are required to connect the plugin to a directory server?

Four parameters are required: the LDAP URI (ldapuri), the bind user Distinguished Name (binddn), the bind password (bindpass), and the base Distinguished Name (basedn). These can be supplied through a dedicated configuration file, ldap.conf for the LDAP plugin and msad.conf for the MSAD plugin, or inline on the Plugin= line in the Fileset definition.

How does Accurate mode detect deleted LDAP objects?

Accurate mode compares the live directory state against the Bacula Catalog at the time of each backup. When an object exists in the Catalog from a previous job but is no longer present in the live directory, the plugin records it as deleted. This catches deletions that occur between scheduled backup runs, which timestamp-based detection would miss.

What replace options are available during an LDAP or AD restore?

Four replace modes are available for this: always, never, ifnewer, and ifolder. Always overwrites the existing object unconditionally. Never skips the object if it already exists. Ifnewer restores only if the backed-up object is more recent than the live one. Ifolder restores only if the backed-up object is older. The mode is selected during the bconsole restore command and can be changed before the job runs.

Can the LDAP plugin back up directories other than Microsoft Active Directory?

Yes. The LDAP plugin works with any directory server that speaks the LDAP protocol, including OpenLDAP, Novell/SUSE eDirectory, and DS389. The MSAD plugin is the one specific to Microsoft Active Directory. For directory servers other than OpenLDAP, the plugin should be tested before use in production.

Why does the MSAD plugin run on Linux while backing up a Windows Active Directory server?

The MSAD plugin installs on a Linux File Daemon and connects to the Active Directory server over the network utilising the LDAP protocol. Nothing is installed on the domain controller itself.

How does the MSAD plugin handle Active Directory tombstone recovery?

When you restore a deleted AD object, the MSAD plugin automatically checks whether a tombstone exists for that object. If one is found, the plugin recovers the object from its tombstone and restores the remaining attributes from the backup. This returns system attributes like SID and objectGUID, which cannot be recovered through other restore methods. Tombstone recovery runs automatically and cannot be disabled.

What Active Directory versions does the MSAD plugin support?

The MSAD plugin supports Microsoft Active Directory from Windows Server 2003 onward, including current and future Windows Server versions.

Can individual user accounts or group objects be restored without rolling back the entire Active Directory?

Yes. The MSAD plugin saves every AD object as its own catalog item. You restore a single user account, group, or organizational unit directly to the live AD server without affecting any other object in the directory. Rolling back the entire directory is no longer required and is not performed.

Can the MSAD plugin restore to a different Active Directory server than the one it backed up from?

Yes. The restore options interface, accessible via option 13 in the bconsole restore command, accepts a different ldapuri and binddn at restore time. This redirects the restore to a different server without changing the original plugin configuration.

What happens if a restored AD object’s userAccountControl attribute cannot be written?

The MSAD plugin checks whether the restore user has permission to write userAccountControl during the restore job. When permission is insufficient, the attribute is restored with default flags, which leaves the account in a disabled state. The plugin records the outcome in the job log so the administrator knows immediately that a permissions fix is needed.

How are full, differential, and incremental backups handled for Active Directory environments?

The MSAD plugin supports all three backup levels. A Full backup captures every object in the directory subtree from the configured BASEDN. An Incremental job captures objects modified since the last backup of any level. A Differential job captures objects modified since the last Full backup. Object modification times are recorded in the Bacula Catalog and used to determine what each subsequent job needs to capture.

Active Directory and LDAP Backup and Recovery

Back Up and Recover Individual LDAP and Active Directory Objects with Bacula Enterprise