1-800-691-1991 | 9am - 8pm ET

DC restore or sure backup fails due to shadow copy expiration


DC restore results in DSRM boot and event id 1918 from ActiveDirectory_DomainService stating:  

The shadow copy service cannot restore Active Directory Domain Services because the shadow copy used is too old.


The backup of the DC is older than the tombstone period. 
Active Directory protects itself from restoring data older than the tombstone lifetime (180 days) by disallowing the restore. As a result, the useful life of a backup is equivalent to the tombstone lifetime setting for the enterprise. Reference:  

Thus Veeam does not support restore from such backups either.


Restore or run sure backup from the backups which were created within the tombstone period.

Setting the time on the DC before the shadow copy expiration date may be a solution for the a single DC restore scenario, but if it is not a single DC, even if the replication starts, there can be a situation when the object remains present only on the restored domain controller, resulting in inconsistent data. So it is not advisable to perform that in case the DC you are restoring is not a single one. 
Veeam Backup & Replication
Version: 7.x, 8.x, 9.x
Last Modified:
Please rate how helpful this article was to you:
5 out of 5 based on 1 ratings
Thank you for helping us improve!
An error occurred during voting. Please try again later.

Couldn't find what you were looking for?

Below you can submit an idea for a new knowledge base article.
Report a typo on this page:

Please select a spelling error or a typo on this page with your mouse and press CTRL + Enter to report this mistake to us. Thank you!

Spelling error in text

Knowledge base content request
By submitting, you agree that your personal data will be managed by Veeam in accordance with the Privacy Policy.

ty icon

Thank you!

We have received your request and our team will reach out to you shortly.


error icon

Oops! Something went wrong.

Please go back try again later.