Applications • Permissions Required for Backup and Restore of Active Directory

Hi,
As per the title, I'm looking to setup Active Directory Backup and Restore, but am unsure of the permissions required.
Some documents say a standard AD User Account added into the BUILT-IN\Administrators group on the Domain Controller, others say a full Domain Admin.
I'd rather not add unnecessary permissions (and would likely get queried by security on adding full domain admin rights), so what is actually needed?
Would the preferred account type be a gMSA, MSA or "user" account (I think gMSA)?
Would Domain Admin rights only be needed for a restore, rather then backup and could the credentials of the person running the restore be "passed through" as they would likely be a Domain Admin?

Thanks,
Richie

Statistics: Posted by Richie Rogers — Jul 17, 2025 8:44 am

---