# Backup and incident response for a Windows web server

> Back up config, content, certificates and data separately, test restore, and run a containment-to-recovery incident sequence.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Back up separately:

- **Config** — IIS `applicationHost.config`/site XML, Nginx conf, service definitions.
- **Content** — site files and uploads (with ACLs).
- **Certificates** — PFX + private keys, exportable and access-controlled.
- **Data** — databases/app state, with a consistent backup method.
- **Secrets** — vault/secret store, not a text file on the web root.

A VM snapshot is not a backup strategy: it is not off-host, not retention, and not a restore test.

## IIS config

```powershell
C:\Windows\System32\inetsrv\appcmd.exe add backup "before-change"
C:\Windows\System32\inetsrv\appcmd.exe list backup
```

Copy backups off the server. Also back up site `web.config` and app pool identities (gMSA/custom accounts are external).

## Restore test

At least quarterly:

1. Restore config to a clean VM.
2. Restore content + ACLs.
3. Import certificates.
4. Start services; test Host header + HTTPS.
5. Record RTO/RPO actuals.

A backup you have never restored is a hypothesis.

## Incident response sequence

1. **Detect/validate** — alerts, user report, unusual outbound.
2. **Contain** — isolate the VM/network, disable compromised accounts, block IPs; preserve evidence.
3. **Eradicate** — remove webshell/malware, patch the entry point, rotate credentials/keys.
4. **Recover** — rebuild from trusted images/backups, restore data, verify integrity.
5. **Lessons** — timeline, root cause, controls, owners.

Do not “clean” a compromised web server and put it back without understanding persistence (services, scheduled tasks, IIS modules, PHP extensions).

> **Caution: Preserve logs before rebuilding**
>
> Export IIS/Nginx logs and Windows events to write-once/off-host storage before you wipe the host. Rebuilding destroys the evidence you need for scope and notification.

## Runbook fields

```text
App:            api-a
RTO/RPO:        1h / 15m
Backups:        config nightly, content daily, DB 15m
Off-host:       yes (bucket/vault)
Restore test:   last date + result
Cert expiry:    date + owner
Contacts:       app owner / security / hosting
```

## Lab boundary

E1. The lab used PVE snapshots and `appcmd` backups but did not run a full restore or IR exercise. The runbook is the production plan for Server 2025.

## Sources

- [Microsoft Learn — IIS configuration settings](https://learn.microsoft.com/en-us/iis/manage/managing-your-configuration-settings/)
- [NIST SP 800-61 — Incident response](https://csrc.nist.gov/pubs/sp/800/61/r3/final)
- [Microsoft Learn — Group Managed Service Accounts](https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview)

---

Source: https://winbook.fyi/en/server/security/backup-ir/