Should I Domain Join Backup Servers?

Short answer: no.

This answer goes for both the backup server and any associated infrastructure used to actually store your backups (e.g. storage arrays). Exposed shares should also not permit domain authentication.

Here's why.

Misconfigurations Are Brutal

When everything is domain-joined, you don't need a sophisticated exploit to reach the backups - a small misconfiguration will do it.

What isn't obvious to a lot of system administrators is that backup files of a servers can be trivially opened to extract password hashes. Domain users, local administrators users, service accounts - the lot.

In the security assessments we run, one of the most common steps in our attack chains to domain administrator is discovering a backup file on an SMB share with overly permissive access controls.

Managing Blast Radius in a Breach

If an attacker gains domain administrator privileges, they will typically try to locate and destroy your backups first.

With domain administrator access, they can usually reach backup servers, network shares, and backup repositories, ensuring there is no viable path to recovery.

Our Recommendation

To reduce the blast radius of a compromise, isolate your backup infrastructure from your AD environment.

Backup servers and their associated infrastructure should not be joined to the production domain at all.

Alternatively, place the backup infrastructure in a separate Active Directory forest or domain with a strict trust model and dedicated administrative accounts.