Scheduled Windows Server Backup with Task Scheduler: complete guide

Create the folder structure at the destination — it can be a secondary disk, network share, or mounted volume:

New-Item -Path "D:\Backup\Files" -ItemType Directory
New-Item -Path "D:\Backup\SQL" -ItemType Directory
New-Item -Path "D:\Backup\SystemState" -ItemType Directory
New-Item -Path "D:\Backup\Logs" -ItemType Directory

Separating files, databases, and system state into distinct folders makes independent rotation easier — you can retain 7 days of files but 30 days of database backups, for example.

Apply restrictive NTFS permissions on the root directory:

icacls "D:\Backup" /inheritance:r
icacls "D:\Backup" /grant:r "Administrators:(OI)(CI)F"
icacls "D:\Backup" /grant:r "svc_backup:(OI)(CI)F"
icacls "D:\Backup" /grant:r "SYSTEM:(OI)(CI)F"

Backups contain sensitive data — limiting access to the service account, SYSTEM, and Administrators reduces attack surface in case of a regular user compromise.

Create the script C:\Scripts\backup-files.ps1:

$source = "C:\Data"
$destination = "D:\Backup\Files"
$logPath = "D:\Backup\Logs\files-$(Get-Date -Format 'yyyy-MM-dd').log"

robocopy $source $destination /MIR /COPYALL /R:3 /W:10 /MT:8 /LOG:$logPath /NP /TEE

$exitCode = $LASTEXITCODE
if ($exitCode -ge 8) {
    Write-EventLog -LogName Application -Source "BackupScript" -EventId 1001 -EntryType Error -Message "Backup failed with code $exitCode"
    exit 1
}
exit 0

The parameters here matter. /MIR mirrors source to destination (deletes files that disappeared). /COPYALL preserves NTFS permissions, timestamps, owner, and auditing. /R:3 /W:10 retries 3 times with 10 seconds between attempts — balances robustness and time. /MT:8 parallelizes with 8 threads.

Register the Event Log source once (so Write-EventLog works):

New-EventLog -LogName Application -Source "BackupScript"

This allows the script to write to Event Viewer > Applications, integrating with monitoring systems that read the Windows log.

Create the script C:\Scripts\backup-sql.ps1:

$date = Get-Date -Format 'yyyy-MM-dd_HHmm'
$destination = "D:\Backup\SQL"
$databases = @("MyApp", "ClientPortal")

foreach ($db in $databases) {
    $file = "$destination\$db-$date.bak"
    $query = "BACKUP DATABASE [$db] TO DISK = '$file' WITH COMPRESSION, CHECKSUM, INIT"
    sqlcmd -S localhost -E -Q $query
    if ($LASTEXITCODE -ne 0) {
        Write-EventLog -LogName Application -Source "BackupScript" -EventId 1002 -EntryType Error -Message "SQL backup failed: $db"
    }
}

COMPRESSION reduces .bak size by 60-80% for most workloads. CHECKSUM verifies integrity during backup — you discover corruption at the right moment, not at restore time. INIT overwrites previous media if the filename matches.

Verify that the feature is installed:

Install-WindowsFeature Windows-Server-Backup -IncludeManagementTools

If it was already installed, the command returns without action. On freshly provisioned servers, this adds the full backup capability + PowerShell cmdlets.

Create the script C:\Scripts\backup-systemstate.ps1:

$date = Get-Date -Format 'yyyy-MM-dd'
$destination = "D:\Backup\SystemState"

wbadmin start systemstatebackup -backupTarget:$destination -quiet

if ($LASTEXITCODE -ne 0) {
    Write-EventLog -LogName Application -Source "BackupScript" -EventId 1003 -EntryType Error -Message "SystemState backup failed"
}

System state backup captures the registry, COM+ database, boot files, and (on domain controllers) the entire AD. It runs in 5-15 minutes on a typical server.

Open Task Scheduler as Administrator (taskschd.msc) and create a task via “Create Task” (not “Create Basic Task” — that one doesn’t expose all options).

On the General tab:

• Name: Daily Backup - Files
• Account: svc_backup (click “Change User or Group”)
• Check: “Run whether user is logged on or not”
• Check: “Run with highest privileges”
• Configure for: Windows Server 2022 (or 2019)

On the Triggers tab, add a new trigger:

• Begin the task: On a schedule
• Daily, at 02:00
• Check “Enabled”

Distributing backups across different times (files 02:00, SQL 03:00, system state 04:00) avoids I/O spikes and contention at the destination.

On the Actions tab, add “Start a program”:

• Program/script: powershell.exe
• Add arguments: -NoProfile -ExecutionPolicy Bypass -File "C:\Scripts\backup-files.ps1"

-NoProfile skips PowerShell profile loading (faster, more predictable). -ExecutionPolicy Bypass avoids blocking by restrictive execution policy without changing global configuration.

On the Settings tab:

• Check “Allow task to be run on demand”
• Check “Run task as soon as possible after a scheduled start is missed”
• Check “If the task fails, restart every: 10 minutes / up to: 3 times”
• “Stop the task if it runs longer than: 4 hours”

Repeat the process for backup-sql.ps1 (03:00) and backup-systemstate.ps1 (04:00, ideally Sunday only — system state is large).

Create C:\Scripts\rotation.ps1 to delete SQL backups older than 14 days:

$limit = (Get-Date).AddDays(-14)
Get-ChildItem "D:\Backup\SQL\*.bak" | Where-Object { $_.LastWriteTime -lt $limit } | Remove-Item -Force

Get-ChildItem "D:\Backup\Logs\*.log" | Where-Object { $_.LastWriteTime -lt $limit } | Remove-Item -Force

Schedule this task for 05:00 daily. wbadmin has its own rotation via -maxBackups: on start systemstatebackup.