Backup and disaster recovery for Windows Server 2022 VPS in Vietnam

A dead Windows Server 2022 VPS in a Vietnam datacenter is rarely the disaster people fear. The real disaster is discovering at 2 AM that your nightly backup job has been failing silently for three weeks, or that the only copy of your database sits on the same NVMe volume as the OS. This guide builds a defensible backup and disaster recovery (DR) setup for a Windows Server 2022 VPS backup Vietnam environment: image-level backups, VSS-consistent shadow copies, offsite replication, and a restore drill you actually run.

• Windows Server Backup (WSB) still ships with Server 2022 and handles full-volume image backups, including bare metal recovery.
• VSS gives you application-consistent snapshots; a crash-consistent copy of a live SQL Server is not good enough.
• Keep at least three copies: live volume, local backup disk, offsite target outside Vietnam.
• A restore you have not tested is not a backup. Schedule a quarterly drill on a spare VPS.

越南 VPS 上的备份必须至少保留一份异地副本，并定期演练恢复。

On a VPS in Vietnam, keep at least one offsite copy of the backup and rehearse the restore on a schedule.

Why a VPS backup plan differs from a physical server

On bare metal you control the disks, the RAID controller and the tape library. On a KVM VPS you control none of that. The hypervisor can snapshot the whole guest, but that snapshot lives on the provider's storage, and provider snapshots are a convenience, not a DR strategy. They protect you against a bad config push or a botched update; they do not protect you against an account problem, a billing mistake, or a host failure.

That means the backup chain has to live inside the guest where you can reason about it. Two layers work well together: provider-level snapshots for fast rollback of the whole VM, and Windows-level backups inside the OS for granular, portable, independently stored copies. This article focuses on the second layer, because it is the one you own end to end. If your workload has outgrown a single VM, the same logic scales to a dedicated server Vietnam deployment, just with more disk to protect.

Define RPO and RTO before you touch a single tool

Recovery Point Objective (RPO) is how much data you can afford to lose, measured in time. Recovery Time Objective (RTO) is how long the service can be down. Write both numbers down before choosing software, because they decide everything else.

A typical small business workload on a Windows VPS might sit at RPO 1 hour and RTO 4 hours. A database with a nightly full and hourly transaction log backup gives you RPO 1 hour. A 200 GB image restored over the network at 100 Mbps takes roughly 4.5 hours, which fits an RTO of 4 hours only if you are restoring to local storage, not pulling it across the internet. Get the arithmetic wrong here and the rest of the plan is theatre.

Step 1 - Add a separate backup volume and format it correctly

First rule: never write backups to the same volume that holds the OS and data. On a KVM VPS you can usually attach a second virtual disk. In this example it is a 100 GB volume presented as disk 1. Run this from an elevated PowerShell session on the Windows Server 2022 VPS.

Get-Disk
Initialize-Disk -Number 1 -PartitionStyle GPT
New-Partition -DiskNumber 1 -UseMaximumSize -DriveLetter B
Format-Volume -DriveLetter B -FileSystem NTFS -NewFileSystemLabel "Backups" -Confirm:$false

WSB cannot back up to a volume that is part of a striped or spanned set, and it refuses a FAT32 target over 32 GB. NTFS on a dedicated disk avoids both traps. If your provider only offers one disk, create a VHDX on a separate partition instead of reusing the system volume, or mount an offsite target over SMB.

Verify the volume is visible and healthy before continuing:

Get-Volume -DriveLetter B | Format-List DriveLetter,FileSystem,SizeRemaining,HealthStatus

You want HealthStatus : Healthy and the full size showing as remaining.

Step 2 - Install Windows Server Backup and create the first image

WSB is a Feature-on-Demand, not installed by default on Server 2022. Install it and the command-line tools, then confirm the module loads.

Install-WindowsFeature Windows-Server-Backup -IncludeManagementTools
Import-Module WindowsServerBackup
Get-Command Get-WB* | Select-Object Name

Now take a full, VSS-consistent image of the system volume plus the data volume, writing the result to B:\. The -AllCritical switch includes the system-reserved partition and everything needed for bare metal recovery.

$policy = New-WBPolicy
$target = New-WBBackupTarget -VolumePath "B:"
$sysvol = Get-WBVolume -AllVolumes | Where-Object { $_.MountPath -eq "C:\" }
$datavol = Get-WBVolume -AllVolumes | Where-Object { $_.MountPath -eq "D:\" }
Add-WBBackupTarget -Policy $policy -Target $target
Add-WBVolume -Policy $policy -Volume $sysvol
Add-WBVolume -Policy $policy -Volume $datavol
Add-WBSystemState -Policy $policy
Add-WBVssBackupOption -Policy $policy -VssFullBackup
Set-WBSchedule -Policy $policy -Schedule 02:00
Set-WBPolicy -Policy $policy -Force

VERIFY: check that the policy exists and the schedule registered.

Get-WBPolicy
Get-WBSchedule

Then run one backup manually so you are not waiting until 02:00 to find a typo in the script.

Start-WBBackup -Policy (Get-WBPolicy)

WSB uses VSS, so SQL Server, Exchange and open files are captured application-consistently as long as their writers are healthy. Check the writers, not just the backup result:

vssadmin list writers

Every writer must report State: [1] Stable and Last error: No error. A writer stuck in [5] Waiting for completion means a backup will be crash-consistent at best.

Step 3 - Do not rely on one local copy

Local backups die with the VM. If the host storage fails, if ransomware encrypts every volume it can see, or if the provider deletes the VM by mistake, B:\ goes with it. You need a copy that leaves the building, and for a Vietnam-based VPS that usually means out of the country or at least off the provider's infrastructure.

Three options, in order of how much I trust them:

• Object storage sync. Point an aws s3 sync or rclone job at the B:\WindowsImageBackup folder after each run. Cheap, versioned if the bucket has versioning on, and immune to a compromised OS account since the credentials are scoped to one prefix.
• Remote SMB target. WSB can write directly to a network share. Simpler, but slower and it blocks if the link drops mid-run.
• Second VPS in a different location. A small instance that pulls backups over a WireGuard tunnel works well and keeps data fully under your control. A modest Linux VPS is often enough for the receiving end.

Whatever you pick, apply the 3-2-1 rule: three copies, two media, one offsite. Add a scheduled task to push the folder after the 02:00 backup finishes.

rclone sync "B:\WindowsImageBackup" remote:vps-backups/server01 --transfers 4 --checkers 8 --log-file "B:\rclone.log"

VERIFY: tail the log and list the remote to confirm object counts match.

Get-Content "B:\rclone.log" -Tail 20
rclone ls remote:vps-backups/server01 | Measure-Object -Line

Step 4 - Protect the backup target itself

A backup you can delete in five minutes is not a disaster recovery plan. Three settings matter on the VPS side.

• Create a dedicated local account that owns the backup folder, grant it write-only on the share if your target supports it, and do not run the sync job under a full Administrator token.
• Enable BitLocker or at least store the backup media offline where possible. If the backup drive is always mounted, ransomware will find it.
• Keep the OS patched and lock down RDP. Most "disasters" on Windows VPS boxes start with a stolen RDP credential, not a disk failure. See the notes below on hardening.

Restrict who can run backup commands. A user who can run Remove-WBBackupSet can wipe your history in one line.

Step 5 - The restore drill

This is the step everyone skips and the only one that matters. Schedule it quarterly, on a throwaway VPS, and time it. RTO is a measured number, not a guess.

For bare metal recovery on Server 2022: attach the image backup location, boot the installation media, choose Repair your computer, then Troubleshoot, then System Image Recovery. Point it at B:\WindowsImageBackup\ and let it run. This is exactly why -AllCritical matters; without it, the recovery environment may refuse the image.

For a single file or folder, WSB makes this trivial through the recovery wizard, but scripted recovery is faster to audit:

Get-WBBackupSet
$catalog = Get-WBBackupSet -BackupTarget (New-WBBackupTarget -VolumePath "B:")
Start-WBFileRecovery -BackupSet $catalog -FilePath "D:\sites\app\config.php" -RecoveryTarget "C:\restore-test\"

VERIFY: compare the restored file hash against the source and record the wall-clock time from start to verified restore. That number is your real RTO.

Get-FileHash "C:\restore-test\config.php" -Algorithm SHA256
Get-FileHash "D:\sites\app\config.php" -Algorithm SHA256

Troubleshooting the common failures

Backup fails with "the specified backup disk cannot be found". Windows renumbered the disk after a reboot or a VM resize. Re-run Get-Disk, confirm the drive letter, and re-add the target with Set-WBPolicy.

Backup runs but reports VSS errors. Check vssadmin list writers and vssadmin list shadowstorage. If the shadow storage area on C: is full, backups fail silently. Either increase it with vssadmin resize shadowstorage or move the shadow copy to a larger volume.

Job succeeds but the offsite sync never runs. Scheduled tasks that launch rclone need "Run whether user is logged on or not" and a stored credential, otherwise they fail with no visible error. Check Get-ScheduledTaskInfo -TaskName "OffsiteBackup" and look at LastTaskResult.

Restore is far slower than expected. On a VPS, network throughput between the backup target and the VM is usually the bottleneck, not disk. Restoring locally from B:\ is dramatically faster than pulling from object storage across the internet.

Where thueVPS fits in

A Windows Server 2022 instance on NVMe with a dedicated IPv4 and full Administrator access is the right base for this kind of plan: you can attach a second disk for local backups, install WSB without begging anyone, and run rclone or an SMB sync to an offsite target. Monthly billing also means a temporary test VPS for the quarterly restore drill costs one month, not a year of commitment. If you need a short-lived box to rehearse recovery on, a Windows VPS with full Administrator rights is the least painful way to do it.

FAQ

Related articles

• Harden Windows Server for Vietnam production in 2026
• How to back up a VPS before an upgrade
• Set up a stable Windows Server 2022 RDP VPS in Vietnam
• Secure RDP configuration for Windows VPS