After a heap of mucking around (I hate DOS batching), I've come up with the following. It seems to work well:
@echo off
SETLOCAL ENABLEEXTENSIONS
SETLOCAL ENABLEDELAYEDEXPANSION
FOR /f %%I IN (
'wmic volume get driveletter'
) DO (
ECHO %%I | FIND ":"
IF ERRORLEVEL 1 (
echo Failed: %%I
) ELSE (
ECHO %%I | FIND "D:"
IF ERRORLEVEL 1 (
IF NOT [!_TEMPVAR!]==[] SET _TEMPVAR=!_TEMPVAR!,
SET _TEMPVAR=!_TEMPVAR!%%I
) ELSE (
echo Skipping CD-ROM
)
)
)
wbadmin enable backup -addtarget:\\backupserver\Backups -schedule:23:00 -systemState -allCritical -vssFull -user:backupservice@domain.local -password:1234password -quiet -include:!_TEMPVAR!
A dissection is:
The first part of the batch finds all the drive letters from wmic volume get driveletter
. It checks to see that each line is actually a valid drive letter (as the output includes some verbose information that we don't need) by checking for the :
character.
Then, it checks to see if the drive is the D:
as in my situation these are all optical drives, which cause errors when specified in wbadmin
and skips them.
Then, it checks to see if the string has content in it. If it does, it suffixes a comma (,
). If the string is blank, it doesn't do anything.
Then, it goes and appends the drive letter to the the variable.
The, it execudes wbadmin
:
wbadmin enable backup
- specifies that we want to set up a Windows Backup schedule
-addtarget:\\enetsbackup1\Backups
- I want to back up to a network location, so I'm specifying it here.
-schedule:23:00
- I want the backups to run at 11pm each night
-systemState
- I want the system state included for bare metal restores
-allCritical
- I want all critical system drives included (this is important because the above script only builds visible drive letters. There may be partitions that need backing up in order to boot the server that do not have drive letters)
-vssFull
- This is the only backup we're doing on this server, so tell Windows Backup to reset the archived bit.
-user:backupservice@domain.local
- This is the account that's a member of the Backup Operators group on the domain (and also neeeds to be in the local Backup Operators group as well. This is very poorly document by Microsoft)
-password:1234password
- The password for the backup service account
-quiet
- Do not make any prompts. I'm going to be running this as a startup script in a group policy, so prompts are bad.
-include:!_TEMPVAR!
- This is the most critical part. It specifies which drives should be backed up, and includes the string of drives we collected earlier.
And just to confirm it's worked, to check it in the GUI:

Things that can probably be improved: Instead of running from drive letters, the drive GUID might be a smarter idea, because this won't back up drives that are not mounted with drive letters. So if you've mounted a disk inside an NTFS partition, or the drive doesn't have a drive letter for whatever reason, it will be skipped.