diff --git a/library/fstore.py b/library/fstore.py
new file mode 100644
index 0000000000000000000000000000000000000000..e9f30cfd1fb972efe7dd4f77343b71b199858e7d
--- /dev/null
+++ b/library/fstore.py
@@ -0,0 +1,76 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+# Authors:
+#   Thomas Woerner <twoerner@redhat.com>
+#
+# Based on ipa-client-install code
+#
+# Copyright (C) 2017  Red Hat
+# see file 'COPYING' for use and warranty information
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+ANSIBLE_METADATA = {
+    'metadata_version': '1.0',
+    'supported_by': 'community',
+    'status': ['preview'],
+}
+
+DOCUMENTATION = '''
+---
+module: fstore
+short description: Backup files using IPA client sysrestore
+description:
+Backup files using IPA client sysrestore
+options:
+  backup:
+    description: File to backup
+    required: true
+author:
+    - Thomas Woerner
+'''
+
+EXAMPLES = '''
+- name: Backup /etc/krb5.conf
+  fstore:
+    backup: "/etc/krb5.conf"
+'''
+
+RETURN = '''
+'''
+
+from ansible.module_utils.basic import AnsibleModule
+from ipalib.install import sysrestore
+from ipaplatform.paths import paths
+
+def main():
+    module = AnsibleModule(
+        argument_spec = dict(
+            backup=dict(required=True),
+        ),
+    )
+
+    module._ansible_debug = True
+    backup = module.params.get('backup')
+
+    fstore = sysrestore.FileStore(paths.IPA_CLIENT_SYSRESTORE)
+    if not fstore.has_file(backup):
+        fstore.backup_file(backup)
+        module.exit_json(changed=True)
+
+    module.exit_json(changed=False)
+
+if __name__ == '__main__':
+    main()
diff --git a/roles/ipaconf/tasks/main.yml b/roles/ipaconf/tasks/main.yml
index 2a74b190a399e201ebd94a099ab4ce1cd7d9e4b1..0edcc02c79f7e1bce92c6049b2670de1786e02b1 100644
--- a/roles/ipaconf/tasks/main.yml
+++ b/roles/ipaconf/tasks/main.yml
@@ -1,4 +1,8 @@
 ---
+- name: Backup IPA default.conf
+  fstore:
+    backup: "{{ ipaconf_default_conf }}"
+
 - name: Template IPA default.conf
   template:
     src: default.conf.j2
diff --git a/roles/krb5/tasks/main.yml b/roles/krb5/tasks/main.yml
index 811dcf8f45e50536deabccc91bdf636f14460f7d..392638aa9cfcc7dddc15ae39aac9fae0dfe4d90e 100644
--- a/roles/krb5/tasks/main.yml
+++ b/roles/krb5/tasks/main.yml
@@ -3,12 +3,9 @@
   package: name="{{ item }}" state=present
   with_items: "{{ krb5_packages }}"
 
-# No backup in ipa-client-install mode
-#- name: Backup {{ krb5_conf }}
-#  copy:
-#    src: "{{ krb5_conf }}"
-#    dest: "{{ krb5_conf }}.bkp"
-#    force: no
+- name: Install - Backup krb5.conf
+  fstore:
+    backup: "{{ krb5_conf }}"
 
 - name: Template krb5.conf
   template: