+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 16
Windows Server 2008 R2 Thread, Backing up Virtual DC's advice/question recovery in Technical; If we have our main DC still running 2003 on a ESXi Host, with the schema upgraded to 2008 R2 ...
  1. #1

    Join Date
    May 2011
    Location
    Jus North of London, close but not too close
    Posts
    717
    Thank Post
    170
    Thanked 53 Times in 51 Posts
    Rep Power
    34

    Backing up Virtual DC's advice/question recovery

    If we have our main DC still running 2003 on a ESXi Host, with the schema upgraded to 2008 R2 and a 2008 R2 DC.

    Am I right in thinking if the main DC (the 2003 server) were to go down I would only be able to replace with another 2008 R2 DC.

    I would dearly like to purchase a new server and then have the primary DC on that so there would be some tolerance, or as we have vMotion and HA maybe leave the DC's where they are and just rely on HA in the event of Hardware failure.

    I guess there is someone out there that has recovered their infrastructure with this setup?

    We would be doing system state backups on the 2008 R2 using windows backup from scheduled wdadmin tasks. The main DC (running 2003) has backup exec. There are also scheduled tasks on the main DC to backup the system state on a nightly basis to another server. Probably overkill I guess.

  2. #2

    dhicks's Avatar
    Join Date
    Aug 2005
    Location
    Knightsbridge
    Posts
    5,611
    Thank Post
    1,226
    Thanked 772 Times in 670 Posts
    Rep Power
    234
    Quote Originally Posted by Davit2005 View Post
    I would dearly like to purchase a new server and then have the primary DC on that so there would be some tolerance, or as we have vMotion and HA maybe leave the DC's where they are and just rely on HA in the event of Hardware failure.
    If I understand correctly, the best practice these days is simply to run two DCs - I'm not sure there's even a distiction between "primary" and "secondary" DCs these days, they are both equally capable of being the only DC on your network if the other conks out.

  3. Thanks to dhicks from:

    Davit2005 (15th February 2012)

  4. #3
    Mr.Ben's Avatar
    Join Date
    Jan 2008
    Location
    A Pirate Ship
    Posts
    941
    Thank Post
    182
    Thanked 157 Times in 126 Posts
    Blog Entries
    2
    Rep Power
    65
    You need to ensure that the Global Catlog function is enabled on both DC's, so that if one conks out, User logons can be processed on the other:

    What Is the Global Catalog?: Active Directory

    I would install the new server, add the AD roles and then transfer the FSMO roles from the 2003 server to the new 2008 one before removing the 2003 server.

    I'm not sure if DPM works with ESXi, but I've found it quite useful in my hyper-v setup.

    In event of failure I would only restore a single DC (the one with the FSMO roles), and then build another.
    Last edited by Mr.Ben; 15th February 2012 at 05:46 PM.

  5. Thanks to Mr.Ben from:

    dhicks (15th February 2012)

  6. #4

    Join Date
    May 2011
    Location
    Jus North of London, close but not too close
    Posts
    717
    Thank Post
    170
    Thanked 53 Times in 51 Posts
    Rep Power
    34
    Quote Originally Posted by dhicks View Post
    If I understand correctly, the best practice these days is simply to run two DCs - I'm not sure there's even a distiction between "primary" and "secondary" DCs these days, they are both equally capable of being the only DC on your network if the other conks out.
    Yep the schema master would be the 2003, the other DC is a global catalog as well to facilitate user logon.

    I rebuilt a DC at the last place when the RAID went bad but it was a physical host.

    Would HA be ok to use on DC's, if the hardware went bad it should swap to the other server but not sure how this would work on DC's?

  7. #5

    Join Date
    Aug 2007
    Location
    Deal, Kent
    Posts
    343
    Thank Post
    12
    Thanked 73 Times in 51 Posts
    Rep Power
    26
    Backing up a DC is not the best of ideas - it should only be used for recovery in a disaster situation. Best practice is to simply have another DC. We run a Virtual environment using Hyper-V and our Hyper-V Host servers are domain joined machines - this means we have to have a DC outside of our cluster as it will not start the cluster and failover services until it can verify a DC is available (we have then made two virtual DC's inside our environment).

    The FSMO roles all belong to the physical machine, the other 2 DC's are global catalog servers as well. If the physical machine dies compeltely, i would simply forceable sieze the roles to one of the virtual servers, and keep the cluster running whilst I set up a new physical machine and transfer the roles to the physical machine once complete.

    The short answer is have a second DC - this is your backup.

  8. #6

    Join Date
    May 2011
    Location
    Jus North of London, close but not too close
    Posts
    717
    Thank Post
    170
    Thanked 53 Times in 51 Posts
    Rep Power
    34
    Quote Originally Posted by Psymon View Post

    The short answer is have a second DC - this is your backup.
    We have a second DC that has the Global catalog, I wouldn't do it any other way :-) . At the moment we only have one VM host, I would like to introduce a second ESXi host when finances allow and can convince my boss.

    I setup 4 ESXi hosts at a last employment with a vCenter managing them. The main point of my thread was to establish wether it would be best to have both DC's on one host with HA enabled in case of hardware failure or just have one DC on each, both would have DHCP, DNS and Global Catalog roles to provide failover. Both servers are also in the same server room as we have limited space, also does HA rely on a SAN based datastore or can it work with local based storage (on the ESXi host itself). We have HA and vMotion in our ESXi licence and the CPU count will allow us to have another couple of hosts.

  9. #7
    Duke5A's Avatar
    Join Date
    Jul 2010
    Posts
    789
    Thank Post
    79
    Thanked 129 Times in 112 Posts
    Blog Entries
    8
    Rep Power
    31
    Quote Originally Posted by Davit2005 View Post
    We have a second DC that has the Global catalog, I wouldn't do it any other way :-) . At the moment we only have one VM host, I would like to introduce a second ESXi host when finances allow and can convince my boss.

    I setup 4 ESXi hosts at a last employment with a vCenter managing them. The main point of my thread was to establish wether it would be best to have both DC's on one host with HA enabled in case of hardware failure or just have one DC on each, both would have DHCP, DNS and Global Catalog roles to provide failover. Both servers are also in the same server room as we have limited space, also does HA rely on a SAN based datastore or can it work with local based storage (on the ESXi host itself). We have HA and vMotion in our ESXi licence and the CPU count will allow us to have another couple of hosts.
    HA requires common storage that every host in the cluster can see, whether it be a SAN or any other device that does iSCSI. If you're going to have both your domain controllers in the cluster, then run one on each host. All that HA does is startup a VM on another host if the host on which it was running on originally goes down. So you would be without a DC for the time it takes to cold boot the VM if you run them both on the same host and a failure occurs. Ideally though, you want to keep one DC physical and in another location.

  10. Thanks to Duke5A from:

    Davit2005 (21st February 2012)

  11. #8

    Join Date
    Feb 2012
    Posts
    1
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    I can suggest you to use Veeam backup in order to backup those machines properly.

  12. #9

    Join Date
    May 2011
    Location
    Jus North of London, close but not too close
    Posts
    717
    Thank Post
    170
    Thanked 53 Times in 51 Posts
    Rep Power
    34
    Quote Originally Posted by Duke5A View Post
    HA requires common storage that every host in the cluster can see, whether it be a SAN or any other device that does iSCSI. If you're going to have both your domain controllers in the cluster, then run one on each host. All that HA does is startup a VM on another host if the host on which it was running on originally goes down. So you would be without a DC for the time it takes to cold boot the VM if you run them both on the same host and a failure occurs. Ideally though, you want to keep one DC physical and in another location.
    I'd thought HA might need a SAN :-D. Seen a few people recommend keeping one physical, It would only be doing the domain main roles (schema master, global catalog, etc. and DNS, DHCP, maybe an additional print server).

  13. #10

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,238
    Thank Post
    239
    Thanked 1,564 Times in 1,248 Posts
    Rep Power
    339
    Am I right in thinking if the main DC (the 2003 server) were to go down I would only be able to replace with another 2008 R2 DC.
    That's incorrect. Your role master is a 2003 DC, but the schema has been upgraded to 2008 R2 due to a 2008 R2 DC in your domain. This is completely normal. If your 2003 DC went down, you could replace it with another 2003 DC.

    Currently your Domain and Forest functional levels are going to be 2003, due to your 2003/2008 R2 server. You cannot for example have a 2000 DC and 2008 R2 DC in the same domain.

    If your Domain and Forest functional levels were set to 2008 R2, you could only introduce a 2008 R2 or better. You couldn't run any 2003 DCs. Any 2003 servers could only be member servers running File/Print services for example.

  14. Thanks to Michael from:

    Davit2005 (21st February 2012)

  15. #11

    Join Date
    May 2011
    Location
    Jus North of London, close but not too close
    Posts
    717
    Thank Post
    170
    Thanked 53 Times in 51 Posts
    Rep Power
    34
    Quote Originally Posted by Michael View Post
    That's incorrect. Your role master is a 2003 DC, but the schema has been upgraded to 2008 R2 due to a 2008 R2 DC in your domain. This is completely normal. If your 2003 DC went down, you could replace it with another 2003 DC.

    Currently your Domain and Forest functional levels are going to be 2003, due to your 2003/2008 R2 server. You cannot for example have a 2000 DC and 2008 R2 DC in the same domain.

    If your Domain and Forest functional levels were set to 2008 R2, you could only introduce a 2008 R2 or better. You couldn't run any 2003 DCs. Any 2003 servers could only be member servers running File/Print services for example.
    Cheers again Michael,
    Over summer I'll probably introduce another 2008 R2 server, move the roles and de-commission our last 2003 DC. Our filter box may not approve but it will give a decent excuse to have to replace it (if we haven't allready done by then) ;-D . I suppose I could just move the roles but leave the filter box pointing at the Ldap on the 2003. One thing for sure, when raise the functional level of the forest there's no going back.

    Cheers for reply

  16. #12

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,238
    Thank Post
    239
    Thanked 1,564 Times in 1,248 Posts
    Rep Power
    339
    One thing for sure, when raise the functional level of the forest there's no going back.
    Spot on

  17. #13

    Join Date
    Oct 2008
    Location
    Leeds
    Posts
    215
    Thank Post
    21
    Thanked 17 Times in 17 Posts
    Rep Power
    14
    Quote Originally Posted by Psymon View Post
    The short answer is have a second DC - this is your backup.
    OK if one of your DCs goes down. But what would you do if your ADS database is corrupted and gets replicated to all DCs? You will need a (recent) backup of ADS in order to perform a Disaster Recovery to recover your domain.

    Two examples of how this might happen:

    • A Hacker removes all users from Domain Admins/Administrators, resets the password for the domain administrator account, then deletes all other accounts.
    • Or a worm/program goes berserk and corrupts ADS.


    You still need to take regular backups of ADS to deal with these types of scenarios, no matter how many DCs you have it won't help. And...

    A) If all of your DCs are on one site you should keep the backups "off-site" from where your DCs are.
    B) Store them offline (e.g. a USB drive or tape) to prevent the said hacker from wiping your backup at the same time as the DCs.

    In my opinion Windows Server Backup (2008/2008 R2) is good for ADS backups. Microsoft trusts it to perform ADS backups for DPM.

    Regards,

    Bruce.
    Last edited by Bruce123; 9th April 2012 at 10:03 PM.

  18. Thanks to Bruce123 from:

    Roberto (10th April 2012)

  19. #14
    chazzy2501's Avatar
    Join Date
    Jan 2008
    Location
    South West
    Posts
    1,774
    Thank Post
    212
    Thanked 263 Times in 213 Posts
    Rep Power
    67
    I've been wondering as I also have 2 DCs but I only one of them is running DHCP (I'm told that this isn't ideal either) I've so many reservations etc how do you share the DHCP role?

  20. #15
    gshaw's Avatar
    Join Date
    Sep 2007
    Location
    Essex
    Posts
    2,648
    Thank Post
    164
    Thanked 217 Times in 200 Posts
    Rep Power
    66
    Just give DHCP its own VM

    Used to have it split across two DHCP servers but seems like after going virtual most people just put it on one VM

    As for DC backups... we use Veeam. The SureBackup feature is handy as you can spool up your entire network from the backup files to check everything works as expected if you needed to restore from them... very funky!
    Last edited by gshaw; 10th April 2012 at 11:08 AM.

  21. Thanks to gshaw from:

    chazzy2501 (10th April 2012)

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Backing Up Hyper-V Virtual Servers - FOR FREE !! with the VSS Writer
    By burgemaster in forum Windows Server 2008 R2
    Replies: 3
    Last Post: 12th March 2012, 10:52 PM
  2. Backing up Virtual machines
    By m1ddy in forum Thin Client and Virtual Machines
    Replies: 9
    Last Post: 23rd April 2010, 08:44 AM
  3. Backing Up Virtual Machines
    By FN-GM in forum Thin Client and Virtual Machines
    Replies: 10
    Last Post: 21st April 2009, 08:21 PM
  4. Any Advice on Server Backing Up hardware???
    By Athlona in forum Hardware
    Replies: 5
    Last Post: 16th September 2008, 12:19 PM
  5. Replies: 5
    Last Post: 30th April 2007, 08:40 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •