Backing up a DC.

[Oaktech]

Forgive me if this is a stupid question, but backing up a DC?

 

I've got 2, one is virtual and one is physical. Is it strictly necessary or even desirable to back them up with windows server backup?

 

They contain no file data at all, they are literally just AD/DNS and one is DHCP although the second has DHCP fully configured and the service turned off.

 

The virtual one gets lumped in with the backup from the baremetal recovery backup of the VM host anyway.

 

I'm concerned that if I was ever in a position to need to recover one it would just be better to build a new one and promo it. My only thought would really be to manually backup the group policies and DNS scope.

 

The 2 DCs are in physically seperate locations. if a disaster happened such that both DCs were affected there would be more important things to deal with than logging in.

[tmcd35]

AD is a funny beast. It's a majorly complex database and yes should be backed up daily using Window Backup. If anything goes wrong it's the only way you'll restore your user accounts, policies, etc without causing any problems. Certainly never use a restored VM as an authoritative DC. You right in terms of rebuilding one, but if the worst happened and both DC went...

[mikkydoos]

Its a VM. Snapshot it daily, back it up weekly Or create a 3rd VM DC.

@tmcd35 - I use a VM as an authoritive DC. Never had an issue.

[tmcd35]

Its a VM. Snapshot it daily, back it up weekly Or create a 3rd VM DC.

@tmcd35 - I use a VM as an authoritive DC. Never had an issue.

 

I think things may have changed a little with Server 2012, but even then I wouldn't trust it. You shouldn't restore a DC from a VM backup...

[Oaktech]

So, whats the recomendation? Bare metal recovery set up on the physical box?

 

The physical box is not the FSMO role holder as it's physical predecessor expired before I arrived. I seized FSMO onto the existing VM box which was working and then promo'd a new physical box in.

[win]

I export my VM DC every now and then, but also have a weekly backup for the system state of the DC. I'd only use it if both DCs go down. Otherwise creating a new DC and linking it to an existing one would be the better option.

[3s-gtech]

There can be issues with having all DCs as VMs, but from what I've read 2012/R2 is no longer a problem. Not sure if this was to do with the time sync to host issues that can happen.

 

I have my DCs as a mix of physical, VM on ESXi and VM on Hyper-V. Just reassures me that I haven't put too many eggs in one basket. The DCs are backed up too - you'll want a baremetal backup offsite/to another separate building in case your server room cops it IMO.

[tmcd35]

So, whats the recomendation? Bare metal recovery set up on the physical box?

 

Build a new VM and restore the system state to it from the Windows Server backup, assuming the physical is also down. If the physical is up then grab the FSMO roles onto the physical and build a fresh VM DC.

[synaesthesia]

Also using VMs here and we are running from one (of a pair) which was recently restored from a backup. No such problems, it pulled everything from the second DC which took over as authorative and bob's my mother's brother. 2012 R2.

[sonofsanta]

Take a System State recovery, and recover through Directory Services Restore Mode using this data. Never ever not ever use a snapshot of a DC as the timestamping will wreck your AD. You might get away with it if you were bringing up only that snapshot on a completely new domain, but if you ever bring back a snapshot of a DC into an existing domain you will ruin everything forever.

 

From my DR documentation, written as a guide to myself:

Instructions derived from: Performing a Bare Metal Restore with DPM 2010 - System Center: Data Protection Manager Engineering Team Blog - Site Home - TechNet Blogs

On a new machine, boot from the Win2k8R2 USB stick and install Win2k8R2.

Once installed, go to Features and add Windows Server Backup.

Restart and use F8 to load the Windows boot menu.

Choose Directory Services Restore Mode.

Once booted into this safe mode, load Backup and choose Restore. Use the [DC] image as saved onto a portable HDD (Backup does not allow pensticks to be used directly), tick the appropriate boxes to restore everything, and set to restart when complete.

Once rebooted as a resurrected [DC], change the IP of the network adapter to [iP]/[MASK] ignoring the warning about virtual adapter if restoring to physical hardware.

Open AD Console, expand ADUC, right click on [domain.local] and click Operations Masters. Go to Infrastructure tab and force transfer of this FSMO role (others are already set to [DC]).

Anything in [square brackets] is redacted information specific to my virtual DC. Last step will be different for most, I'd imagine; amend so that your recovered DC seizes whatever FSMO roles it didn't already have.

 

In my case, one virtual and one physical, recovering from a complete disaster, I'd do the steps above then promo a new physical DC. If I'd only lost the virtual DC I'd probably just promo a new virtual one, though I think you can do a non-authoritative AD restore which brings it back with all the data but updates with newer information from your existing DC. Never experimented with that though.

[Oaktech]

Ok, so I think what I'm going to do is to baremetal the physical box and leave the virtual one lumped in with the backup of it's host.

 

In the even of a physical dc failure I'll just bring it back from it's image, if the virtual box goes then I'll seize fsmo onto the physical box and enable the dhcp scope, bring up a new VM dc and promo it in.

 

In the event of both expiring, the backup of the physical box will do to get us going again.

 

Sound?

Edited September 23, 2014 by Oaktech

[mikkydoos]

So, whats the recomendation? Bare metal recovery set up on the physical box?

 

The physical box is not the FSMO role holder as it's physical predecessor expired before I arrived. I seized FSMO onto the existing VM box which was working and then promo'd a new physical box in.

 

 

I'd do baremetal. It'll pull everything across when you promote. Unless you've got other critical stuff running on it you need to keep.

 

I had to do this a while ago when the O365 Sync Tool lunched both my DC's.

Restored to a physical from an image.... built a new VM DC, promoted it, then seized FSMO roles on the VM. Physical is now secondary DC. It worked thank **** ; )

Edited September 23, 2014 by mikkydoos