Veeam B&R v5 recovery of a domain controller

[Louharle]

Looking for documentation regarding the process of recovering an Active DIrectory domain controller through the use of Veeam Backup and Recovery version 5 or later, utilizing VSS and not inducing a VSS. Areas that I would like clarification on are the process that Veeam goes through to boot in to AD RECOVERY MODE and how does it decide what mode to go in to (Authoritative/Non-Authoritative) and how does it know it's an Active Directory Domain Controller (or is there checkboxes or the like that are available during the restore process). Any guidance / information would be most helpful.

Thanks,

LouHarle

[Gostev]

Hi Louis,

Unfortunately, I will not be able to provide much details on how we do this on public forum, because this technology is our know-how. Please appreciate that we are still the only vendor to provide this feature for image-level backups.

I can address some of your questions above though.

1. DC will always boot in non-authoritative mode, which is exactly what you want most of the time. You should not need to perform authoritative restore in most cases unless your Active Directory corrupts or something because, authoritative restore reverts AD to the earlier point in time and can cause too many additional issues by itself. It is really the last resort. But if you need to perform it from Veeam backup, there are existing discussion with verified procedure posted on this forum that you can refer to.

2. Veeam Backup knows that computer is a DC by querying certain Windows OS configuration parameters from within OS (our application-aware processing logic does that when backup is performed). So, detection is fully automated (there are no checkboxes).

Hope this helps.

Thanks.

[Louharle]

It does, very much. I agree that 99% of the time non-authorative will be the mode you want. I appreciate the fast response!

[habibalby]

[merged]

Hi,
I'm testing Veeam Backup to backup our Domain Controller. I just did a backup test on test DC and it backed up fine. I deleted the VM, and I restored it from the Backup. When it boots, it booted fine without any issue. I looked at the Event Viewer and I didn't see any errors or warning. Does this mean Veeam restoring DC as an authoritative restore mode? Or I must perform the authoritative restore mode manually?

Thanks,

[habibalby]

Hi,
I have just run my DC 2008 from a Backup and start the machine and entered F8 to go to the DSRM,, it logs fine and asked for the local username. I poovided the local user name of the DSRM but it didn't restore successfully. How can I restore the DC / Run it from Backup?

Thanks,

[Gostev]

Hi, reading through my response above, DCs are restored in non-authoritative mode. The process is automatic, and you should not do anything (just wait until the restored DC automatically reboots). If you are looking to perform authoritative restore (which you really do not want to do in most cases), please search for the existing topic describing the procedure of such restore. Thanks.

[habibalby]

Hi,
I found that when the veeam backup is finished, in the Boot Sequence the Auto Checked on the Active Directory Repair under MSConfig is checked even after second reboot. What I did, I rebooted the machine first and when the DS Restore completes I unchecked this option and the Active Directory starts normally and I was able to login to the Domain.

Veeam should comes with a proper documents on how to Restore DC/ Active Directory.

Thanks,

[Gostev]

There is no documentation needed, as the non-authoritative DC restore process is fully (100%) automated. I am not sure what are you doing and what settings are you looking at and changing, but again, you do not have to be performing any manual steps at all. After being powered on for the first time, the restored VM will boot in safe mode once (the very first boot), perform VSS restore, and then reboot immediately. Until this point, everything is fully automated. After that reboot, the VM will boot up normally, and the restore process is done. All the following reboots (those initiated by user) will be normal as well.

We had automatic DC recovery functionality in the product for 3 years now, it is very polished by now, if it had bugs with it, someone of 25000 customers would have certainly run into them by now. Of course, there might be some environment-specific issue in your case, so if you think that something is not working as it should, feel free to open a support case, and our support stuff will troubleshoot this for you.

Thanks!

[habibalby]

Hi,
As I stated above;
1. First boot it goes into safe mode
2. Second boot it goes into Directory Restore Mode
3. Third boot it goes again into Directory Restore Mode... Humm, here's the trick. It goes into DRM because it doesn't uncheck the Safe Mode and Active Directory Repair in the Boot Option under the MSConfig System Configuration.
4. I initiated the MSConfig and unchecked the Safe Mode boot
5. DC Starts Normally.
6. Set the IP Address again and make sure DNS and name resolution okay.. and reboot to make sure DC is working fine.
7. DC Up and Running.
8. Thanks to Veeam for this Solution

[Gostev]

Got it, at step 2 above something does not work as expected in this case, because normally the process should go from step 1 right to step 5. Do you wait long enough after 1st boot? Does reboot 2 happen automatically? We would want to investigate this if possible (if you have time and desire to work with our support). Thanks!

[habibalby]

Hi,
It doesn't reboot automatically.. I have finished three cigarettes and came back but it didn't that's why decided to reboot it automatically.

Thanks,

[Gostev]

The in-guest process that automatically reboots DC is also the one disabling safe mode boot. Thus, clearly there is something wrong with it in your case, if neither happens.

[habibalby]

Aha, In my opinion to create a KB about these issues and how to overcome such as things when it happened. Luckily I have an experience in backup and restoring DCs.. It came to my mind to see the Boot Sequence and I found the issue. Otherwise I would force to seize the FSMO roles to get it restored.

Thanks any way for your help

[Gostev]

Well, again, we have no reason to believe that the issue even exist in the product. Because it was never reported before in all these years, it is very unlikely. This need to be investigated first. Might be incorrect product usage (application-aware processing not enabled), might be issues with specific DC being broken or having broked security settings, and so on.

[danieln]

Hi everyone,

I have the same issue, one of the 2 DCs is constantly rebooting in safe mode and because I cannot logon on it there is no way for me to disable the boot.ini modifications Veeam B&R does.
Veeam B&R modifies ALL boot.ini boot options, not only the default one, beats me why all.
Hussain, how do I go about letting it boot normally?!
One way would be to attach the disk to a running guest and modify the file, I guess…

For Veeam team: clearly there is an issue some time, just saying 25,000 did not complain ...
I wonder what can it be: maybe the antivirus software may prevent the file edit process, even is safe mode? We use Kaspersky.
In case of a DR event (or a simple VM restore) nobody needs guess work and custom boot scenarios, it should just work.

Thank you,
Daniel.