Felt into USN Journal Rollback with SBS 2011

[labsy]

Hi,

customer had unresponsive SBS 2011 (running on Hyper-V as VM) and only chance was to roll-back to yesterday's backup. But unfortunately, Veeam B&R was NOT made with Application-Aware option, so now customer has:

• SBS 2011 with Exchange in USN Journal Roolback state, NETLOGON paused, reg Key confirmed 0x4, it is not replication

• 2 addtional DCs in this domain, which are OK

What can we do now?
I read a lot of MS articles and they all say we need to DEMOTE SBS from domain and DCPORMO it back...but this is an illusion, Exchange will break for sure. I am even not sure if SBS can be demoted anyway. The second option MS recommends is to DEMOTE all other DCs, make SBS primary, remove "DSA Not Writable" KEY from registry, and then re-add other DCs back.
But all this seems like too big deal for me.

Wouldn't I just simply do a non-authoritative restore, and USN Journal would get back into sync?

[HannesK]

Hello,
please understand that we cannot give support on critical things for Microsoft Software in the Veeam forums.

Best regards,
Hannes

[Mike Resseler]

Andrej,

While I cannot guarantee something, this is what I would look into...

1. If you have multiple DC's, then demoting of the DC on SBS should not be a problem. Even with SBS, Active Directory will know that there is a forest with multiple DC's. However, before you do that, make sure that you have seized all roles to the other DC's. If DNS is OK, there should not be a problem because Exchange will simply ping and receive the data of one of the other DC's.
2. Doing a non-authoritative restore seems indeed another solution, but since you are not backing up application-aware, it still could fail since we don't know in what state the backup is. (PS: Any reason why you didn't do application-aware?)

For me, I would suggest to seize the roles to the other DC's, turn off the SBS DC and see if all others will work. If it does and there are no issues for 1 or 2 days, start SBS again and go for the demote and promote option. I'm pretty sure in an SBS environment your 2 DC's will be able to run the workload without the 3rd
After that, consider application-aware backups

My 2 cents
Mike

[labsy]

Mike,

thank you for reasonable suggestions. Seems all you write having logic behind and quite some hope for success.
What I need to study is how to demote SBS without braeking Exchange, which is on the same box. Many MS articles discuss demoting SBS first by removing Exchange role, which is what I do not want to do.

Non-Authoritative restore I had in mind was just to use BurFlags and reset FRS (and USN Journal) on SBS, then resync it FROM one of other up-to-date DC-s, which are still up and running in domain. Would this really break something? Is demoting/re-promoting to domain really necessary?

[tsightler]

Demote/promote is a pretty safe operation and is what I would do in this situation.

You could restore the 2011 SBS server into an isolated test environment, with proper, application aware backups of the other two DCs, and give it a try to see how it works, with zero risk to the existing environment.

[labsy]

Well, demote/promote SBS 2011 with Exchange in the same box does not sound an easy operation to me. In fact, AFAIK, demoting and re-promoting SBS is not supported, as this will break SBS integration within domain.

In my situation, SBS is a holder of FSMO roles, except of GC, which was moved to another DC. As SBS is out of sync, I cannot move FSMO roles, because operation fails with "ERROR: The requested FSMO operation failed. The current FSMO holder could not be contacted". This is expected, as SBS is out of sync for more than a week now.
I can force move FSMO roles, but I would do that only in case SBS would not be in domain any more.