Backing up the DC

[Perry]

I used domain credentials in Veeam to backup my VMs but my domain controllers are also the VMs being backed up by Veeam. In the event that I loose my domain controllers and want to restore then using Veeam, I will no longer have the credentials to restore the controllers if need be. So I am wondering if in that scenario I can use non domain based credentials in Veeam to restore.

Can you only restore with the same credentials used to back up? How would you restore in such a scenario?

[Mike Resseler]

Perry,

I'm not sure if I completely understand it.

1. You use domain credentials to backup a DC. Are you using those credentials for the in-guest backup? Or are you saying that Veeam is running on a domain based service account (or user)

If you lose your domain controllers, then obviously you can't authenticate anymore. However, because of the way cached credentials work, you will be able to log in to the B&R server, restore the entire DC, get it back online and you can continue to work.

Makes sense?

Mike

[Perry]

I meant that Veeam is running on a domain based service account (or user).

So lets say I lost everything in a catastrophe. All our hardware is gone. The only thing I have left is the .VBM, .VBK, and .VIB backup files of my entire VM infrastructure saved off site somewhere. Now I need to reconstitute my entire infrastructure. The DC servers were VMs backed up in those backup files along with everything else. So I would build a new server, install Veeam and first try to restore my DC servers. But how can I do this if the backup was made with domain credentials that are no longer available. Can I still restore without a domain (maybe local credentials)?

[Mike Resseler]

You won't need those. When you rebuild the Veeam server you can import the backups and restore it to a virtual server. Do note that a recovery of a DC probably means it will start in directory services restore mode but after that you should be good to go

[Perry]

So the backup files are not assigned ownership to the domain account that made the backups? So I can recover from a backup under any user account? I was under the impression that I had to be logged in under the same account that did the backup to perform the restore.

[Mike Resseler]

Perry,

No, that is not necessary. You can for example grab a backup chain and import it into another backup server to start recovering. Now if you are wondering about security, that is why we have encryption for the backup files

Thanks
Mike

[foggy]

And here's the step-by-step instructions for DC recovery, just in case.

[Fwiler]

Perry,

Not exactly related to Veeam, but in my experience it's always good to have a separate domain controller off to the side for emergencies.
Cloud hosted or even a simple little desktop would work.
It just makes life easier for many reasons besides restoring.

[Mike Resseler]

Dustin,

Correct. I actually use backup of DC's for 99% for recovery of single objects or similar. As an IT admin (before Veeam) I always had at least 2 DCs in every environment I worked for. (Some environments much more). The 1% other recovery was to build a quarantined test lab or to test if the restore of the backups worked. Something that is much simpler now with SureBackup but in my time (the good old days ) was a bit more difficult.

But this specific case was for a total loss so it is a scenario that you hope will never happen, but you need to take it into account. Even if you have DC's at different locations. You never know there will be a malware that specifically targets DC's and renders your entire worldwide environment useless in minutes.

But as said. Yes, to everyone out there. 2 DC's is indeed a must. And with today's technologies, have at least one of them (or both) virtual. On a core version to save resources