Veeam restore to Azure Sid\SPN issue?

[stormlight]

Hello,

Backing up ESX vms (SQL and App servers) and sending a copy over to our Azure site via SOBR. If there is ever an instance where I need to restore and spin up the backed up VM on azure (in a primary site DR event) what happens with the SID and SPN of the machines that will be restored to Azure.

I have a vendor that is hesitant in saying that this would work based on their belief that Veeam would break the Sid, SPN, and ect.

I know Veaam doesn't do that as its an image base backup. However, what about the Veeam restore process to Azure? Does it restore it as an exact image or does it change anything in the VM that would change the sid break SPN, ect?

I thought that this was one of the ways people migrate to Azure and would be surprised if there was any issues like this.

Thanks

[veremin]

Are you talking about Active Directory SID? After you restore VM to Microsoft Azure you will need to re-join it to the domain, and during such operation a new SID will be assigned. Thanks!

[stormlight]

Kind of, I haven't tried this yet so I'm reading and researching. I believe it has mostly to do with SPNs. https://docs.microsoft.com/en-us/window ... ipal-names and what happens to services after the machine is restored and joined to azure.
I didn't know about the need to re-join the a restored VM to the domain so thank you. This may be part of the app owners problem with the restore to azure. I didn't see that in the documentation unless I missed it. an you please share official Veeam documentation where that is so i can read it and find more info. https://helpcenter.veeam.com/docs/backu ... ml?ver=110 is what I have reviewed along with other random internet docs so far. Thank you

[veremin]

It's not mentioned in documentation, as it's not a required step or something that is done by our product automatically.

I just made an assumption about what will be needed in your case: say, you restore VM to Microsoft Azure, VM is not joined domain (I assume your Active Directory does not cover cloud infrastructure), your application owners seem to be using the machine in AD environment, so they need to re-join it to domain, which results in new SID.

Thanks!

[stormlight]

I have a domain controller machine sitting in Azure. (in the same resource group the Veeam restore would be placed into.) I restore the Veeam backup, spin it up and the VM sees the domain controller and all is good correct? Veeam doesn't do anything to the vm and I don't have to rejoin the domain. Correct?

Thanks