backing up domain controllers

[lil328i]

Hi everyone, first post!

I'm using the eval version of veeam backup abd so far it's working great.

We have 2 ESXi [licensed] servers and a SAN, with Virtual Center server.

My question is regarding backing up virtualized domain controllers, we have 2, one on each vmware box, plus a third externally on it's own hardware [just in case].
One of the two vmware DC's is the RID master.

What would be the best practice for backing these up using Veeam backup.

Second question is with AD. I heard that it's best to remove a DC from participating in Ad before backing up a virtualised server. Anyone else agree?
Apparently backing up vmware DC's is so new that microsoft dosnt have any "best practices"

Thanks!!!

Peter

[Gostev]

Peter, all you need to do is enable Veeam VSS processing in Backup job settings, and make sure you do not set the "continue even if VSS fails" checkbox. DC backups made without proper VSS processing are worse than no backup at all.

You don't need to remove DC from AD or do anything else - just backup DC as a regular VM. I have a big blog post about virtualized DC backups here, you can pick up more information from it: http://veeammeup.com/2008/08/vss-and-vm ... g-you.html

One thing not mentioned there is that with Veeam, DC restore will be performed as non-authoritative. So there is no risk of Active Directory information loss due to accidentally restoring some very old VM DC backup.

[lil328i]

Thank You!!!

[lil328i]

I'm getting an ERROR using VSS
Retrieving file list
RPC function call failed. Function name: [Unfreeze]. Target machine: [192.168.88.247].
RPC error:Access is denied.
Code: 5

I'm using the domain administrators credentials in the username and password window for VSS.

[Gostev]

Sounds like there are some additional custom security settings on your domain controller which prevent this, since this functionality works fine on clean DC install when using domain admin account. You can work with our support to troubleshoot this.

[lil328i]

the DC is just a garden variety plain, nothing special, DC. It does not even hold any of the roles, such as RID master etc. All it does it secondary dns and wins.
maybe a better question would be, what are "default VSS agent credentials"?
are they simply a domain administrative account? or something else?

Thanks!

Peter

[lil328i]

ok, nevermind, i think. I didnt enter my domain admin credentials in the prescribed format domain\account
It's now backing up...: )
so to recap, and judging from reading the link you kindly sent....
You advised NOT to check "not set the "continue even if VSS fails" checkbox". So I did not.
when and if I evern need to perform a dc restore, should I just do the restore, and let AD sync itself? or do I need to be in Directory Services Restore mode?
can you clarify this briefly?
The article seems to state, I do NOt need to be in Dir Services Restore Mode.

Thanks!!!!

Peter

[Gostev]

Peter, upon restore, DC will boot into Directory Restore Mode automatically (as shown on the video). When restoring DC, you do not need to do anything besides instructing Veeam Backup to perform full VM restore. The actual restore is fully automated. Your DC will first boot into Directory Restore Mode and perform shadow copy restore, then reboot and boot normally, and then it will automatically sync up with other existing DCs to get all of its AD data up-to-date. All these operations will be performed automatically, you just sit back, relax and watch all this happening

[lil328i]

Thanks!!!!
super product!!!!
got all my vm's backed up, will be buying the full version next month! WOOT!

[digex]

Can you still recover using a backup of a DC that doesnt have any of the roles by seizing the roles? I need to test my DC recovery offsite at one of our DR sites. Since it does not see the other DC's to sync up will I have any issues?

[Gostev]

Yes, you will have issues when recovering DC to site other than original. Customers who attempted to do this all reported that DC logs multiple errors and fails to work properly when restored to site other than original. And you are correct, this is expected because it cannot see other DCs and services (like DNS). DCs are just not designed to be moved around like that - up until the latest times, Microsoft did not keep virtualization in mind at all.

[smileythf]

How about with Replication? I've got a replicated DC and every so often I'll boot it up and it will tell me that there is an issue with the server and shut down. Anyone else experienced this?

[Gostev]

No, I have not heard similar issue reported before. What issue exactly does it report before shutting down?