Restoring Domain Controller Server with Active Directory from Bare Metal Backup

[horhota]

I have tried to determine if and how this is possible using Veeam Agent for Windows, free version. There are a number of previous posts but none seem to match up with my situation so I am looking to get a better understanding of what's involved. Currently we do a bare-metail backup of a server running Windows Server 2016. This server is our domain controller, with all of our active directory information. We have no other servers. Normally I look at a bare metal backup as similar to an image backup of a regular desktop pc - if you restore the image, everything comes back - users, registry, licenses as well as the regular disk file structure. Is the same true for a bare metals backup(using Agent for Windows) of our server - just restore the backup and everything is back - files, active directory, domain controller data? The posts I have gone through talk about needing to do all kinds of extra stuff - registry changes, something called application aware image processing, etc - none of which I am familiar with or would expect to have to do. I would appreciate some clarity - perhaps a link to a post that references a situation similar to mine. I realize the question of server restores has come up before but I just can't find anything that pertains to my situation.
Thanks.

[HannesK]

Hello,
The general challenges with restoring a multi master application like active directory is described in KB2119. The first section "Restoring single lost DC in a multi-DC environment or in environment with only a single DC" describes your situation more or less (it's about VMs, but it's the same with agent based backups)

As you have only one domain controller, you cannot break any domain replication (because there is no replication to other domain controllers).

The agent always does VSS snapshots (also free edition without application aware image processing). So I see no issues doing a bare metal restore with a standalone domain controller and Veeam Agent for Windows free edition

Best regards,
Hannes

[horhota]

Thank you, HannesK, for your reply. I had already read the KB2119 article and it is the source of my confusion. First, I don't know how to get "application-aware image processing" enabled in my backup job. I see nothing in the job setup screens that refers to this. Is this feature automatic - a default with Veeam Agent for Windows, free edition?
I am also not sure what needs to be done when I boot into Directory Services Restore Mode (DSRM) - from research I believe this is the same as the old F8 Safe Mode. ( In Windows Server2016 you have to set this up using bcdedit commands before the restore.) Based on your reply, it sounds like I do nothing when the server comes up in safe mode/DSRM - I just tell it to reboot and it restarts as normal - as my domain controller. Is this correct?
The section on restoring the Active Directory is also challenging. However, from you post above, it doesn't sound like I need to even do that - the boot up in DSRM and subsequent reboot appear to do this automatically. Is this also correct?
I've never done a restore before so I would appreciate if you could clarify or elaborate on the questions above. I have been asked to do a test restore early in the new year and I do not want to start doing it only to find that something didn't get done and I am left with a server that is unusable. Please note that I approached the local consulting firm who supplied the server but they are highly critical of using Veeam software and won't give me any assistance at all. So I will have to rely on the advice I get from the Veeam community.

[HannesK]

Veeam agent free edition does not have the "application aware" checkbox. But it also uses VSS (volume shadow copy services). So the domain controller is backed up in applications consistent state.

ah sorry, I did not properly read the KB headline... it's about about multi-DC environment. As you have only one DC, it's not relevant.

I never had a single DC domain, so I never tried that kind of restore. But as mentioned earlier: I don't see any issues, because you cannot break anything because you have a single-DC domain.

Actually you can also do restore tests to VMware workstation or whatever product you like. The only thing is, that you need to create a bare metal restore ISO with the correct drivers for VMware (or the product you prefer). The easiest way is to do a Windows installation and then just create a bare metal recovery iso.