DC not starting correctly in SureBackup

[zoltank]

ID#00613138

I use a 2008 R2 DC in my SureBackup application group, and for the past couple of weeks it's been intermittently failing to provide DC services inside SureBackup. It appears to start correctly and it will pass the SureBackup tests, but if you logon to the server directly and try to open AD Users and Computers it gives an error that the specified domain could not be reached. Any subsequent VMs brought up in SureBackup which rely on AD (like Exchange) will then fail.

After troubleshooting the problem on my own, it turns out Netlogon is starting before FRS is ready, therefore SYSVOL isn't shared, therefore domain services aren't available. The workaround to this is setting the FRS SYSVOL-Ready flag manually per this MS KB article: http://support.microsoft.com/kb/947022/en-us. I can start a SureBackup session with the failing DC VM, set the flag, reboot, and have it come up correctly. I can then remove the flag, reboot, and have it fail again.

I don't think I'd want to set that flag permanently on my DCs, so is there any way Veeam could incorporate setting the flag into the SureBackup start up procedure for domain controllers?

[zoltank]

One thing I did notice is even using the SYSVOL-Ready flag the DC still doesn't perform an authoritative restore of SYSVOL. To get the SYSVOL share working correctly and get the NETLOGON share back, I need to manually perform both the SYSVOL-Ready flag procedure above and the Burflags authoritative SYSVOL restore procedure.

So the SYSVOL-Ready procedure is only fixing the symptom of a deeper problem regarding how SureBackup is handling some DCs.

[veremin]

I'm just wondering whether the said VMs were backuped with Application Aware Image Processing enabled. Thanks.

[zoltank]

I'm just wondering whether the said VMs were backuped with Application Aware Image Processing enabled. Thanks.

All my VMs are backed up with Application Aware Image Processing.

[zoltank]

As I mentioned above, it's also an intermittent issue. Depending on the backup it will either work or not. If I run the backup job again it will usually start working.

Also, to verify that there isn't some problem with the DC itself, I restored one of the backups which is failing into my test lab, and it works quite happily there.

[veremin]

I don't think I'd want to set that flag permanently on my DCs, so is there any way Veeam could incorporate setting the flag into the SureBackup start up procedure for domain controllers?

I believe we're trying indeed to set required burflags ourselves, but due to the MS bug you've referenced we cannot do so. So, keep working with a support team; they should be able to assist you with that issue. Thanks.

[zoltank]

If you're setting burflags yourself, can't you also set the SYSVOL-Ready flag at the same time?

[veremin]

We will take a look at the number of users affected by the referenced MS bug. Based on the number of issue reported so far, we might try to find a way to address it in one of the next product releases. Thanks.

[zoltank]

Between this bug and the bug which keeps Win2003 DCs from working in SureBackup, I'm really kind of up against a wall in having a viable DC to use in my SureBackup jobs.

[Gostev]

Registry flag should be easy to set, if this is confirmed to be the issue. We already have a facility that changes some other registry keys for DC VMs in SureBackup. Thanks!

[VER]

Just ran into exactly the same issue with one of our 2012R2 domain controllers which are backed up using B&R 8.0.

Is this fix implemented in B&R v8.0?

[foggy]

Yep, the following key was added in v8:

Code: Select all

HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Backup and Replication\SureBackup
SetSysvolReady (REG_DWORD)

Default value is 0. If set to 1, the HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\SysvolReady registry key value is set to 1 during DC preparation.

[redhorse]

Yep, the following key was added in v8:

Code: Select all

HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Backup and Replication\SureBackup
SetSysvolReady (REG_DWORD)

Default value is 0. If set to 1, the HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\SysvolReady registry key value is set to 1 during DC preparation.

Where do I have to set this key? On the Veeam Server or on the DC? Do I have to set in "Wow6432Node", too?

I set it on Server and DC but SysvolReady was 0 after starting SureBackup.

[foggy]

You should set it on Veeam B&R console under the key specified above and restart the server after that.

[redhorse]

You should set it on Veeam B&R console under the key specified above and restart the server after that.

In should set the key on Veeam B&R console? Where?

[foggy]

In the key specified above:

Code: Select all

HKEY_LOCAL_MACHINE\SOFTWARE\Veeam\Veeam Backup and Replication\SureBackup

After adding it you should see something similar to the following in the job debug log, once it is started:

Code: Select all

[03.09.2014 15:07:21] <01> Info     [SureBackup] | 30 | SetSysvolReady                | Boolean | True       | False      | Enables or disables setting 'SysvolReady' registry key in guest OS

[redhorse]

It's not working! SysvolReady is still 0 although I see this line in the job debug log.

The debug log tells me that Veeam changes the SyvolReady key in the registry in this path:

HKEY_LOCAL_MACHINE\System85fde29834a043b3b9ab0f79ee718656\ControlSet001\Services\Netlogon\Parameters]
HKEY_LOCAL_MACHINE\System85fde29834a043b3b9ab0f79ee718656\ControlSet002\Services\Netlogon\Parameters

Is that right?

[foggy]

The path is ok, however the fact that SysvolReady is still 0 is not expected. Please open a case with our technical support and provide full Veeam B&R logs as well as the %SystemRoot%\System32\Winevt folder contents from the DC started by the SureBackup job. Thanks.

[redhorse]

The problem was solved just without doing anything but now it’s back again.

Before I open a support case I want to know if it is right that setting the 'SysvolReady' to 1 only sets this flag on the DC once? I start the DC with SureBackup and it is automatically booting in safe mode (with SysvolReady to 1) but after the following reboot SyvolReady changes back to 0 and the ActiveDirectory is not working.

[foggy]

Before I open a support case I want to know if it is right that setting the 'SysvolReady' to 1 only sets this flag on the DC once? I start the DC with SureBackup and it is automatically booting in safe mode (with SysvolReady to 1) but after the following reboot SyvolReady changes back to 0...

Yes, this is expected. Please open a case and provide information mentioned above for further investigation.

[redhorse]

Now, one day later, it works after the new restore point. That’s crazy!

But now I think the problem is not the SysvolReady-Flag after I read lots of information about Domain Controller restore.

We have a physical and a virtual DC and with SureBackup the physical DC is not reachable in the virtual environment. Could this be the problem? Is SureBackup performing an authorative or a non-authorative restore? I checked the Flags for DC, DNS and Global Catalog. But it’s not clear why it is working one day and not the next day.

So now it is not easy to open a case because today everything seem to be fine.

[foggy]

Is SureBackup performing an authorative or a non-authorative restore?

SureBackup performs an authoritative restore of the DC in the application group.

[kevin_cambs_uk]

After troubleshooting the problem on my own, it turns out Netlogon is starting before FRS is ready, therefore SYSVOL isn't shared, therefore domain services aren't available. The workaround to this is setting the FRS SYSVOL-Ready flag manually per this MS KB article: http://support.microsoft.com/kb/947022/en-us. I can start a SureBackup session with the failing DC VM, set the flag, reboot, and have it come up correctly. I can then remove the flag, reboot, and have it fail again.

Just like to say this saved me hours of work, thanks for posting the solution