Veeam B&R recovery of a domain controller

Availability for the Always-On Enterprise

[MERGED] Restoring Multiple Domain Controllers

Veeam Logoby peeky1323 » Tue Aug 22, 2017 3:14 pm

Hi everyone.

I have a strange issue here. We have 3 domain controllers (2x2012 R2 and 1 2008 R2). I am trying to restore them into a test setup and I have restored one and followed the guide here:

https://www.veeam.com/blog/how-to-recov ... ction.html

for performing an authoritative restore. I then restored the other 2. My AD is broken and cannot start AD users and computers, sites and services etc, replication will not work, and can't login to any member servers I have restored into this test setup. After much troubleshooting I tracked down the regitry key sysvolready was set to 0 on all servers. After changing this to 1 things are improving and cna now login and start the AD tools (I haven't looked beyond this yet to see if there are still issues). Is there a set procedure for restoring multiple DCs? Do you perform the authoritative restore steps on one that holds a certain role or anyone?

Many thank,

Matt
Matt Peek
VMCE V9
peeky1323
Service Provider
 
Posts: 71
Liked: 4 times
Joined: Wed May 30, 2012 11:58 am
Full Name: Matt Peek

Re: Restoring Multiple Domain Controllers

Veeam Logoby foggy » Tue Aug 22, 2017 4:01 pm

Hi Matt, please review this KB describing all the nuances of domain controller recovery, including your scenario. Just to confirm, you have application-aware image processing enabled on the corresponding backup job, right?
foggy
Veeam Software
 
Posts: 16271
Liked: 1302 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

[MERGED] Restoring Active Directory Domain Controllers

Veeam Logoby SteeleTek » Thu Oct 12, 2017 6:24 pm

Greetings,

One of the most common issues I experience when using Veeam to restore a backup or failover a replica of Windows Server 2008 R2 Active Directory Domain Controllers is being unable to create new objects in AD (user/computer/group). We receive the error "Windows cannot create the object OBJECTNAME because: The directory service was unable to allocate a relative identifier."

The DC we restore is the PDC master, Infrastructure master, and RID master.

This article from Microsoft doesn't seem applicable since the DC we restored already has all the necessary master roles: https://support.microsoft.com/en-us/hel ... irectory-s

Anyone else experience this issue when restoring Veeam backups of a DC or performing a failover to a replica for a DC?

Thank you!
SteeleTek
Service Provider
 
Posts: 18
Liked: 2 times
Joined: Tue Jan 19, 2016 4:51 pm

Re: Restoring Active Directory Domain Controllers

Veeam Logoby SteeleTek » Thu Oct 12, 2017 9:41 pm

It seems like we mainly experience this when other Domain Controllers in the domain (such as the secondary one) is not also restored/available. Obviously, this can occur if the RID master is not available but in our case we were restoring the RID master.

Lesson learned: always restore ALL the domain controllers, even the secondary ones!
SteeleTek
Service Provider
 
Posts: 18
Liked: 2 times
Joined: Tue Jan 19, 2016 4:51 pm

Re: Restoring Active Directory Domain Controllers

Veeam Logoby final » Fri Oct 13, 2017 7:29 am

Restoring AD is a pain if you have multiple DCs (which you should). Each AD-Object has a version number attached to it. During DC-Sync, it's "higher version wins" - so your newly restored DC will get all the newer AD objects from the other DCs as soon as it has a connection to them. If you restore your DC because you actually want to restore your AD to an older state, then you have two options:
1. restore all DCs to a state before the "catastrophic event"
2. restore one DC, boot it up in "restore mode" (F8 during boot) and without a network connection, and use ntdsutil to perform an "authoritative restore". I believe this does nothing else than increase the version number of all AD objects on the specific DC by a large number, therefore ensuring that the DC now has the highest version number on all AD objects. After that, you can give the DC back its network connection, and all other DCs will replicate the old (now new) state from the restored DC.

Fortunately, the last and only AD restore I had to do is about 8 years ago. Maybe the restoring process is more sophisticated these days than it was back in the day, so my info may be a bit outdated.
final
Enthusiast
 
Posts: 27
Liked: 10 times
Joined: Sun Aug 14, 2016 7:19 pm

Re: Restoring Active Directory Domain Controllers

Veeam Logoby foggy » Fri Oct 13, 2017 11:32 am 1 person likes this post

Here's a KB article describing domain controller recovery peculiarities in detail, should answer your concerns.
foggy
Veeam Software
 
Posts: 16271
Liked: 1302 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

[MERGED] Will Veeam work if AD server is offline?

Veeam Logoby Fwiler » Thu Oct 19, 2017 8:10 pm

Planning our disaster recovery solution.

If our AD servers are down will Veeam work on restoring these? The reason I ask is I've provided domain admin credentials within Veeam for backups and replication.
Should I be using different credentials, or does Veeam use cached credentials once you've entered them?

If the Veeam server itself goes out and I have to reinstall Veeam on a different server, would that also require a working AD server?

Thanks.
Fwiler
Novice
 
Posts: 8
Liked: never
Joined: Wed Jul 13, 2016 4:34 pm
Full Name: Dustin Fulwiler

Re: Will Veeam work if AD server is offline?

Veeam Logoby DGrinev » Fri Oct 20, 2017 2:31 pm

Hi Dustin,

You're good to go with the domain admin credentials. Also, check the KB about the DC restore process.
You can restore Veeam Backup server without working AD.
Please review this thread for additional information. Thanks!
DGrinev
Veeam Software
 
Posts: 1022
Liked: 108 times
Joined: Thu Dec 01, 2016 3:49 pm
Full Name: Dmitry Grinev

[MERGED] Active Directory restore

Veeam Logoby BIGNOOKIE » Tue Dec 19, 2017 3:55 am

I have seen some other posts on this forum regarding AD restores but I seem to be going nowhere rapidly.
The jobs are setup to be application aware etc.
The AD server is backed up over CloudConnect and I have asked our provider to restore the server for DR testing.
I boot the server and login using DSRM and then reboot normally.
However I have no DNS and no AD.
At first I thought it was because it was a member AD server (no FSMO roles) (2012R2) but seizing didn't work.
So I removed that server and backed up the server hosting all the FSMO roles (2008R2).
Had it restored again and essentially the same result.
What am I missing here? Google isn't been that helpful :-)
I thought Veeam was all about availability but if you can't even stand up your AD, there's not much point bothering with your other servers....
BIGNOOKIE
Lurker
 
Posts: 2
Liked: never
Joined: Sun May 07, 2017 10:51 pm
Full Name: Nick Johnston

Re: Veeam B&R recovery of a domain controller

Veeam Logoby foggy » Tue Dec 19, 2017 11:05 am

Hi Nick, please review the domain controller recovery peculiarities for better understanding.
foggy
Veeam Software
 
Posts: 16271
Liked: 1302 times
Joined: Mon Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson

Previous

Return to Veeam Backup & Replication



Who is online

Users browsing this forum: No registered users and 31 guests