Availability for the Always-On Enterprise
Post Reply
peeky1323
Service Provider
Posts: 96
Liked: 8 times
Joined: May 30, 2012 11:58 am
Full Name: Matt Peek
Contact:

[MERGED] Restoring Multiple Domain Controllers

Post by peeky1323 » Aug 22, 2017 3:14 pm

Hi everyone.

I have a strange issue here. We have 3 domain controllers (2x2012 R2 and 1 2008 R2). I am trying to restore them into a test setup and I have restored one and followed the guide here:

https://www.veeam.com/blog/how-to-recov ... ction.html

for performing an authoritative restore. I then restored the other 2. My AD is broken and cannot start AD users and computers, sites and services etc, replication will not work, and can't login to any member servers I have restored into this test setup. After much troubleshooting I tracked down the regitry key sysvolready was set to 0 on all servers. After changing this to 1 things are improving and cna now login and start the AD tools (I haven't looked beyond this yet to see if there are still issues). Is there a set procedure for restoring multiple DCs? Do you perform the authoritative restore steps on one that holds a certain role or anyone?

Many thank,

Matt
Matt Peek
VMCE V9

foggy
Veeam Software
Posts: 16821
Liked: 1358 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Restoring Multiple Domain Controllers

Post by foggy » Aug 22, 2017 4:01 pm

Hi Matt, please review this KB describing all the nuances of domain controller recovery, including your scenario. Just to confirm, you have application-aware image processing enabled on the corresponding backup job, right?

SteeleTek
Service Provider
Posts: 18
Liked: 2 times
Joined: Jan 19, 2016 4:51 pm
Contact:

[MERGED] Restoring Active Directory Domain Controllers

Post by SteeleTek » Oct 12, 2017 6:24 pm

Greetings,

One of the most common issues I experience when using Veeam to restore a backup or failover a replica of Windows Server 2008 R2 Active Directory Domain Controllers is being unable to create new objects in AD (user/computer/group). We receive the error "Windows cannot create the object OBJECTNAME because: The directory service was unable to allocate a relative identifier."

The DC we restore is the PDC master, Infrastructure master, and RID master.

This article from Microsoft doesn't seem applicable since the DC we restored already has all the necessary master roles: https://support.microsoft.com/en-us/hel ... irectory-s

Anyone else experience this issue when restoring Veeam backups of a DC or performing a failover to a replica for a DC?

Thank you!

SteeleTek
Service Provider
Posts: 18
Liked: 2 times
Joined: Jan 19, 2016 4:51 pm
Contact:

Re: Restoring Active Directory Domain Controllers

Post by SteeleTek » Oct 12, 2017 9:41 pm

It seems like we mainly experience this when other Domain Controllers in the domain (such as the secondary one) is not also restored/available. Obviously, this can occur if the RID master is not available but in our case we were restoring the RID master.

Lesson learned: always restore ALL the domain controllers, even the secondary ones!

final
Enthusiast
Posts: 32
Liked: 11 times
Joined: Aug 14, 2016 7:19 pm
Contact:

Re: Restoring Active Directory Domain Controllers

Post by final » Oct 13, 2017 7:29 am

Restoring AD is a pain if you have multiple DCs (which you should). Each AD-Object has a version number attached to it. During DC-Sync, it's "higher version wins" - so your newly restored DC will get all the newer AD objects from the other DCs as soon as it has a connection to them. If you restore your DC because you actually want to restore your AD to an older state, then you have two options:
1. restore all DCs to a state before the "catastrophic event"
2. restore one DC, boot it up in "restore mode" (F8 during boot) and without a network connection, and use ntdsutil to perform an "authoritative restore". I believe this does nothing else than increase the version number of all AD objects on the specific DC by a large number, therefore ensuring that the DC now has the highest version number on all AD objects. After that, you can give the DC back its network connection, and all other DCs will replicate the old (now new) state from the restored DC.

Fortunately, the last and only AD restore I had to do is about 8 years ago. Maybe the restoring process is more sophisticated these days than it was back in the day, so my info may be a bit outdated.

foggy
Veeam Software
Posts: 16821
Liked: 1358 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Restoring Active Directory Domain Controllers

Post by foggy » Oct 13, 2017 11:32 am 1 person likes this post

Here's a KB article describing domain controller recovery peculiarities in detail, should answer your concerns.

Fwiler
Novice
Posts: 8
Liked: never
Joined: Jul 13, 2016 4:34 pm
Full Name: Dustin Fulwiler
Contact:

[MERGED] Will Veeam work if AD server is offline?

Post by Fwiler » Oct 19, 2017 8:10 pm

Planning our disaster recovery solution.

If our AD servers are down will Veeam work on restoring these? The reason I ask is I've provided domain admin credentials within Veeam for backups and replication.
Should I be using different credentials, or does Veeam use cached credentials once you've entered them?

If the Veeam server itself goes out and I have to reinstall Veeam on a different server, would that also require a working AD server?

Thanks.

DGrinev
Veeam Software
Posts: 1218
Liked: 128 times
Joined: Dec 01, 2016 3:49 pm
Full Name: Dmitry Grinev
Location: St.Petersburg
Contact:

Re: Will Veeam work if AD server is offline?

Post by DGrinev » Oct 20, 2017 2:31 pm

Hi Dustin,

You're good to go with the domain admin credentials. Also, check the KB about the DC restore process.
You can restore Veeam Backup server without working AD.
Please review this thread for additional information. Thanks!

BIGNOOKIE
Novice
Posts: 3
Liked: never
Joined: May 07, 2017 10:51 pm
Full Name: Nick Johnston
Contact:

[MERGED] Active Directory restore

Post by BIGNOOKIE » Dec 19, 2017 3:55 am

I have seen some other posts on this forum regarding AD restores but I seem to be going nowhere rapidly.
The jobs are setup to be application aware etc.
The AD server is backed up over CloudConnect and I have asked our provider to restore the server for DR testing.
I boot the server and login using DSRM and then reboot normally.
However I have no DNS and no AD.
At first I thought it was because it was a member AD server (no FSMO roles) (2012R2) but seizing didn't work.
So I removed that server and backed up the server hosting all the FSMO roles (2008R2).
Had it restored again and essentially the same result.
What am I missing here? Google isn't been that helpful :-)
I thought Veeam was all about availability but if you can't even stand up your AD, there's not much point bothering with your other servers....

foggy
Veeam Software
Posts: 16821
Liked: 1358 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Veeam B&R recovery of a domain controller

Post by foggy » Dec 19, 2017 11:05 am

Hi Nick, please review the domain controller recovery peculiarities for better understanding.

Post Reply

Who is online

Users browsing this forum: alex.mihai, BrentBPPI, darmarko and 63 guests