Procedure to remove Veeam B&R server from Domain Controller

[mikhael]

In the case of:
- small infrastructure with no.2 vSphere hosts and only one operative Veeam B&R server installed in a VM (and replicated on the second host)
- the VM is dedicated only to the Veeam B&R server and all related Veeam services including Veeam ONE is installed on the same Microsoft Server 2019 istance
- main repo is an iSCSI attached storage via the Microsoft initiator ReFS formatted

...wishing to remove this Veeam B&R server from Microsoft Domain Controller (Veeam best practice),

we can simply (procedure 1):
1) remove the Microsoft instance from the domain
2) change the account and credentials used by veeamone and its database

or it is better a migration (procedure 2):
1) disable all Veeam Jobs
2) perform a Veeam configuration backup and stop all Veeam Services
3) prepare a new Microsoft Server 2019 VM and apply MS updates
4) configure the additional network dedicated to iSCSI, the iSCSI initiator / chap authentication and connect to the existing repo with the SAME DRIVE LETTER
5) make a fresh Veeam B&R and Veeam One installation
6) restore functionality from the point 2 config backup

Probably the procedure 2) better guarantees the complete cleaning of the Domain Admins accounts profiles, registry and password previously used in the VM which had worked joined in MS AD ?

In case the procedure 2) is better, what about the Veeam One historical data migration ?
This is the only way: https://www.veeam.com/kb1801 ?

tks

[Vitaliy S.]

Hi Michele,

Yes, I would agree that Procedure 2 is a better (or proper way) to do it. Moreover, can you please tell me how did you install Veeam ONE server to a DC our setup does not support it due to lack of local groups (only domain ones are present)?

As for your last question, then yes, this KB talking about Veeam ONE db migration is still valid/only way.

Thanks!

[mikhael]

Hi.

Finally I used the procedure 2. The initial installation phase, starting from zero, of Veeam Backup server and Veeam One, together with the construction of a Microsoft Server, takes a long time before being able to use the configuration file. In the event of a disaster recovery it is much better to have a backup, or better a replica, of the Veeam server. Regarding Veeam One, in my text I referred to a virtual machine that was already dedicated solely to Veeam Backup server and Veeam One, but joined in the main company domain controller. Veeam One was not in the same VM as the DC, it was simply in a VM joined in the DC. Now, both Veeam Backup Server, the proxy and Veeam One are in the same dedicated MS 2019 virtual machine, but no longer joined in the DC. Because of the small customer enviroment, I will leave the Veeam dedicated machine outside the domain instead of creating a new one just only for one instance.

The main repository is an iSCSI QNAP storage which use the Microsoft Server iSCSI initiatior of the Veeam virtual machine.
The offsite repository is a Windows Server 2019 ReFS DAS isolated by the destination firewall with time based rules which open only during night backup copy transfer hours.