Replicating a Domain Controller

Discussions specific to VMware vSphere hypervisor

Replicating a Domain Controller

Veeam Logoby marius roma » Sat Jun 02, 2012 2:39 pm

After replicating a Windows Server 2008 R2 Domain Controller I start the replica and I get a black screen with the option to start the VM normally or in command line mode.
At replication time the source VM is up and running.
I select to start Window normally and the VM starts, but when I try to logon with any domain user account I get an error saying that "There are no logon servers available to service the logon request".
If I clone the replica VM the clone starts with no problem an I can logon with no problem...
Given the source DC cannot be powered off at repliuca time, what is the best practice to replicate a DC and allow the replica work as expected?
Regards
marius
marius roma
Expert
 
Posts: 339
Liked: 3 times
Joined: Wed Feb 01, 2012 12:04 pm
Full Name: Mario

Re: Replicating a Domain Controller

Veeam Logoby Jfmoots » Sat Jun 02, 2012 5:17 pm 1 person likes this post

On the Guest Processing page of your replication job, do you have a check in the box to "Enable application-aware image processing"?

What type of vNIC to you have configured on this machine?

What are you doing to make it safe to boot this DC in your enviroment? Are you "breaking" network connectivity to this replica when you boot it? Bringing up a copy of a production DC in production is scary to me...

How exactly are you starting the replica? Through the Veeam console by selecting "Failover" or are you manually starting it from the VI Client?
Jfmoots
Veeam Software
 
Posts: 214
Liked: 26 times
Joined: Fri Oct 28, 2011 3:26 pm
Location: Ohio, United States
Full Name: James Moots

Re: Replicating a Domain Controller

Veeam Logoby Gostev » Sat Jun 02, 2012 5:29 pm 3 people like this post

Basically, you cannot pull a single DC from a multi-DC environment, and expect it to work in the isolated environment. Because what happens is it will fail to find replication partners (other DCs), and will stop the NETLOGON service.

Also, keep in mind that you must wait for the DC to automatically reboot (after it completes the VSS restore process) before attempting to logon.

One of these 2 points is likely the cause for your issue.

Please search the existing topics for more information and the detailed description of the DC restore.
Gostev
Veeam Software
 
Posts: 21644
Liked: 2426 times
Joined: Sun Jan 01, 2006 1:01 am
Location: Baar, Switzerland

Re: Replicating a Domain Controller

Veeam Logoby marius roma » Sun Jun 03, 2012 11:06 am

Thank you for the messages.

Let me provide somer further information:

- The DC is the only DC in its own forest
- The vNIC is E1000
- I try to start the replica from the vSphere client and the replica starts in black screen with the options to start in save mode or normally; I select to start Windows normally and Windows starts; should I start in safe mode?
- I start the VM replice from the vSphere client; consider I really don't want to start it (the source is up and running), I only want to be sure that the replica process was successfully and that the replica can start if I need it; should I start it from the Veeam console? Can I start the replica fron the Veeam console without creating problems to the source VM?
- There are no other DCs as the DC is the only DC in its own forest
- I don't configure the DC to automatically reboot as I don't want to reboot it; I only want to perform a test to see if the replica can reboot in case of need...

Any further help will be strongly apreciated...
Marius
marius roma
Expert
 
Posts: 339
Liked: 3 times
Joined: Wed Feb 01, 2012 12:04 pm
Full Name: Mario

Re: Replicating a Domain Controller

Veeam Logoby tkrajewski » Sun Jun 03, 2012 5:36 pm 1 person likes this post

Hi Marius,
Do I understand it correctly, that at some point in time, you have two DCs, with the same names, IPs, MAC addresses, SIDs, etc, running in the same network? Or do you try to isolate replica before starting up in some non-production network?

Tomasz
Tomasz
tkrajewski
Veeam Software
 
Posts: 139
Liked: 34 times
Joined: Tue Jan 17, 2012 5:47 pm
Full Name: Tomasz Krajewski

Re: Replicating a Domain Controller

Veeam Logoby Vitaliy S. » Sun Jun 03, 2012 9:43 pm 1 person likes this post

marius roma wrote:- I try to start the replica from the vSphere client and the replica starts in black screen with the options to start in save mode or normally; I select to start Windows normally and Windows starts; should I start in safe mode?

Please check an existing topic for the answer: Veeam B&R v5 recovery of a domain controller
Vitaliy S.
Veeam Software
 
Posts: 20090
Liked: 1157 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: Replicating a Domain Controller

Veeam Logoby habibalby » Mon Jun 04, 2012 5:05 am 3 people like this post

Hello,
I have created this document for my environment; hope it's applicable to yours.

Thanks,

Restoring Active Directory / Domain Controller using Veeam Backup & Replication


When Domain Controller backed up with Veeam software, the backup runs with VSS integration which will back up the NTDS database by butting the Active Directory Database into backup state like any other backup software or when System State runs.
Below is the procedure to restore Domain Controller after successfully backed up using veeam software.

1.Restore the Virtual Machine to the datastore that accessible by ESX host where the VM will run.
2.Once restoration is successful, make sure before you Power On the VM to put it in a private PortGroup. This will avoid conflicting the machine name / IP address with the production VM.
3.First boot it goes into safe mode Non-Authoritative Restore it’s by default
4.Second boot it goes into Directory Restore Mode. This will ask you to provide the local username and password of the domain controller / during DS setup:
a.Username: Administrator
b.PWD: Password
5.Third boot it goes again into Directory Restore Mode. If this is the case here's the trick. It goes into DRM because it doesn't uncheck the Safe Mode and Active Directory Repair in the Boot Option under the MSConfig System Configuration.
6.Run MSConfig and unchecked the Safe Mode boot and reboot the machine
7.At this step, the DC starts normally and it gives the below indications as the restoration successfully done.


Event IDSourceDescription
1004DFSRThe DFS Replication Service Started
6102DFSRThe DFS Replication Service successfully registered with WMI
1206DFSRThe DFS Replication Service successfully contacted Domain Controller “Name”
1000ActiveDirectory_DomainServiceMicrosoft Active Directory Domain Service Startup Completes
1394ActiveDirectory_DomainServiceAll problem preventing updates to the Active Directory Domain Services database has been cleared.

Note: This procedure tested on a “Test” Primary Domain Controller and an Additional Domain Controller that backed up from production ADC. If this procedure will be tested on a private environment where the Primary Domain Controller doesn’t exist or the Primary Domain Controller is Physical and doesn’t want to be interrupted it, then Sezing the FSMO Roles is required to have full function of Active Directory Service.
habibalby
Expert
 
Posts: 350
Liked: 23 times
Joined: Mon Jul 18, 2011 9:30 am
Location: Bahrain
Full Name: Hussain Al Sayed

Re: Replicating a Domain Controller

Veeam Logoby dellock6 » Mon Jun 04, 2012 7:06 am 1 person likes this post

Great how-to, thanks for it! :)

Luca.
Luca Dell'Oca
EMEA Cloud Architect @ Veeam Software

@dellock6
http://www.virtualtothecore.com
vExpert 2011-2012-2013-2014-2015-2016
Veeam VMCE #1
dellock6
Veeam Software
 
Posts: 5157
Liked: 1386 times
Joined: Sun Jul 26, 2009 3:39 pm
Location: Varese, Italy
Full Name: Luca Dell'Oca

Re: Replicating a Domain Controller

Veeam Logoby habibalby » Mon Jun 04, 2012 7:09 am 1 person likes this post

dellock6 wrote:Great how-to, thanks for it! :)

Luca.


Thanks dear :)
habibalby
Expert
 
Posts: 350
Liked: 23 times
Joined: Mon Jul 18, 2011 9:30 am
Location: Bahrain
Full Name: Hussain Al Sayed

Re: Replicating a Domain Controller

Veeam Logoby marius roma » Mon Jun 04, 2012 7:31 am

Many thanks to everybody for the answers and the support.
Lert me ask for some further clarification and provide some further details.

tkrajewski wrote:Hi Marius,
Do I understand it correctly, that at some point in time, you have two DCs, with the same names, IPs, MAC addresses, SIDs, etc, running in the same network? Or do you try to isolate replica before starting up in some non-production network?

Tomasz


I have two separate vSphere infrastructures in two separate places, with different IP addresses.
What I expect, from replica, is being able to power on my DC (I repeat, it's the only DC in its own forest...) in the replica site in the simplest possible way.

In topic "Veeam B&R v5 recovery of a domain controller" (see viewtopic.php?f=2&t=7000&hilit=domain+controller+restore) Gostev says:

Gostev wrote:1. DC will always boot in non-authoritative mode, which is exactly what you want most of the time. You should not need to perform authoritative restore in most cases unless your Active Directory corrupts or something because, authoritative restore reverts AD to the earlier point in time and can cause too many additional issues by itself. It is really the last resort. But if you need to perform it from Veeam backup, there are existing discussion with verified procedure posted on this forum that you can refer to.


Should I presume that my AD got corrupted during the replica process? I think I don't need to boot in non-authoritative mode, as I presume that my AD is not corrupted.
Can I just skip the AD recovery process and boot my replica normally?

Thanks to habibalby for the detailed instuctions, but is there a way to skip the suggested procedure?

habibalby wrote:1.Restore the Virtual Machine to the datastore that accessible by ESX host where the VM will run.
2.Once restoration is successful, make sure before you Power On the VM to put it in a private PortGroup. This will avoid conflicting the machine name / IP address with the production VM.
3.First boot it goes into safe mode Non-Authoritative Restore it’s by default
4.Second boot it goes into Directory Restore Mode. This will ask you to provide the local username and password of the domain controller / during DS setup:
a.Username: Administrator
b.PWD: Password
5.Third boot it goes again into Directory Restore Mode. If this is the case here's the trick. It goes into DRM because it doesn't uncheck the Safe Mode and Active Directory Repair in the Boot Option under the MSConfig System Configuration.
6.Run MSConfig and unchecked the Safe Mode boot and reboot the machine
7.At this step, the DC starts normally and it gives the below indications as the restoration successfully done.


To resume, given I have a DC in une site and I need to have a replica in a replica site, and given I must be able to start the replica in the simplest and fastest way, is replica the right tool?
Should I do anything else?
By the way a made a test and cloned the replica using vShpere tools. The clone of the replica boots normaly with no visible problem. But it's, obviously, a complicated solution...
Regards
marius
marius roma
Expert
 
Posts: 339
Liked: 3 times
Joined: Wed Feb 01, 2012 12:04 pm
Full Name: Mario

Re: Replicating a Domain Controller

Veeam Logoby habibalby » Mon Jun 04, 2012 7:42 am 1 person likes this post

AD is a complicated product of microsoft and purely depends on USN even cloning it is not supported at all or snapshoting it. But veeam the excellent backup product of Virtualization, made MicroCrap :) to beleive is a supported product to backup application-aware of MicroCrap products.

Alternative methods you can replicate your DC and on your production DC, make a System State backup and restore it on a daily basis to the Replica DC. It's over complicated than backing your DC up with Veeam, shifted to DR/Remote Site and get it restored over there.
habibalby
Expert
 
Posts: 350
Liked: 23 times
Joined: Mon Jul 18, 2011 9:30 am
Location: Bahrain
Full Name: Hussain Al Sayed

Re: Replicating a Domain Controller

Veeam Logoby Vitaliy S. » Mon Jun 04, 2012 9:15 am 1 person likes this post

marius roma wrote:Should I presume that my AD got corrupted during the replica process? I think I don't need to boot in non-authoritative mode, as I presume that my AD is not corrupted.

Your AD is not corrupted during replication process.
marius roma wrote:Can I just skip the AD recovery process and boot my replica normally?

To boot your DC in consistent and "working" state, these steps are required. Please look through this blog post for additional details:
http://www.veeam.com/blog/vss-and-vmwar ... g-you.html
Vitaliy S.
Veeam Software
 
Posts: 20090
Liked: 1157 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: Replicating a Domain Controller

Veeam Logoby marius roma » Tue Jun 05, 2012 4:22 pm

I hope that the question is not too much stupid...
Given a DC that is the only DC in its own forest (nothing to replicate with other DCs), what is supposed to happen if I replicate or backup it while it is powered off?
Should I expect it to start in safe mode or to start normally?
Mainly, should I expect to start AD recovery or just to start normally?
Regards
marius
marius roma
Expert
 
Posts: 339
Liked: 3 times
Joined: Wed Feb 01, 2012 12:04 pm
Full Name: Mario

Re: Replicating a Domain Controller

Veeam Logoby Vitaliy S. » Tue Jun 05, 2012 4:44 pm 1 person likes this post

I believe replicating powered off DC won't require any extra recovery steps, so it should boot up normally (same situation as you would have just power off, and then power on the DC VM later).
Vitaliy S.
Veeam Software
 
Posts: 20090
Liked: 1157 times
Joined: Mon Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov

Re: Replicating a Domain Controller

Veeam Logoby marius roma » Wed Jun 06, 2012 8:31 am

Many thanks to everybody.
I made a test performing a backup (I will try a replica as well, but I presume the results are the same) and the DC restored from the backup powered up without any problem.

My only trouble, now, is that it looks like backup and replica of powered off VM looks slooooooower that backup and replicas of powered on VM. Is it my feeling or is it the standard behavior?
If so, does it depend on the missing VSS support (in powered off VMs)? Is there any way to speed up the backup and the replica of powered off VM?

Let me ask another question: imagine I perform a replica of my VM every night.
The very first replica takes a lot of time (because I need to replicate the whole VM), further replicas are faster and faster (because I transfer only updates).
If I usually replicate my VM while it is powered on and one night I power my VM down before replicating it, should I expect the replica to be fast as usually or to take the same time as the very first (when the whole of the VM had been replicated)?
Regards
marius
marius roma
Expert
 
Posts: 339
Liked: 3 times
Joined: Wed Feb 01, 2012 12:04 pm
Full Name: Mario

Next

Return to VMware vSphere



Who is online

Users browsing this forum: Google [Bot], jguillot and 1 guest