Active Directory Disaster Active Directory Disaster RecoveryRecovery

Paul SimmonsPaul SimmonsSupport EngineerSupport EngineerDirectory ServicesDirectory ServicesMicrosoft CorporationMicrosoft Corporation

DefinitionDefinition

Resolving problems on MicrosoftResolving problems on Microsoft® ® WindowsWindows®® domain domain controllers that affect client, domain, or forest controllers that affect client, domain, or forest operationoperation–– In the least amount of timeIn the least amount of time With the least amount of painWith the least amount of pain With the best possible resultsWith the best possible results

Preventive MaintenancePreventive Maintenance

Use good hardware and test it regularlyUse good hardware and test it regularly Test deployments in a lab before deployment Test deployments in a lab before deployment Practice recovery scenarios in a labPractice recovery scenarios in a lab Remove single points of failureRemove single points of failure Never have only one domain controller in a domainNever have only one domain controller in a domain Back up before and after every major state changeBack up before and after every major state change

Recovery OptionsRecovery Options

RebuildRebuild Winnt32, Dcpromo, and Re-replicateWinnt32, Dcpromo, and Re-replicate Known recovery time and resultsKnown recovery time and results

RestoreRestore Windows Backup (Ntbackup.exe) to restore to a known Windows Backup (Ntbackup.exe) to restore to a known

good stategood state Re-replicateRe-replicate

RepairRepair Esentutl repair of database is a last resortEsentutl repair of database is a last resort Use integrity check to see if database is damaged Use integrity check to see if database is damaged

Recovery ToolsRecovery Tools

Ntbackup – System StateNtbackup – System State Ntdsutil – Metadata CleanupNtdsutil – Metadata Cleanup Esentutl – Database Validation and RepairEsentutl – Database Validation and Repair Winnt32 – RebuildWinnt32 – Rebuild Dcpromo – Re-promoteDcpromo – Re-promote Component level recoveryComponent level recovery

FAZAMFAZAM Dfsutil.exeDfsutil.exe

NtbackupNtbackup

Features:Features: Backs up Active DirectoryBacks up Active Directory®® in online mode in online mode Scheduled backupsScheduled backups

What to back upWhat to back up System state: Active Directory, boot files, registry, and System state: Active Directory, boot files, registry, and

moremore

Resources:Resources: Q240363: “How to Back Up and Restore the System State”Q240363: “How to Back Up and Restore the System State” Q233427: “Files and Folders Not Backed Up Using the Q233427: “Files and Folders Not Backed Up Using the

Ntbackup.exe Tool”Ntbackup.exe Tool”

Backup LimitationsBackup Limitations

Backup life = tombstonelifetime valueBackup life = tombstonelifetime value Default = 60 days oldDefault = 60 days old Password change interval = 30 daysPassword change interval = 30 days Password history = 2 (current and previous)Password history = 2 (current and previous) Backup useful life = 60 days or two default password Backup useful life = 60 days or two default password

changeschanges Old backups can reintroduce tombstoned objectsOld backups can reintroduce tombstoned objects

Schema rollback is not supportedSchema rollback is not supported

NtdsutilNtdsutil

Metadata cleanupMetadata cleanup Remove orphaned domain controllers or domainsRemove orphaned domain controllers or domains

Integrity check and repairIntegrity check and repair Wrapper around EsentutlWrapper around Esentutl Tells you if database is damagedTells you if database is damaged

Authoritative restoreAuthoritative restore Mark selected objects on domain controller as authoritativeMark selected objects on domain controller as authoritative

Nonauthoritative RestoreNonauthoritative Restore

What is it?What is it? Restore to known good point using NtbackupRestore to known good point using Ntbackup Reboot into Active Directory mode to sync changes Reboot into Active Directory mode to sync changes

When to use When to use Recover from hardware failureRecover from hardware failure Return to known good state on single domain controller Return to known good state on single domain controller

OptionsOptions Rebuild server from scratch. Re-run Dcpromo.Rebuild server from scratch. Re-run Dcpromo. Restore machine to a known good point and sync deltas.Restore machine to a known good point and sync deltas.

Authoritative RestoreAuthoritative Restore What is it?What is it?

Restore to known good point using NtbackupRestore to known good point using Ntbackup Make objects on reference domain controller as “master Make objects on reference domain controller as “master

copy” for Active Directorycopy” for Active Directory When to useWhen to use

Accidental deletion or modification of objects or containers Accidental deletion or modification of objects or containers in the Active Directoryin the Active Directory

Corruption of objects/attributes in the directoryCorruption of objects/attributes in the directory OptionsOptions

Find a good domain controller that has the objects and Find a good domain controller that has the objects and make it authoritativemake it authoritative

Restore from a backup that contains the objects and make Restore from a backup that contains the objects and make it authoritativeit authoritative

Authoritative RestoreAuthoritative Restore

Boot into offline restore mode Boot into offline restore mode Press F8 during boot phasePress F8 during boot phase Log on with offline administrator accountLog on with offline administrator account

Mark objects in Ntdsutil as authoritativeMark objects in Ntdsutil as authoritative Find machine with objects or restore themFind machine with objects or restore them Restore subtree or entire database (rare)Restore subtree or entire database (rare)

Best practiceBest practice Use most specific distinguished name path needed for Use most specific distinguished name path needed for

recoveryrecovery Restore Active Directory over Terminal ServicesRestore Active Directory over Terminal Services––Q256588Q256588

Winnt32 and DcpromoWinnt32 and Dcpromo

What is it?What is it? Reinstall of OSReinstall of OS Run Dcpromo Run Dcpromo

When to useWhen to use Known recovery time and end resultKnown recovery time and end result No applications or services to protect No applications or services to protect

OptionsOptions Maintain standby server that can be shipped to remote siteMaintain standby server that can be shipped to remote site

ScenariosScenarios

Hardware failureHardware failure

Deleted objects in Active DirectoryDeleted objects in Active Directory

Flexible Single Master Operation (FSMO) recoveryFlexible Single Master Operation (FSMO) recovery

Demo of authoritative restoreDemo of authoritative restore

Hardware FailureHardware Failure

Scenario:Scenario: Domain controller experiences catastrophic hardware Domain controller experiences catastrophic hardware

failurefailure

Goal:Goal: Replace bad hardware or entire server and resume Replace bad hardware or entire server and resume

operationsoperations

Given:Given: Valid backupValid backup Identical hardwareIdentical hardware

Hardware Failure Hardware Failure (2)(2)

ProcessProcess Replace server or hardwareReplace server or hardware Restore from tape backupRestore from tape backup Re-replicateRe-replicate

AlternativesAlternatives Winnt32 and Dcpromo Winnt32 and Dcpromo

Hardware Failure Hardware Failure (3)(3)

Restore to dissimilar hardwareRestore to dissimilar hardware Q263532: “Disaster Recovery of Active Directory on Q263532: “Disaster Recovery of Active Directory on

Dissimilar Hardware”Dissimilar Hardware”

RequirementsRequirements Same number of drives and drive lettersSame number of drives and drive letters Complete backup of system state and system driveComplete backup of system state and system drive Same NICS, video cards, HAL, kernel, and number of Same NICS, video cards, HAL, kernel, and number of

processorsprocessors Remove teaming network cards on targetRemove teaming network cards on target Same disk drive controller and configurationSame disk drive controller and configuration

Deleted Objects in Active DirectoryDeleted Objects in Active Directory

ScenarioScenario Critical objects have been deleted from Active DirectoryCritical objects have been deleted from Active Directory

GoalGoal To recover the objects without re-creating themTo recover the objects without re-creating them

GivenGiven A valid backupA valid backup

Deleted Objects in Active Directory Deleted Objects in Active Directory (2)(2)

Resolution; restore from tape and authoritative restore Resolution; restore from tape and authoritative restore in Ntdsutil: in Ntdsutil: Restore recent backup containing deleted objectsRestore recent backup containing deleted objects Mark deleted objects as authoritative using NtdsutilMark deleted objects as authoritative using Ntdsutil Authoritative restore in NtdsutilAuthoritative restore in Ntdsutil

Alternative:Alternative: Find replica domain controller that hasn’t received the Find replica domain controller that hasn’t received the

deletionsdeletions Mark deleted distinguished name as authoritative (no Mark deleted distinguished name as authoritative (no

restore required)restore required)

Deleted Objects in Active Directory Deleted Objects in Active Directory (3)(3)

ProtectionProtection Set replication schedule once every four days on “backup Set replication schedule once every four days on “backup

domain controller”domain controller” Mark objects as authoritative when deletion detectedMark objects as authoritative when deletion detected

FSMO RecoveryFSMO Recovery

Flexible Single Master Operations (FSMO)Flexible Single Master Operations (FSMO) Q223787: “Flexible Single Master Operation Transfer Q223787: “Flexible Single Master Operation Transfer

and Seizure Process”and Seizure Process” Transfer rolesTransfer roles

PreferredPreferred GracefulGraceful

Seizure of rolesSeizure of roles Last resortLast resort That server cannot come back online…EVER.That server cannot come back online…EVER.

Ntdsutil FSMO Transfer UINtdsutil FSMO Transfer UI

Demo: User Objects CreatedDemo: User Objects Created

Demo: Repadmin /ShowmetaDemo: Repadmin /Showmeta

Demo: System State BackupDemo: System State Backup

Demo: Deleted ObjectsDemo: Deleted Objects

Demo: Restore System StateDemo: Restore System State

Demo: Advanced OptionsDemo: Advanced Options

Demo: Authoritative RestoreDemo: Authoritative Restore

Demo: Authoritative Restore Demo: Authoritative Restore (2)(2)

Demo: Repadmin /Showmeta with Demo: Repadmin /Showmeta with Incremented Version NumbersIncremented Version Numbers

Additional References:Additional References:

Server recovery: Server recovery: http://www.microsoft.com/windows2000/techinfo/adhttp://www.microsoft.com/windows2000/techinfo/administration/fileandprint/recovery.aspministration/fileandprint/recovery.asp

Q241594: “HOW TO: Perform an Authoritative Q241594: “HOW TO: Perform an Authoritative Restore to a Domain Controller in Windows 2000”Restore to a Domain Controller in Windows 2000”

Microsoft Windows 2000 Server Distributed Systems Microsoft Windows 2000 Server Distributed Systems GuideGuide, Chapters 9 and 10, Chapters 9 and 10