Forum Discussion

soulseeker's avatar
soulseeker
Level 4
10 years ago

Restoring Active directory with BE2014

Hi there,

first of all - I don't have an actual problem, just thinking about "what if...".

Ok, what, if I have to revert my AD to an earlier point of time. I now about authorative restores but I hope I can accomplish this only with BE.

Currently we use 3 DCs ... one 2008, that holds all the FSMO-roles and another 2008 that is just global catalog. Same for a 2012R2.

When I plan to revert my AD let's say to last week, do I only have to restore the system state of the main DC? Does BE treat this as an authorative restore? Do all reverted changes automatically replicate to my other DCs?

Sorry if this may feel like a NOOB-question, but when I am facing the problem I'd like to know what I can expect when messing around with a DC.

Thanks :)

Marcel 

2014
Backup and Recovery
Backup Exec
Windows Server (2003-2008)
  • pkh's avatar
    pkh
    10 years ago

    No.  There is no simple way to do an AD authoritative restore.

    To do an authoritative restore of AD, you must follow the authoritative AD restore steps given in the first document referenced earlier.  In fact, it would be like recovering the server. Unless you are absolutely sure that the contents of the C: drive is exactly in sync with the registry, then you need to restore the contents of the C: drive to what it was a week ago before restoring the system state from a week ago.

    The moral of the story is that you hope that you never have to restore AD.  Have a couple of DC's so that the failure of a DC will not crash the entire AD.  Use the BE AD agent if you have a need to restore deleted AD objects which is probably the only reason why you need to revert your AD to a week ago. Also remember that by reverting to the AD state one week ago means that all the changes since then would be lost, e,g any user who changed their password during this period would revert to their old password.  You can imagine the chaos that would ensue.

6 Replies

Sort By
  • Colin_Weaver's avatar
    Colin_Weaver
    Moderator
    10 years ago

    You still have to set an authoritative restore as otherwise what you restore will be replicated over by existing DCs (in other words our restore is non-authoritative - unless you only have one DC in your environment)

  • soulseeker's avatar
    soulseeker
    Level 4
    10 years ago

    Thanks for your reply but the articles do not really answer my question. Or maybe I didn't get it.

    I do not talk about a complete retore of a failed DC and the necessity to reinstall the whole OS ... "just" an AD restore of let's say last weeks backup. So to revert a scheme update or whatever. Can I mark the restore-operation from backup exec as authorative in any way so that the changes will also be reverted on the other DCs?

  • pkh's avatar
    pkh
    Moderator
    10 years ago

    No.  There is no simple way to do an AD authoritative restore.

    To do an authoritative restore of AD, you must follow the authoritative AD restore steps given in the first document referenced earlier.  In fact, it would be like recovering the server. Unless you are absolutely sure that the contents of the C: drive is exactly in sync with the registry, then you need to restore the contents of the C: drive to what it was a week ago before restoring the system state from a week ago.

    The moral of the story is that you hope that you never have to restore AD.  Have a couple of DC's so that the failure of a DC will not crash the entire AD.  Use the BE AD agent if you have a need to restore deleted AD objects which is probably the only reason why you need to revert your AD to a week ago. Also remember that by reverting to the AD state one week ago means that all the changes since then would be lost, e,g any user who changed their password during this period would revert to their old password.  You can imagine the chaos that would ensue.

  • soulseeker's avatar
    soulseeker
    Level 4
    9 years ago

    Thanks again and sorry for my late reply. My reason for thinking about this was not the ability to restore missing AD-objects, but maybe reverting a scheme change. I had to update my scheme for an update of the lync-server. If this lync-update will be unsuccessfull, I must revert the scheme ... so this would only be possible with an authorative restore of the whole "main"-DC that holds all the roles. What a nightmare.

    I really hoped that I could only restore the system state of this DC and wait for replication to the other DCs that are only global catalogs.

  • CraigV's avatar
    CraigV
    Moderator
    9 years ago

    Yeah unfortunately this is MS-related, and not Backup Exec at all. BE is simply the means to get your restore done and plays no part in what happens from an infrastructure-recovery point of view.

    Thanks!