Active Directory Backup / Restore

[pyaeger]

We are in the process of migrating our DC's to 2008 from 2003.  Our requirement is to be able to backup our active directory and restore to either same or different hardware for the purposes of on site recovery and/or offsite disaster recovery.  We have backup exec 12.5 in place now and with the DC's on server 03 we had been using the windows backup utility to backup AD to disk and then using BE to write this off to tape.  Albeit a little convoluted, we were able to restore AD to different hardware using this method.  With 2008 you can't backup AD in this manner anymore.  What product/products will we need to be able to accomplish this task moving forward?

Thanks,

Pete

[pkh]

BE is able to backup the AD.  Just backup the system state of a DC and AD will be backed up along with some other files.  This system state can be restored back to the DC.  This is an all or nothing restore.  If you need to restore individual AD objects, then you need to purchase the AD Remote Agent option.  ADRA allows you to restore individual objects, like a userid which has been accidentally deleted.

[Symanticus]

So does this means if the BE Media Server is the DC itself then it can backup self by just selecting the system state components only ?

and then for restoration,

1. setup the Windows Server 2008 as normal role

2. install RAWS on the server above

3. perform restore to the server of the backup system state components then reboot.

is that the proper way of doing it ?

[pkh]

So does this means if the BE Media Server is the DC itself then it can backup self by just selecting the system state components only ?

No. With only the backup of the system state, you would not be able to restore the entire media server.  When you want to restore the media server, you would have to load the OS and other applications, including BE, from their installation disks before you can restore the system state.  When you install BE, RAWS is automatically installed on the media server.

There is an entire section in the Admin Guide on how to prepare for a restore.  I would suggest that you get familiar with it.

[Symanticus]

thanks for your explanation man, i really appreciate that.

Cheers,

Albert

[pyaeger]

I believe I have read in the standard documentation that the regular remote agent will NOT allow for an AD restore to different hardware.  We attempted this in the past with no success.  I guess I'm wondering if the AD remote agent will do any better with this?  Also, what is the first version of BE that supports windows 2008 R2 clients?

Thanks.

[pkh]

I believe I have read in the standard documentation that the regular remote agent will NOT allow for an AD restore to different hardware

Can you be a bit more specific?  Which documentation are you refering to?

We attempted this in the past with no success.

What exactly did you try to restore?  The entire system state?

Also, what is the first version of BE that supports windows 2008 R2 clients?

BE 12.5

[pyaeger]

BE admin guide pg 475 had the info about identical make and model of hardware.  A call with Symantec also verified that AD restore to different hardware was not supported, at least using regular remote agent for AD backup.

I really just want to know if the AD agent will do a backup we could use to restore active directory from scratch on new/different hardware.  I'm really not worried about the granular restore capabilities of the agent, but the bigger picture.

Thanks.

[Colin_Weaver]

Hi there

I am not sure which version of Backup Exec you were reading the Admin guide for as Page 475 in the BE 2010 version discusses robotic libraries and in the 12.5 version is a summary of job status. Hence can't confirm against what your comment about the guide.

However a few comments - Active Directory backups without ADRA (the recovery agent) are part of the system state and can ONLY be restored as a System State Restore - which means the servername must be the same as the original. There is a small amount of leeway on whether a System State will restore to dissimilar hardware, however we can't predict where problems might occur - or even where the restore will appear to work but something in the System State will cause a Blue Screen issue on restart.

Note when version 11D was released we added some functionality to IDR to help with dissimilar hardware in terms of the recovery of the complete machine and obviously a system state restore is part of what is recovered in IDR. That said the abilitities of Backup Exec System Recovery (BESR - a Separate product from Backup Exec) with Restore Anywhere capability are usually a better option for dissimilar hardware recovery.

 The Active Directory Recovery Agent (ADRA) is an optional agent which provides the ability to recover individual objects within AD. ADRA is not a DR function - you would need to restore the System State to DR a DC. 

As part of how it works it ADRA requires a System State Backup too - also the restore job properties for restoring an individual object don't appear to have a redirection capability so the original DC would have to be online to make use of the object restoration anyway.

As a final comment, most backup products have to backup Active Directory as part of the System State so would have similar limitations with regards possible blue screens on restart because of the hardware differences. So in reality it is difficult to beat having more than one DC in an environment - preferably in different buildings

[Colin_Weaver]

BTW Windows 2008 still has a Backup to Disk utility - it can no longer Backup to tape so although your original configuration on 2003 was a tad unusual - I thought you could still backup the 2008 System State using the inbuilt utility (which is now called Windows Server Backup) - as previously mentioned though if there are configurations in the system state that look for harwdare that is no longer present then after a restore, instability and blue screen issues can be seen as the drivers try to load.