cancel
Showing results for 
Search instead for 
Did you mean: 

Restoring Active directory with BE2014

soulseeker
Level 4

Hi there,

first of all - I don't have an actual problem, just thinking about "what if...".

Ok, what, if I have to revert my AD to an earlier point of time. I now about authorative restores but I hope I can accomplish this only with BE.

Currently we use 3 DCs ... one 2008, that holds all the FSMO-roles and another 2008 that is just global catalog. Same for a 2012R2.

When I plan to revert my AD let's say to last week, do I only have to restore the system state of the main DC? Does BE treat this as an authorative restore? Do all reverted changes automatically replicate to my other DCs?

Sorry if this may feel like a NOOB-question, but when I am facing the problem I'd like to know what I can expect when messing around with a DC.

Thanks :)

Marcel 

1 ACCEPTED SOLUTION

Accepted Solutions

pkh
Moderator
Moderator
   VIP    Certified

No.  There is no simple way to do an AD authoritative restore.

To do an authoritative restore of AD, you must follow the authoritative AD restore steps given in the first document referenced earlier.  In fact, it would be like recovering the server. Unless you are absolutely sure that the contents of the C: drive is exactly in sync with the registry, then you need to restore the contents of the C: drive to what it was a week ago before restoring the system state from a week ago.

The moral of the story is that you hope that you never have to restore AD.  Have a couple of DC's so that the failure of a DC will not crash the entire AD.  Use the BE AD agent if you have a need to restore deleted AD objects which is probably the only reason why you need to revert your AD to a week ago. Also remember that by reverting to the AD state one week ago means that all the changes since then would be lost, e,g any user who changed their password during this period would revert to their old password.  You can imagine the chaos that would ensue.

View solution in original post

6 REPLIES 6

Colin_Weaver
Moderator
Moderator
Employee Accredited Certified

You still have to set an authoritative restore as otherwise what you restore will be replicated over by existing DCs (in other words our restore is non-authoritative - unless you only have one DC in your environment)

CraigV
Moderator
Moderator
Partner    VIP    Accredited

Hi Marcel,


Check the TNs below and see if they help you at all:

https://support.symantec.com/en_US/article.HOWTO23130.html

https://support.symantec.com/en_US/article.HOWTO23095.html

https://support.symantec.com/en_US/article.TECH87904.html

The admin guide should also have more indepth information for you.

Thanks!

 

soulseeker
Level 4

Thanks for your reply but the articles do not really answer my question. Or maybe I didn't get it.

I do not talk about a complete retore of a failed DC and the necessity to reinstall the whole OS ... "just" an AD restore of let's say last weeks backup. So to revert a scheme update or whatever. Can I mark the restore-operation from backup exec as authorative in any way so that the changes will also be reverted on the other DCs?

pkh
Moderator
Moderator
   VIP    Certified

No.  There is no simple way to do an AD authoritative restore.

To do an authoritative restore of AD, you must follow the authoritative AD restore steps given in the first document referenced earlier.  In fact, it would be like recovering the server. Unless you are absolutely sure that the contents of the C: drive is exactly in sync with the registry, then you need to restore the contents of the C: drive to what it was a week ago before restoring the system state from a week ago.

The moral of the story is that you hope that you never have to restore AD.  Have a couple of DC's so that the failure of a DC will not crash the entire AD.  Use the BE AD agent if you have a need to restore deleted AD objects which is probably the only reason why you need to revert your AD to a week ago. Also remember that by reverting to the AD state one week ago means that all the changes since then would be lost, e,g any user who changed their password during this period would revert to their old password.  You can imagine the chaos that would ensue.

soulseeker
Level 4

Thanks again and sorry for my late reply. My reason for thinking about this was not the ability to restore missing AD-objects, but maybe reverting a scheme change. I had to update my scheme for an update of the lync-server. If this lync-update will be unsuccessfull, I must revert the scheme ... so this would only be possible with an authorative restore of the whole "main"-DC that holds all the roles. What a nightmare.

I really hoped that I could only restore the system state of this DC and wait for replication to the other DCs that are only global catalogs.

CraigV
Moderator
Moderator
Partner    VIP    Accredited

Yeah unfortunately this is MS-related, and not Backup Exec at all. BE is simply the means to get your restore done and plays no part in what happens from an infrastructure-recovery point of view.

Thanks!