Skip to main content

How to restore a virtual Domain Controller with Cyber Backup 12.5 on another ESXi server?

Thread needs solution

I am currently trying to verify backup / restore in an ESXi environment with Windows Server 2016 operating system VMs. 

I created an agentless backup of the virtual machines including the domain controller, for the domain controller I activated application backup for Microsoft active directory. No errors happened during backup.

To verify the restore procedure I restored all the machines to new VMs on another ESXi server. In theory the restored VMs should be identical to the old ones. But obviously the domain controller is not, it does not allow login any more. Consulting the documentation it seems the restored domain controller assumes it was cloned and thus prevents startup of active directory. The other machines do come up and allow login but do not have DNS or AD. 

How can I restore the whole system including the domain controller in case my ESXi server hardware is lost and I have to restore on another ESXi server? 

Update: The answer to this is to shut down the Domain Controller before backing it up. There seems to be no way to get a consistent hot backup from a DC. With a hot backup the DC will go into Directory Services Restore Mode after restoration to a different VM. I assume even a restore to the same VM will have the same issue. 

So despite application backup for Microsoft active directory do not use hot backups from the domain controller. 

 

If you have any other experience, please let me know.

1 Users found this helpful

Hello Nick!

I haven't tested this, but reading the docs it looks like it's not that the hot backup is inconsistent, rather you just can't restore a DC while you still have the original up. Apparently you would run into the same issue if you had multiple DCs and only tried restoring one of them.

I guess you are testing disaster recovery. Have you isolated the new environment from the old? Maybe this link is of help?

-- Peter

Hello Peter,

thank you for you input. 

Yes, I am testing disaster recovery, on the assumption that we lost the system completely on all sites and have to recover it on new hardware from backup. 

The new environment is isolated from the old environment. The restored domain controller is the primary domain controller with all the FSMO roles. So no role has to be seized from another domain controller. 

The article you linked nicely summarizes the issues you have to take into account during a disaster recovery test. Unfortunately it does not expand on the on the pit falls of replication and cloning of virtual domain controllers with Windows Server 2016 and higher. Well it might be different in Azure than in an ESXi environment. 

Best Regards,

Nick

 

frestogaslorastaswastavewroviwroclolacorashibushurutraciwrubrishabenichikucrijorejenufrilomuwrigaslowrikejawrachosleratiswurelaseriprouobrunoviswosuthitribrepakotritopislivadrauibretisetewrapenuwrapi
Posts: 0
Comments: 2016

Hello Nick,

Welcome to Acronis forums!

This issue should be considered in detail: how the backup has been taken and how the restore has been performed. According to your description, it should work. Thus, I recommend that you open a case with Acronis Support Team so that the engineers could collect and analyze the restoration logs.