AD restore on different hardware [Was: Re: Completely restoring two domains in the same forest]

"Massimo" <> ha scritto nel messaggio
news:exwL%...

> I have an Active Directory forest (2003 functional level) composed of a
> root domain and a child domain; each domain has two domain controllers,
> and all the DCs are global catalogs.
>
> I need to completely re-create this forest in a test lab, and I'm planning
> on using backups and restores to do this; I have full system state backups
> of every domain controller.
>
> What is the restore process I should follow?

Today I tried restoring the system state of the first domain controller of
the root domain on one of the test lab's servers. It didn't work.

Problem: the system state brings with it all the original system's hardware
settings, so looks like it just doesn't like being restored on different
hardware. I got a BSOD complaining about INACCESSIBLE_BOOT_DEVICE, most
likely because the SCSI controller is definitely different between the two
systems (HP Smart Array on the original one, VMWare SCSI (disguised as LSI
Logic U320) on the destination one). It doesn't look like a HAL problem, as
the two systems have exactly the same HAL ("ACPI Multiprocessor PC").

As suggested here (http://support.microsoft.com/kb/263532/en-us), I launched
a repair install from a Windows 2003 R2 CD-ROM (the same version used on
both the original and destination systems), but it didn't work also: after
the text-mode setup, I got the same BSOD again.

The Question: I have a full system state backup of a Windows 2003 R2 domain
controller and I don't have its AD domain available (because this is a test
lab or a real disaster recovery scenario), how can I restore full DC
functionality to a server with the same OS but different hardware?

I can't do more tests until Monday, but I have a couple ideas to try:

- Run DCPROMO /ADV to restore only the AD database instead of the full
system state. But will this work if the original domain isn't available? I
think not, but please confirm.
- Use DSRM to do the same as above; but will this mode be available if the
server isn't a domain controller yet?
- Force the system to use the right SCSI controller driver. I tried, but it
looks like the actual system state restore is delayed until reboot: after
restoring and before rebooting, the system still has all the device drivers
it had before, so the restored hardware database clearly isn't in place yet;
this makes me unable to modify it with proper device drivers.
- I can mount the restored system's boot disk on another VM and access it
for file/Registry modifications, if needed; I tried this also, but the
WINDOWS\system32\config directory is full of $RestoredActiveFileXX things,
which I think make up the restored system state, copied on disk but still
not "active" (see above). I don't know what to do here, or if I can do
anything at all.


If you can help, please do :-)


Massimo

I tried this once too.
Was never successful

But I thought about this although I didn't try it.

Create a new Server VM that can actually see the LAN and be fully functional
on it

Join it to the real domain

DC Promo it to a Domain Controller

When finished, give it time to fully replicate then shut down the VM.

Make a copy of the VM "hard drive file" and put it somewhere safe

Start up the VM and run DCPromo on the it to demote it down to a member
server, wait till replication stabilizes.
Move the VM from a Member Server to a Workgroup. Basically this is the same
thing as gracefully removing a DC from the domain. You can delete the VM at
this point.

Use the saved copy of the VM "hardrive" to create a new VM. Do **not* let
it see the LAN when it starts up. Have it seize all the FSMO Roles and go
through all the normal "cleanup" steps you would go through if a DC is
non-gracefully removed from a Domain. When finished you should have a
domain with a single DC holding all the Roles. But this is for a single
Forest/Domain only.

Your problem is going to be with having Child domains. You will have to do
a VM for each child Domain and the Root Domain at the *same time* so the VMs
won't be out of sync with each other. Make the backup copies and create new
VMs for each and start them up *together*,..but yet isolated from the *real*
LAN. Then do all the cleanup processes.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

If there is an Exchange Server then you will have to wait untill the VM DCs
are all working correctly and "cleaned up". Then create a new Server VM
clean from scratch and then install Exchange on it and go throught the steps
you would go through if you had lost your real Exchange Server with out a
Full Backup.

I believe once Exchange is install the way it is suppposed to be you can use
actual "real" Backups of your Exchange Data Stores to "restore" them to the
new VM Exchange. It think because the VM Active Directory would have all
the Exchange material left over in it from the AD you mirrored it from the
Exchange installation should pick all that up as it is installed.
But,...like I said,..I haven't tried this,...it is just theory for me.


--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

"Phillip Windell" <> ha scritto nel messaggio
news:...

> I tried this once too.
> Was never successful

:-(

> But I thought about this although I didn't try it.

It's a good strategy, and it's the one we'll probably use if restores don't
work.

But I find quite puzzling to not be able to restore a domain controller from
backup if I don't have identical hardware at hand...


Massimo

No help here? :-(


Massimo


"Massimo" <> ha scritto nel messaggio
news:...

>> I have an Active Directory forest (2003 functional level) composed of a
>> root domain and a child domain; each domain has two domain controllers,
>> and all the DCs are global catalogs.
>>
>> I need to completely re-create this forest in a test lab, and I'm
>> planning on using backups and restores to do this; I have full system
>> state backups of every domain controller.
>>
>> What is the restore process I should follow?
>
> Today I tried restoring the system state of the first domain controller of
> the root domain on one of the test lab's servers. It didn't work.
>
> Problem: the system state brings with it all the original system's
> hardware settings, so looks like it just doesn't like being restored on
> different hardware. I got a BSOD complaining about
> INACCESSIBLE_BOOT_DEVICE, most likely because the SCSI controller is
> definitely different between the two systems (HP Smart Array on the
> original one, VMWare SCSI (disguised as LSI Logic U320) on the destination
> one). It doesn't look like a HAL problem, as the two systems have exactly
> the same HAL ("ACPI Multiprocessor PC").
>
> As suggested here (http://support.microsoft.com/kb/263532/en-us), I
> launched a repair install from a Windows 2003 R2 CD-ROM (the same version
> used on both the original and destination systems), but it didn't work
> also: after the text-mode setup, I got the same BSOD again.
>
> The Question: I have a full system state backup of a Windows 2003 R2
> domain controller and I don't have its AD domain available (because this
> is a test lab or a real disaster recovery scenario), how can I restore
> full DC functionality to a server with the same OS but different hardware?
>
> I can't do more tests until Monday, but I have a couple ideas to try:
>
> - Run DCPROMO /ADV to restore only the AD database instead of the full
> system state. But will this work if the original domain isn't available? I
> think not, but please confirm.
> - Use DSRM to do the same as above; but will this mode be available if the
> server isn't a domain controller yet?
> - Force the system to use the right SCSI controller driver. I tried, but
> it looks like the actual system state restore is delayed until reboot:
> after restoring and before rebooting, the system still has all the device
> drivers it had before, so the restored hardware database clearly isn't in
> place yet; this makes me unable to modify it with proper device drivers.
> - I can mount the restored system's boot disk on another VM and access it
> for file/Registry modifications, if needed; I tried this also, but the
> WINDOWS\system32\config directory is full of $RestoredActiveFileXX things,
> which I think make up the restored system state, copied on disk but still
> not "active" (see above). I don't know what to do here, or if I can do
> anything at all.
>
>
> If you can help, please do :-)
>
>
> Massimo
>

Hello Massimo,

See this one and read about why different hardware is a problem:
http://support.microsoft.com/kb/249694

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> No help here? :-(
>
> Massimo
>
> "Massimo" <> ha scritto nel messaggio
> news:...
>
>>> I have an Active Directory forest (2003 functional level) composed
>>> of a root domain and a child domain; each domain has two domain
>>> controllers, and all the DCs are global catalogs.
>>>
>>> I need to completely re-create this forest in a test lab, and I'm
>>> planning on using backups and restores to do this; I have full
>>> system state backups of every domain controller.
>>>
>>> What is the restore process I should follow?
>>>
>> Today I tried restoring the system state of the first domain
>> controller of the root domain on one of the test lab's servers. It
>> didn't work.
>>
>> Problem: the system state brings with it all the original system's
>> hardware settings, so looks like it just doesn't like being restored
>> on different hardware. I got a BSOD complaining about
>> INACCESSIBLE_BOOT_DEVICE, most likely because the SCSI controller is
>> definitely different between the two systems (HP Smart Array on the
>> original one, VMWare SCSI (disguised as LSI Logic U320) on the
>> destination one). It doesn't look like a HAL problem, as the two
>> systems have exactly the same HAL ("ACPI Multiprocessor PC").
>>
>> As suggested here (http://support.microsoft.com/kb/263532/en-us), I
>> launched a repair install from a Windows 2003 R2 CD-ROM (the same
>> version used on both the original and destination systems), but it
>> didn't work also: after the text-mode setup, I got the same BSOD
>> again.
>>
>> The Question: I have a full system state backup of a Windows 2003 R2
>> domain controller and I don't have its AD domain available (because
>> this is a test lab or a real disaster recovery scenario), how can I
>> restore full DC functionality to a server with the same OS but
>> different hardware?
>>
>> I can't do more tests until Monday, but I have a couple ideas to try:
>>
>> - Run DCPROMO /ADV to restore only the AD database instead of the
>> full
>> system state. But will this work if the original domain isn't
>> available? I
>> think not, but please confirm.
>> - Use DSRM to do the same as above; but will this mode be available
>> if the
>> server isn't a domain controller yet?
>> - Force the system to use the right SCSI controller driver. I tried,
>> but
>> it looks like the actual system state restore is delayed until
>> reboot:
>> after restoring and before rebooting, the system still has all the
>> device
>> drivers it had before, so the restored hardware database clearly
>> isn't in
>> place yet; this makes me unable to modify it with proper device
>> drivers.
>> - I can mount the restored system's boot disk on another VM and
>> access it
>> for file/Registry modifications, if needed; I tried this also, but
>> the
>> WINDOWS\system32\config directory is full of $RestoredActiveFileXX
>> things,
>> which I think make up the restored system state, copied on disk but
>> still
>> not "active" (see above). I don't know what to do here, or if I can
>> do
>> anything at all.
>> If you can help, please do :-)
>>
>> Massimo
>>

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel messaggio
news: .com...

> Hello Massimo,
>
> See this one and read about why different hardware is a problem:
> http://support.microsoft.com/kb/249694

Hello Meinolf,

I know different hardware is a problem when restoring the system state; my
main question was: is there any way I can rebuild a domain controller
without restoring the full system state? Will DSRM and/or DCPROMO help me
here?

I also already tried repairing the Windows installation from the install
media; after the text-mode part of the setup, it crashed again with the same
blue screen.


Massimo

Hello Massimo,

No, you can't restore without at least the system state. Make sure you have
more then one DC/GC and that replication works correct. So you have allways
the AD database available, FSMO roles you can seize if needed.

For a test domain i would add an additional DC/DNS/GC, let it replicate,
disconnect it from the domain and NEVER connect it back, seize the FSMO roles
and you have a full running copy from the production. Any new policy/change
make also on the test domain.

Also see here:
http://blogs.dirteam.com/blogs/jorge...11/19/105.aspx

http://blogs.dirteam.com/blogs/jorge...11/19/107.aspx

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel
> messaggio news: .com...
>
>> Hello Massimo,
>>
>> See this one and read about why different hardware is a problem:
>> http://support.microsoft.com/kb/249694
>>
> Hello Meinolf,
>
> I know different hardware is a problem when restoring the system
> state; my main question was: is there any way I can rebuild a domain
> controller without restoring the full system state? Will DSRM and/or
> DCPROMO help me here?
>
> I also already tried repairing the Windows installation from the
> install media; after the text-mode part of the setup, it crashed again
> with the same blue screen.
>
> Massimo
>

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel messaggio
news: .com...

> No, you can't restore without at least the system state. Make sure you
> have more then one DC/GC and that replication works correct. So you have
> allways the AD database available, FSMO roles you can seize if needed.

I'm testing a disaster recovery scenario here, so all I have are full
backups (including of course the system state) of the production DCs; so, if
I'm correctly understanding this issue, those backups are totally useless if
I don't have identical hardware to restore them on?

> For a test domain i would add an additional DC/DNS/GC, let it replicate,
> disconnect it from the domain and NEVER connect it back, seize the
> FSMO roles and you have a full running copy from the production.

Yes, I know I can do that; I also could use VMWare Converter to create
virtual clones of my DCs.
But I'm really interested in the disaster recovery scenario, here.


Massimo

Hello Massimo,

As stated in the article:
You can restore a system state backup from one physical computer to the same
physical computer or another computer that has the same make, model, and
configuration (identical hardware).

Microsoft does not support restoring a system state backup from one computer
to a second computer of a different make, model, or hardware configuration.
Microsoft will only provide commercially reasonable efforts to support this
process. Even if the source and destination computers appear to be identical
makes and models, there may be driver, hardware, or firmware differences
between the source and destination computers.

So it is not supported, but can work. Personally i made the same experience
like Philipp, always a blue screen.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel
> messaggio news: .com...
>
>> No, you can't restore without at least the system state. Make sure
>> you have more then one DC/GC and that replication works correct. So
>> you have allways the AD database available, FSMO roles you can seize
>> if needed.
>>
> I'm testing a disaster recovery scenario here, so all I have are full
> backups (including of course the system state) of the production DCs;
> so, if I'm correctly understanding this issue, those backups are
> totally useless if I don't have identical hardware to restore them on?
>
>> For a test domain i would add an additional DC/DNS/GC, let it
>> replicate,
>> disconnect it from the domain and NEVER connect it back, seize the
>> FSMO roles and you have a full running copy from the production.
> Yes, I know I can do that; I also could use VMWare Converter to create
> virtual clones of my DCs.
> But I'm really interested in the disaster recovery scenario, here.
> Massimo
>