Programming4us
         
 
 
Applications Server

Active Directory 2008 : Proactive Directory Maintenance and Data Store Protection (part 4) - Performing Proactive Restores

9/15/2011 5:00:25 PM

5. Performing Proactive Restores

Backup data sets are only as good as the restores and recoveries they support. This is why it is essential for you to test the restoration procedure and to test as many scenarios as possible to ensure that when you do face a disaster, you can recover the data or systems you lost by relying on your backups.

When working with a DC, there are several restoration scenarios:

  • Restoring nonauthoritative data to the directory to reduce the replication required to update a DC that has been off for some time

  • Restoring authoritative data because the data in the directory has been destroyed

  • Restoring a complete DC from a backup

When you need to restore data to a system, you cannot do so when the DC is running, despite the fact that in Windows Server 2008 R2 you can control the AD DS service as you would other services. In fact, you must restart the server and run WinRE, or you must restart the server in Directory Services Restore Mode (DSRM). Each method supports different restoration procedures. DSRM supports data restores to the directory; WinRE supports recovery of the entire system.

5.1. Restarting in DSRM

There are two ways to launch a server into DSRM. The first relies on a server reboot and, during the reboot process, pressing F8 to view startup options. Note that if you are running the DC in a virtual machine on Hyper-V, you must press the F5 key while the machine is starting to access the Windows Boot Manager screen first, then press F8 to access Advanced Boot Options. This allows you to choose the Directory Services Restore Mode. Remember that you need to have access to the DSRM password to use this mode.



You can also force the reboot directly into DSRM by changing the boot order in the boot file of the OS. This is done with the Bcdedit.exe command. To use the command line to change the boot order, type the following command in an elevated command prompt:

bcdedit /set safeboot dsrepair

Then, when you need to restart the server normally, use the following command:

bcdedit /deletevalue safeboot

If you need to perform the operation only once, it might be best simply to rely on the F8 key at system startup.


Warning:

IMPORTANT RESETTING THE DSRM PASSWORD

To reset the DSRM password—an activity you should perform on a regular basis—you must first boot into DSRM and then use the standard password changing methods.



Note:

MORE INFO RUNNING DCS AS VMS

For more information on working with DCs as VMs, go to http://technet.microsoft.com/pt-pt/library/dd363545%28WS.10%29.aspx.


5.2. Identifying the Appropriate Backup Data Set

One of the challenges faced by organizations who used AD DS in previous versions of Windows was the ability to identify properly whether the data they required was located in a particular backup data set. In Windows Server 2008 R2, you can rely on the AD DS database mounting tool to view the contents of a data set before you perform a recovery operation. This prevents the previous hit-or-miss approach that system administrators needed to rely on.

The mounting tool works with database snapshots. Snapshots can easily be created with the Ntdsutil.exe tool. For example, to generate regular snapshots of a directory, you would use the following command:

ntdsutil "activate instance NTDS" snapshot create quit quit

This generates a snapshot on the same volume as the database. Be careful how you use this command, because it will quickly fill up the disk on which the Ntds.dit database file is located.

Perform the following steps to view backup data set or snapshot contents:

  1. Launch an elevated command prompt by right-clicking Command Prompt in the Start menu and choosing Run As Administrator.

  2. Begin by listing the available snapshots. Snapshots are created each time a backup is run or through the Ntdsutil.exe create subcommand, but you need to have the snapshot GUID to mount it. Use the following command to pipe all snapshot GUIDs into a text file.

    ntdsutil "activate instance NTDS" snapshot "list all" quit quit >snapshot.txt


  3. Now, look into the text file to locate and copy the GUID you need:

    notepad snapshot.txt

  4. Locate the GUID you need and copy it to the clipboard. The snapshot GUID is always preceded by the date and time you created the snapshot. Remember to include the brackets in the selection. Minimize Notepad in case you need a different GUID.

  5. Mount the snapshot you need to use. Remember to right-click and then click Paste to paste the GUID at the mount command.

    ntdsutil
    activate instance NTDS
    snapshot
    mount guid
    quit
    quit

    Note the path listed for the mounted database.

  6. Use the AD DS database mounting tool to load the snapshot as an LDAP server.

    dsamain -dbpath c:\$SNAP_datetime_VOLUMEC$\windows\ntds\ntds.dit
    -ldapport portnumber

    Be sure to use ALL CAPS for the -dbpath value and use any number beyond 40,000 for the -ldapport value to ensure that you do not conflict with AD DS. Also note that you can use the minus (–) sign or the slash (/) for the options in the command. The database is mounted and will stay mounted until you have completed your operations. Do not close the command prompt. In fact, you might want to use two command prompts, one for mounting the snapshot in Ntdsutil.exe and one for the Dsamain.exe command. Then you can mount and unmount different snapshots until you locate the one that contains the information you need to recover.

    Note that if the dsamain command gives you errors, you must restart the server to clear reserved TCP ports. After the server is restarted, the operation should work properly.



  7. Now use Ldp.exe or Active Directory Users And Computers to access the instance. For example, launch Active Directory Users And Computers from the Administrative Tools program group.

  8. Right-click Active Directory Users And Computers and click Change Domain Controller.

  9. In the Change Directory Server dialog box, click <Type A Directory Server Name[:Port] Here>, type the servername:portnumber, such as Server10:40000, and press Enter. (Use the port number you specified in step 6.) The status column should indicate that the server is online. Click OK.



  10. Search the loaded instance to locate the information you need and view its properties. If it is the instance you need, make note of its name. Close Active Directory Users And Computers.

  11. Return to the dsamain command prompt and press Ctrl+C to stop Dsamain.exe.

  12. Unmount the database snapshot. Use the following command. Remember to paste in the GUID from the clipboard.

    ntdsutil
    activate instance NTDS
    snapshot
    unmount guid
    quit
    quit

  13. Close the command prompt.

If the selected database snapshot was not the one you were looking for, repeat the procedure. If it was, proceed to a restore.


Warning:

IMPORTANT USING ARROW KEYS IN COMMAND PROMPTS

You can use the up and down arrow keys when you are in a command prompt to return to previous commands. Also, note that there are different buffers in the command prompt. For example, there is a buffer in the command prompt itself and a different buffer in the Ntdsutil.exe command. You can use both to return to previous commands and save typing.


5.3. Performing Nonauthoritative or Authoritative Restores

As mentioned earlier, performing a restore requires that you restart the directory in DSRM. This means shutting down the DC. Remember that you can perform either nonauthoritative or authoritative restores on both the full installation and Server Core. A nonauthoritative restore addresses a DC rebuild when no data was lost because it is still found on other DCs. An authoritative restore restores data that was lost and updates the Update Sequence Number (USN) for the data to make it authoritative and ensure that it is replicated to all other servers. You can use the same procedure for both types of restores, but you can also perform authoritative restores without using DSRM. Make sure you have connected the removable media on which you stored the backup that you want to restore.

  1. Repair the server, if required, and start it. During startup, press F8 to view the startup modes. Remember that if you are using a virtual machine, you must press F5 before you can press F8.

  2. Select Directory Services Restore Mode and press Enter.

  3. This will boot into Windows. Press Ctrl+Alt+Delete, and then log on with the DSRM account using the servername\accountname format and password. You will need to switch users to log on because the last logged on user account will be displayed by default. Use the DSRM password you set when you created the DC.

    You can restore the data either through the command line or with Windows Server Backup. Note, however, that when you want to restore directory data, you must perform a System State restore and, to do so, you must use the command line.

  4. Launch an elevated command prompt by right-clicking Command Prompt on the Start menu and choosing Run As Administrator.

  5. Type the following command:

    wbadmin get versions -backuptarget:drive -machine:servername

    For example, to list the available backups located on D drive on SERVER10, type:

    wbadmin get versions -backuptarget:d: -machine:server10

    Note the version identifier information, because you need the exact name for the next command.

  6. To recover system state information, type the following command:

    wbadmin start systemstaterecovery -version:datetime -backuptarget:drive
    -machine:servername -quiet

    For example, to recover the system state from a backup dated February 15, 2008, from D drive on SERVER10, type:

    wbadmin start systemstaterecovery -version:02/15/2008-19:38
    -backuptarget:d: -machine:server10 -quiet

    You use the -quiet option to avoid having to confirm the backup operation. Note that the restore takes time to complete.



  7. When prompted, press Y to restart the DC in its normal operating mode. When you restart the server, AD DS knows that it has recovered from a restore and performs an integrity check of the database as it starts.

If you are performing a nonauthoritative restore, you are finished. AD DS replication will bring this server up to date when the restart is complete.


Note:

IMPORTANT USING DFS REPLICATION

If your forest is in Windows Server 2008 R2 functional level, you will be using DFS replication. In this case, the restore creates a nonauthoritative version of the SYSVOL share. If you want to avoid additional replication, add the authsysvol switch to the Wbadmin.exe command.


If you are performing an authoritative restore, you must mark the restored data as authoritative. The best approach is to perform this restore with an online DC. Use the following steps:

  1. With the server restarted in normal mode, log on with domain administrator credentials. Launch Server Manager, expand the Configuration node, and click Services. Locate the Active Directory Domain Services service, select it, and then click Stop in the details pane. Click Yes when prompted to stop dependent services.

  2. Launch Command Prompt as an administrator and type the following commands:

    ntdsutil
    activate instance NTDS
    authoritative restore
    restore object database
    quit
    quit

    The restore object database subcommand marks all the data in the Ntds.dit database of this DC as authoritative. When you use this command, you are prompted to confirm the restore. Click Yes to do so.

    If you want to restore only a portion of the directory, use the restore subtree subcommand in Ntdsutil.exe, as follows:

    restore subtree ou=ouname,dc=dcname,dc=dcname

    where you must supply the distinguished name of the OU or object that you want to restore.

  3. Close the command prompt and restart the AD DS service.

After the service is restarted, the replication process starts and the restored information that has been marked as authoritative is replicated to all other DCs. AD DS replication brings the server up to date when the service is restarted by replicating data from this DC to others because the restore was authoritative.




Tip:

TIP

Performing an authoritative or nonauthoritative Active Directory restore, working with the restartable AD DS service, and working in Directory Services Recovery Mode are important parts of this topic on the exam.


5.4. Restoring from a Complete Backup

When the DC is completely down and needs to be rebuilt, but you have access to a full server backup, you can perform a complete system restore. You need access to the full server backup files. If they are on a removable drive, make sure this drive is connected to the server before you begin the restore; otherwise, you must restart the server. If the files are on a network drive, make note of the path. Also, obtain the Windows Installation Media DVD or, if your new DC is a virtual machine, link its DVD drive to an ISO file containing the Windows Installation Media.

Full server recoveries can be performed through the graphical interface or the command line.

5.4.1. Performing a Graphical Full Server Recovery
Performing a Graphical Full Server Recovery

To perform a full server recovery with the graphical interface, use the following procedure. This procedure applies to both the full installation and Server Core.

  1. Insert or connect the Windows Server 2008 R2 installation DVD, restart the computer, and, when prompted, press a key to start from the DVD.

  2. On the initial Windows screen, accept or select the language to install, the time and currency format, and a keyboard layout, and then click Next.

  3. In the Install Now window, click the Repair Your Computer link.

  4. In the System Recovery Options dialog box, click anywhere to clear any operating systems that are selected for repair and click Next.

  5. Under Choose A Recovery Tool, click System Image Recovery.

  6. If the backup is stored on a remote server, click Cancel on the warning message.

  7. Choose Select A System Image and click Next.

  8. In the Select The Location Of The Backup page, perform the following steps, depending on whether the backup is stored locally or on a network share:

    1. If the backup is stored on the local computer, select the location of the backup and click Next. Proceed to step 9.

    2. If the backup is stored on a network share, click Advanced, and then click Search For A System Image On The Network. Click Yes to confirm.

    3. In the Network Folder, type the path for the network share and click OK.

    4. Type the appropriate credentials and click OK.

    5. In the Select The Location Of The Backup page, select the backup image and click Next.

  9. Select the date and time of the image to restore and click Next.

  10. If you want to replace all data on all volumes, on the Choose Additional Restore Options page, select Format And Repartition Disks.

  11. To prevent volumes that are not included in the restore from being deleted and re-created, click Exclude Disks, select each disk you want to exclude, and then click OK.

  12. Click Next, and then click Finish. Click Yes to confirm that all selected disks will be reformatted and replaced with the data in the image backup.

    When the restore is complete, the server should restart as a new image of the server you restored in the backup set you used.

Performing a Command-Line Full Server Recovery

To perform a full server recovery with the command line, use the following procedure. This procedure applies to both the full installation and Server Core.

  1. Insert or connect the Windows Server 2008 R2 installation DVD, restart the DC, and, when prompted, press a key to start from the DVD.

  2. On the initial Windows screen, accept or select the language to install, the time and currency format, and a keyboard layout, and then click Next.

  3. In the Install Now window, click the Repair Your Computer link.

  4. In the System Recovery Options dialog box, click anywhere to clear any operating systems that are selected for repair and click Next.

  5. Under Choose A Recovery Tool, select Command Prompt.

  6. At the command prompt, type diskpart and press Enter.

  7. At the diskpart prompt, type list vol and press Enter.

    Identify from the list the drive letter for the volume that corresponds to the location of the full server backup you want to restore. The drive letters in WinRE do not necessarily match the volumes as they appeared in Windows Server 2008 R2.

  8. Type exit and press Enter.

  9. At the Sources prompt, type the following command and press Enter:

    wbadmin get versions -backuptarget:drive -machine:servername

    For example, to list the available backups located on the D drive on SERVER10, type:

    wbadmin get versions -backuptarget:D: -machine:SERVER10

    Note the version identifier information, because you need the exact name for the next command.

  10. At the command prompt, type the following command and press Enter:

    wbadmin start sysrecovery -version:datetime -backuptarget:drive
    -machine:servername -quiet

    For example, to recover the system state from a backup dated February 15, 2009, from D drive on SERVER10, type:

    wbadmin start sysrecovery -version:02/15/2009-19:38 -backuptarget:d:
    -machine:server10 -quiet

    You use the -quiet option to avoid having to confirm the backup operation.

  11. After the recovery operation has completed, minimize the command window and, in the System Recovery Options dialog box, click Restart.

    The server should restart and operate normally.

Other -----------------
- BizTalk 2009 : The BizTalk Management Database
- BizTalk 2009 : Handling Failed Messages and Errors
- Microsoft Dynamics GP 2010 : Dynamics GP Utilities (part 3) - Additional steps
- Microsoft Dynamics GP 2010 : Dynamics GP Utilities (part 2) - Loading sample company data & Creating a new Dynamics GP company
- Microsoft Dynamics GP 2010 : Dynamics GP Utilities (part 1) - Completing the Dynamics GP installation
- Microsoft Dynamics GP 2010 : Creating an ODBC data source
- Microsoft Dynamics AX 2009 : Working with Forms - Storing last form values
- Microsoft Dynamics AX 2009 : Creating modal forms & Changing common form appearance
- Exchange Server 2010 : Performing Tracking and Logging Activities in an Organization (part 2) - Using Protocol Logging & Using Connectivity Logging
- Exchange Server 2010 : Performing Tracking and Logging Activities in an Organization (part 1) - Using Message Tracking
- Exchange Server 2010 Maintenance, Monitoring, and Queuing : Understanding Troubleshooting Basics
- Extending Microsoft Dynamics CRM 4.0 : Examples
- Extending Microsoft Dynamics CRM 4.0 : IFrames
- BizTalk 2009 : Using XML Namespaces (part 3) - Using System Property Schemas
- BizTalk 2009 : Using XML Namespaces (part 2) - Using Port Filters and Content-Based Routing
- BizTalk 2009 : Using XML Namespaces (part 1) - Understanding Property Promotions
- BizTalk 2009 : Understanding the Message Bus
- Active Directory Domain Services 2008 : Determine Global Catalog Servers
- BizTalk Server 2006 Operations : Disaster Recovery
- Configuring and Using Active Directory Rights Management Services
 
 
Most View
- Exchange Server 2010 : Designing and Implementing Message Classifications (part 2)
- Windows 7 : Checking Free Disk Space
- Cloud Security and Privacy : Analyst Predictions
- Developing for Windows Phone and Xbox Live : GameComponents
- Windows 7 Customization : Understanding File Types
- Windows7: Managing Network Connections (part 1)
- Exchange Server 2007 : Configuring Cluster Services with Server 2003
- Windows Server 2008 : Grasp the Structure of Group Policy
- Developing for Windows Phone and Xbox Live : Graphics Pipeline
- Windows 7 : Customizing Startups with the Advanced Options Menu
Top 10
- Implementing Edge Services for an Exchange Server 2007 Environment : Utilizing the Basic Sender and Recipient Connection Filters (part 3) - Configuring Recipient Filtering
- Implementing Edge Services for an Exchange Server 2007 Environment : Utilizing the Basic Sender and Recipient Connection Filters (part 2)
- Implementing Edge Services for an Exchange Server 2007 Environment : Utilizing the Basic Sender and Recipient Connection Filters (part 1)
- Implementing Edge Services for an Exchange Server 2007 Environment : Installing and Configuring the Edge Transport Server Components
- What's New in SharePoint 2013 (part 7) - BCS
- What's New in SharePoint 2013 (part 6) - SEARCH
- What's New in SharePoint 2013 (part 6) - WEB CONTENT MANAGEMENT
- What's New in SharePoint 2013 (part 5) - ENTERPRISE CONTENT MANAGEMENT
- What's New in SharePoint 2013 (part 4) - WORKFLOWS
- What's New in SharePoint 2013 (part 3) - REMOTE EVENTS