Completely restoring two domains in the same forest

Hello Massimo,

See this one and read about why different hardware is a problem:
http://support.microsoft.com/kb/249694

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> No help here? :-(
>
> Massimo
>
> "Massimo" <barone@mclink.it> ha scritto nel messaggio
> news:OsBKZxIXJHA.1184@TK2MSFTNGP05.phx.gbl...
>
>>> I have an Active Directory forest (2003 functional level) composed
>>> of a root domain and a child domain; each domain has two domain
>>> controllers, and all the DCs are global catalogs.
>>>
>>> I need to completely re-create this forest in a test lab, and I'm
>>> planning on using backups and restores to do this; I have full
>>> system state backups of every domain controller.
>>>
>>> What is the restore process I should follow?
>>>
>> Today I tried restoring the system state of the first domain
>> controller of the root domain on one of the test lab's servers. It
>> didn't work.
>>
>> Problem: the system state brings with it all the original system's
>> hardware settings, so looks like it just doesn't like being restored
>> on different hardware. I got a BSOD complaining about
>> INACCESSIBLE_BOOT_DEVICE, most likely because the SCSI controller is
>> definitely different between the two systems (HP Smart Array on the
>> original one, VMWare SCSI (disguised as LSI Logic U320) on the
>> destination one). It doesn't look like a HAL problem, as the two
>> systems have exactly the same HAL ("ACPI Multiprocessor PC").
>>
>> As suggested here (http://support.microsoft.com/kb/263532/en-us), I
>> launched a repair install from a Windows 2003 R2 CD-ROM (the same
>> version used on both the original and destination systems), but it
>> didn't work also: after the text-mode setup, I got the same BSOD
>> again.
>>
>> The Question: I have a full system state backup of a Windows 2003 R2
>> domain controller and I don't have its AD domain available (because
>> this is a test lab or a real disaster recovery scenario), how can I
>> restore full DC functionality to a server with the same OS but
>> different hardware?
>>
>> I can't do more tests until Monday, but I have a couple ideas to try:
>>
>> - Run DCPROMO /ADV to restore only the AD database instead of the
>> full
>> system state. But will this work if the original domain isn't
>> available? I
>> think not, but please confirm.
>> - Use DSRM to do the same as above; but will this mode be available
>> if the
>> server isn't a domain controller yet?
>> - Force the system to use the right SCSI controller driver. I tried,
>> but
>> it looks like the actual system state restore is delayed until
>> reboot:
>> after restoring and before rebooting, the system still has all the
>> device
>> drivers it had before, so the restored hardware database clearly
>> isn't in
>> place yet; this makes me unable to modify it with proper device
>> drivers.
>> - I can mount the restored system's boot disk on another VM and
>> access it
>> for file/Registry modifications, if needed; I tried this also, but
>> the
>> WINDOWS\system32\config directory is full of $RestoredActiveFileXX
>> things,
>> which I think make up the restored system state, copied on disk but
>> still
>> not "active" (see above). I don't know what to do here, or if I can
>> do
>> anything at all.
>> If you can help, please do :-)
>>
>> Massimo
>>

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel messaggio
news:ff16fb66108a58cb2c2ab5eaca2d@msnews.microsoft.com...

> Hello Massimo,
>
> See this one and read about why different hardware is a problem:
> http://support.microsoft.com/kb/249694

Hello Meinolf,

I know different hardware is a problem when restoring the system state; my
main question was: is there any way I can rebuild a domain controller
without restoring the full system state? Will DSRM and/or DCPROMO help me
here?

I also already tried repairing the Windows installation from the install
media; after the text-mode part of the setup, it crashed again with the same
blue screen.


Massimo

Hello Massimo,

No, you can't restore without at least the system state. Make sure you have
more then one DC/GC and that replication works correct. So you have allways
the AD database available, FSMO roles you can seize if needed.

For a test domain i would add an additional DC/DNS/GC, let it replicate,
disconnect it from the domain and NEVER connect it back, seize the FSMO roles
and you have a full running copy from the production. Any new policy/change
make also on the test domain.

Also see here:
http://blogs.dirteam.com/blogs/jorge...11/19/105.aspx

http://blogs.dirteam.com/blogs/jorge...11/19/107.aspx

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel
> messaggio news:ff16fb66108a58cb2c2ab5eaca2d@msnews.microsoft.com...
>
>> Hello Massimo,
>>
>> See this one and read about why different hardware is a problem:
>> http://support.microsoft.com/kb/249694
>>
> Hello Meinolf,
>
> I know different hardware is a problem when restoring the system
> state; my main question was: is there any way I can rebuild a domain
> controller without restoring the full system state? Will DSRM and/or
> DCPROMO help me here?
>
> I also already tried repairing the Windows installation from the
> install media; after the text-mode part of the setup, it crashed again
> with the same blue screen.
>
> Massimo
>

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel messaggio
news:ff16fb66108be8cb2c36d30d2bad@msnews.microsoft.com...

> No, you can't restore without at least the system state. Make sure you
> have more then one DC/GC and that replication works correct. So you have
> allways the AD database available, FSMO roles you can seize if needed.

I'm testing a disaster recovery scenario here, so all I have are full
backups (including of course the system state) of the production DCs; so, if
I'm correctly understanding this issue, those backups are totally useless if
I don't have identical hardware to restore them on?

> For a test domain i would add an additional DC/DNS/GC, let it replicate,
> disconnect it from the domain and NEVER connect it back, seize the
> FSMO roles and you have a full running copy from the production.

Yes, I know I can do that; I also could use VMWare Converter to create
virtual clones of my DCs.
But I'm really interested in the disaster recovery scenario, here.


Massimo

Hello Massimo,

As stated in the article:
You can restore a system state backup from one physical computer to the same
physical computer or another computer that has the same make, model, and
configuration (identical hardware).

Microsoft does not support restoring a system state backup from one computer
to a second computer of a different make, model, or hardware configuration.
Microsoft will only provide commercially reasonable efforts to support this
process. Even if the source and destination computers appear to be identical
makes and models, there may be driver, hardware, or firmware differences
between the source and destination computers.

So it is not supported, but can work. Personally i made the same experience
like Philipp, always a blue screen.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel
> messaggio news:ff16fb66108be8cb2c36d30d2bad@msnews.microsoft.com...
>
>> No, you can't restore without at least the system state. Make sure
>> you have more then one DC/GC and that replication works correct. So
>> you have allways the AD database available, FSMO roles you can seize
>> if needed.
>>
> I'm testing a disaster recovery scenario here, so all I have are full
> backups (including of course the system state) of the production DCs;
> so, if I'm correctly understanding this issue, those backups are
> totally useless if I don't have identical hardware to restore them on?
>
>> For a test domain i would add an additional DC/DNS/GC, let it
>> replicate,
>> disconnect it from the domain and NEVER connect it back, seize the
>> FSMO roles and you have a full running copy from the production.
> Yes, I know I can do that; I also could use VMWare Converter to create
> virtual clones of my DCs.
> But I'm really interested in the disaster recovery scenario, here.
> Massimo
>

"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel messaggio
news:ff16fb66108c78cb2c3a0692afbd@msnews.microsoft.com...

> So it is not supported, but can work. Personally i made the same
> experience like Philipp, always a blue screen.

That's ok.

But I really wish Microsoft would provide means of restoring Active
Directory that were not so dependent on the server's hardware. After all, AD
is "only" a database, and doesn't have any real dependency on physical
devices... if it could be backed up and restored without the need to include
it in a full system state backup, that would be a lot better.


Massimo

"Massimo" wrote:

> But I find quite puzzling to not be able to restore a domain controller from
> backup if I don't have identical hardware at hand...

This right here is why Acronis can sell True Image with Universal Restore
for a thousand bucks per server.

On Dec 15, 10:30*am, m...@pioneerprogramming.com
<mctpioneerprogramming...@discussions.microsoft.com> wrote:
> "Massimo" wrote:
> > But I find quite puzzling to not be able to restore a domain controllerfrom
> > backup if I don't have identical hardware at hand...
>
> This right here is why Acronis can sell True Image with Universal Restore
> for a thousand bucks per server.

when i used to do this, best way i found is the following. take your
test DC and before you run DCPROMO connect it to your production
network. turn it into a DC and then put it on your separate test
network.

take any non-dc server and rename it to the name of your test server
you just made a DC. promote it to a DC, reboot, wait 20 minutes and
demote.

on your test network you'll also need an extra server. rename it to
every DC in your list, promote, reboot and demote until you are down
to the 1 DC you need in testing.

this worked for me on a smallish forest of 10DC's. also mentioned this
to PSS one time about the right way to get rid of ghost entries in AD
for DC's that no longer exist and i think they liked it to officially
publish it.

"Massimo" <barone@mclink.it> wrote in message
news:uZVWeJOXJHA.4632@TK2MSFTNGP04.phx.gbl...
> "Phillip Windell" <philwindell@hotmail.com> ha scritto nel messaggio
> news:ut8ZTiJXJHA.4384@TK2MSFTNGP03.phx.gbl...

> But I find quite puzzling to not be able to restore a domain controller
> from backup if I don't have identical hardware at hand...

To me it would be puzzling if it worked. I would never expect it to work.
After the time I tried it and realized what was happening I would have never
expected it to be any other way.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

"Massimo" <barone@mclink.it> wrote in message
news:OQ3NSkhXJHA.1532@TK2MSFTNGP03.phx.gbl...
> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel messaggio
> news:ff16fb66108be8cb2c36d30d2bad@msnews.microsoft.com...

> I'm testing a disaster recovery scenario here, so all I have are full
> backups (including of course the system state) of the production DCs; so,
> if I'm correctly understanding this issue, those backups are totally
> useless if I don't have identical hardware to restore them on?

Yes. Completely useless.

That is why you want more than one DC,...one fails you load up the OS on new
hardware, join the domain, and run DCPromo to make it a new DC where it
replicated from the remaining DC.

The backups are worthless unless you are restoring to the same or identical
hardware.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

"Massimo" <barone@mclink.it> wrote in message
news:O0On3BiXJHA.5108@TK2MSFTNGP05.phx.gbl...
> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> ha scritto nel messaggio
> news:ff16fb66108c78cb2c3a0692afbd@msnews.microsoft.com...
I really wish Microsoft would provide means of restoring Active
> Directory that were not so dependent on the server's hardware. After all,
> AD is "only" a database, and doesn't have any real dependency on physical
> devices... if it could be backed up and restored without the need to
> include it in a full system state backup, that would be a lot better.

They do. That is what having a least two DCs is all about. The second DC
*is* your Active Directory backup.

Yes,..I can hear all the objections already,...thought of some myself,..like
how about if the building burned down and I loose all DC and can not buy
identical hardware? I'm not saying it is a perfect world,..I'm just saying
that is the way the world is.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

"Phillip Windell" <philwindell@hotmail.com> ha scritto nel messaggio
news:%23IiI7t4XJHA.1324@TK2MSFTNGP04.phx.gbl...

>> But I find quite puzzling to not be able to restore a domain controller
>> from backup if I don't have identical hardware at hand...
>
> To me it would be puzzling if it worked. I would never expect it to work.
> After the time I tried it and realized what was happening I would have
> never expected it to be any other way.

Let me restate this :-)

I know, too, that restoring a system state backup can't work on different
hardware; what I find puzzling is the only way to back up and restore AD
being including it in a full system state backup.

I of course don't know the inner secrets of how a DC works, but I don't
think it could be *so* difficult to decouple the AD database from the
physical details of the server it's hosted on.


Massimo

I agree.
I guess they have their reasons...


--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------


"Massimo" <barone@mclink.it> wrote in message
news:OrXOen7XJHA.1188@TK2MSFTNGP05.phx.gbl...
> "Phillip Windell" <philwindell@hotmail.com> ha scritto nel messaggio
> news:%23IiI7t4XJHA.1324@TK2MSFTNGP04.phx.gbl...
>
>>> But I find quite puzzling to not be able to restore a domain controller
>>> from backup if I don't have identical hardware at hand...
>>
>> To me it would be puzzling if it worked. I would never expect it to
>> work. After the time I tried it and realized what was happening I would
>> have
>> never expected it to be any other way.
>
> Let me restate this :-)
>
> I know, too, that restoring a system state backup can't work on different
> hardware; what I find puzzling is the only way to back up and restore AD
> being including it in a full system state backup.
>
> I of course don't know the inner secrets of how a DC works, but I don't
> think it could be *so* difficult to decouple the AD database from the
> physical details of the server it's hosted on.
>
>
> Massimo
>