Chatta subito con l'assistenza
Chat con il supporto

Recovery Manager for AD Forest Edition 10.2 - User Guide

Overview Getting started
Permissions required to use Recovery Manager for Active Directory Recovery Manager Console Getting and using help Configuring Windows Firewall Using Computer Collections Managing Recovery Manager for Active Directory configuration Licensing
Backing up data
Permissions required for the Backup operation Managing Backup Agent Using a least-privileged user account to back up data Using Managed Service Accounts Active Directory backups vs Windows System State backups Creating BMR and Active Directory backups Using the Backup Wizard Retrying backup creation Enabling backup encryption Backing up AD LDS (ADAM) Backing up cross-domain group membership Backing up distributed file system (DFS) data Backup scheduling Setting performance options Setting advanced backup options Using Forest Recovery Agent Unpacking backups Using e-mail notification Viewing backup creation results
Restoring data
Getting started with Active Directory recovery Managing deleted or recycled objects Restoring backed up Active Directory components Integration with Change Auditor for Active Directory Using granular online restore Restoring AD LDS (ADAM) Selectively restoring Active Directory object attributes Restoring objects in an application directory partition Restoring object quotas Restoring cross-domain group membership Performing a restore without having administrator privileges Reports about objects and operations Using complete offline restore Offline restore implications Restoring SYSVOL authoritatively Performing a granular restore of SYSVOL Recovering Group Policy Restoring data from third-party backups Using the Extract Wizard Restoring passwords and SID history
Full Replication Consolidating backup registration data Monitoring Recovery Manager for Active Directory Recovering an Active Directory forest
Forest recovery overview Deploying Recovery Manager for Active Directory Forest Edition (Disaster Recovery Edition) Permissions required to use Forest Recovery Console Forest Recovery Console Managing a recovery project Recovery methods Phased recovery Managing Forest Recovery Agent Rebooting domain controllers manually Resetting DSRM Administrator Password Purging Kerberos Tickets Managing the Global Catalog servers Managing FSMO roles Manage DNS Client Settings Configuring Windows Firewall Developing a custom forest recovery plan Backing up domain controllers Assigning a preferred DNS server during recovery Handling DNS servers during recovery Forest recovery approaches Deciding which backups to use Running custom scripts while recovering a forest Overview of steps to recover a forest Viewing forest recovery progress Viewing recovery plan Viewing a report about forest recovery or verify settings operation Handling failed domain controllers Adding a domain controller to a running recovery operation Selectively recovering domains in a forest Recovering SYSVOL Deleting domains during recovery Resuming an interrupted forest recovery Recovering read-only domain controllers (RODCs) Checking forest health Collecting diagnostic data for technical support
Using Management Shell Creating virtual test environments Using Recovery Manager for Active Directory web portal Appendices
Frequently asked questions Best practices for using Computer Collections Technical characteristics Best practices for creating backups Best practices for creating backups for forest recovery Best practices for recovering a forest Descriptions of recovery or verification steps Ports Used by Recovery Manager for Active Directory Forest Edition (Disaster Recovery Edition) Backup Wizard Online Restore Wizard Online Restore Wizard for AD LDS (ADAM) Group Policy Restore Wizard Repair Wizard Extract Wizard Events generated by Recovery Manager for Active Directory Descriptions of PowerShell commands
Add-RMADBackup Add-RMADCollectionItem Add-RMADReplicationConsole Add-RMADStorageServer Backup-RMADCollection Close-RMADFEProject Compare-RMADObject Convert-RMADBackup ConvertTo-RMADRecycledObject Copy-RMADFEBackup Create-RMADStorageAgentSetup Expand-RMADBackup Export-RMADBackup Export-RMADFERecoveryCertificate Export-RMADFEResult Export-RMADSecureStorageBackup Get-RMADBackup Get-RMADBackupAgent Get-RMADBackupInfo Get-RMADBackupObject Get-RMADBackupSecurityStatus Get-RMADCollection Get-RMADCollectionItem Get-RMADDeletedObject Get-RMADFEAvailableSubnet Get-RMADFEComputer Get-RMADFEConsole Get-RMADFEDnsCache Get-RMADFEDomain Get-RMADFEEvent Get-RMADFEGlobalOptions Get-RMADFEOperation Get-RMADFEPersistenceConnection Get-RMADFEProject Get-RMADFERecoveryAgent Get-RMADFESchedule Get-RMADGlobalOptions Get-RMADLicenseInfo Get-RMADObject Get-RMADReplicationConsole Get-RMADReplicationSchedule Get-RMADReplicationSession Get-RMADReplicationSessionItem Get-RMADReportObject Get-RMADReportObjectAttributes Get-RMADReportObjectChildren Get-RMADReportSession Get-RMADSession Get-RMADSessionItem Get-RMADSessionItemEvent Get-RMADStorageServer Get-RMADStorageServerHardeningStatus Get-RMADStorageServerRetentionPolicy Import-RMADBackup Import-RMADFERecoveryCertificate Install-RMADBackupAgent Install-RMADFERecoveryAgent New-RMADCollection New-RMADFEProject New-RMADFERecoveryMedia New-RMADSchedule Open-RMADFEProject Protect-RMADSecureStorageServer Publish-RMADBackupSecurityStatus Refresh-RMADStorageServer Register-RMADSecureStorageBackups Remove-RMADBackup Remove-RMADBackupAgent Remove-RMADCollection Remove-RMADCollectionItem Remove-RMADFERecoveryAgent Remove-RMADFESchedule Remove-RMADReplicationConsole Remove-RMADReplicationSchedule Remove-RMADReplicationSession Remove-RMADStorageServer Remove-RMADUnpackedComponent Rename-RMADCollection Restore-RMADDeletedObject Restore-RMADDomainController Restore-RMADObject Resume-RMADFERecovery Save-RMADFEProject Set-RMADCollection Set-RMADFEComputer Set-RMADFEDnsCache Set-RMADFEDomain Set-RMADFEGlobalOptions Set-RMADFEPersistenceConnection Set-RMADFERecoveryMode Set-RMADFESchedule Set-RMADGlobalOptions Set-RMADReplicationConsole Set-RMADReplicationSchedule Set-RMADStorageServerRetentionPolicy Start-RMADFERecovery Start-RMADFERecoveryAgentOperation Start-RMADFEVerification Start-RMADReplication Start-RMADReportViewer Stop-RMADFEWorkflow Test-RMADSecureStorageBackup Unprotect-RMADStorageServer Update-RMADBackupAgent Update-RMADFEProject Update-RMADLicense

General tab

You can use this tab to specify recovery settings for one or more domain controllers selected in the list.

TIP

To specify recovery settings for multiple domain controllers at a time:

  1. Hold down CTRL, and then click to select domain controllers in the list of domain controllers.

  2. Use the General tab to specify recovery settings for the selected domain controllers.

The "Domain Controller Recovery Settings and Progress" area also provides the following commands for managing the recovery of domain controllers:

Recovery-related commands

  • Pause Next Operation - Suspends the next operation performed during the current session on the selected domain controllers.

  • Resume Operation - Resumes the suspended operation on the selected domain controllers.

  • Retry All Operations - Retries all operations for the selected domain controllers. Before retrying all operations, you may specify a different recovery method for the domain controllers.

  • Retry Last Operation - Retries the last operation performed during the current session on the selected domain controllers.

  • Skip and Continue - Skips the error encountered for the selected domain controllers.

  • Abort - Cancels the recovery or verify settings operation for the domain controllers selected in the list.

Recovery Methods

Recovery method - Allows you to choose one of the following recovery methods for the domain controller selected in the list:

Restore Active Directory from backup

Restores the domain controller from the backup you specify. For more information on backup selection methods, see Selecting backups for recovery. During recovery, Recovery Manager for Active Directory uses custom Internet Protocol security (IPSec) rules to isolate the domain controllers for which you selected this recovery method. For more information, see How does Recovery Manager for Active Directory isolate domain controllers during forest recovery?

Restore SYSVOL

Restores contents of the SYSVOL share on the specified domain controllers. Read-only domain controllers (RODC) will be restored as well.

This method can be set only on the Recovery Mode tab of Recovery Project Settings. For details, see Recovering SYSVOL.

Install Active Directory

Installs Active Directory by using Microsoft’s tools.

For domain controllers running Windows Server 2008 or earlier, this step uses the Dcpromo.exe tool.

For Windows Server 2012-based domain controllers, this step uses the Windows PowerShell cmdlets Install- ADDSDomainController.

Installs Active Directory by selecting the Install from Media (IFM) option. The selected servers will be promoted to Domain Controllers using a media file created from the Active Directory backup.

Note: Make sure that a read-only domain controller (RODC) can be installed using a backup created from a read-only DC, or a writable DC can be installed using a backup created from a writable DC.

For details, see Install Active Directory recovery method.

Reinstall Active Directory

Uninstalls Active Directory and then installs it again by using Microsoft’s tools.

For domain controllers running Windows Server 2008 or earlier, this step uses the Dcpromo.exe tool.

For Windows Server 2012-based domain controllers, this step uses the Windows PowerShell cmdlets Install- ADDSDomainController and Uninstall-ADDSDomainController.

Uninstalls Active Directory and then installs it again by selecting the Install from Media (IFM) option.
The selected servers will be uninstalled and then promoted to Domain Controllers using a media file created from Active Directory backup.

After the Active Directory reinstallation is complete, the domain controller replicates Active Directory data from other domain controllers that were restored from backups in the recovery project.

Note

The Reinstall Active Directory recovery method removes the global catalog by default if it is present on the domain controller being recovered. If you need to reconfigure the global catalog on the domain controller during Active Directory reinstallation, select the Configure the domain controller as a global catalog server option in the Additional Settings section.

Uninstall Active Directory

Performs a forced removal of Active Directory from the domain controller and then demotes it to a member server in the domain. Domain controller’s metadata is completely removed from Active Directory.

Note

When you use this method, the local Administrator password on the target domain controller is reset to the value you specify in the Set DSRM password and Confirm DSRM password text boxes in the Forest Recovery Console.

Adjust to Active Directory changes

This recovery method is available and selected automatically when the domain controller is a Global Catalog server and belongs to the excluded domain, and either Rebuild GC, advertise normally or Rebuild GC, advertise fast is checked on the Global Catalog tab of the project settings. You can suppress any of the first two options using advanced settings.

How the Adjust to Active Directory changes method works:

  1. The agent removes lingering objects from other recovered domains, if any, using the Repadmin tool.

  2. If the previous step fails, the agent performs unhost and rehost of recovered domain partitions using the Repadmin tool.

  3. Only if both previous steps fails, the agent rebuilds Global Catalog on this domain without attempts to remove lingering objects. In case of full reset of Global Catalog, the replication of Global Catalog data may require additional time.

Do not recover

Isolates the domain controller from other domain controllers and completely removes it from the domain - no actions are performed on the domain controller itself. This option is used if the domain controller is inaccessible or you do not want to recover the domain controller due to any failures. Recovery Manager for Active Directory removes all metadata of domain controllers that were not recovered from the Active Directory forest.

Note

For recovery in the second phase only: If you are going to restore this domain controller on the second phase later, select the Keep this domain controller in the project option. For details, see Phased recovery.

Do nothing

This recovery method does not perform any actions on the domain controller and does not remove it. This method is available only if the Repromotion recovery mode is selected on the Recovery Mode tab of Recovery Project Settings. For details, see Phased recovery.

Options

Computer Access area

Allows you to specify the user name and password that will be used by Recovery Manager for Active Directory to access domain controllers in the domain. This area has the following text boxes:

Target machine - Using this option you can specify the IP address for the target machine where Active Directory will be installed. Only for the Install Active Directory From Media and Install Active Directory methods.

Use Default Domain Access Credentials - This option lets you use the default domain credentials to access domain controllers. To configure the default domain access credentials, select the option and press the view link that opens Recovery Project Settings. For more details, see Specifying recovery project settings. If the option is not selected, you can specify domain access credentials and DSRM password in the Domain Controller Access section. Otherwise, the Domain Controller Access section is not active.

User name and User password - Allows you to specify the user name and password with which Recovery Manager for Active Directory will perform the following operations:

  • install, upgrade and check the Forest Recovery Agent

  • purge Kerberos tickets

  • manage FSMO roles

  • manage DNS client settings

  • manage Global Catalog servers

  • check forest health

These credentials are not used to access domain controllers during the project verification and forest recovery. Forest Recovery Agent uses RPC over SSL for communication. To get more details, see Managing Forest Recovery Agent.

CAUTION: The password for the specified account will be reset to the value specified in the project during the restore process. Make sure that the specified account existed in Active Directory at the time of the creation of the selected backup - the backup can be selected by a user or by the specified backup criteria. Otherwise, the password will not be reset.

DSRM administrator - Allows you to specify the user name with which you want Recovery Manager for Active Directory to access the selected domain controllers in Directory Services Restore Mode (DSRM).

Set DSRM password and Confirm DSRM password

Allows you to specify the DSRM password to be used by Recovery Manager for Active Directory during the domain controller (DC) recovery.

When using these boxes, consider the current mode of the DC:

  • If the DC is already in DSRM mode. Use these boxes to specify the current password of the account you entered in the DSRM administrator text box. Otherwise, the DC recovery will fail.

  • If the DC is not in DSRM mode. Use these boxes to set a new temporary DSRM password for the account you entered in the DSRM administrator text box. Recovery Manager for Active Directory will use this temporary DSRM password to restart the domain controller in DSRM during the recovery. Then, Recovery Manager for Active Directory will replace this temporary password with the DSRM password stored in the backup you specified for the DC.

Target server network settings - Allows you to specify network settings applied to the recovered machine.

  • IP Address

  • Subnet mask

  • Default gateway

  • DNS Server

*Only for the Bare Metal Active Directory Recovery method

The network and DNS settings will be retrieved automatically from the BMR backup for the Bare Metal Active Directory Recovery method. If you need to edit the settings, click Change and specify the following options:

  • Retrieve network and DNS settings from a backup (used by default)

This option gets network settings for the selected domain controller from the backup

  • Use the following address

This option lets you specify network settings manually.

  • Select a DNS server automatically

If this option is selected, DNS server will be selected automatically.

  • Use the specified DNS server

This option lets you specify one DNS server or a list of DNS servers separated by semicolons.

NAT settings - This option lets you access recovered domain controllers that are located outside the network where Recovery Manager for Active Directory is installed. *Only for the Bare Metal Active Directory Recovery method

Additional Settings area

This area has the following options:

  • Install the domain controller as a read-only - Use this option to install Read-Only Domain Controller(RODC) for Install Active Directory and Reinstall Active Directory recovery methods. This option will be selected by default if the original DC was read-only. Note that a read-only DC can be installed using a backup created only from the RODC. For more details, see Recovering read-only domain controllers (RODCs).

  • Configure the domain controller as a global catalog server - Use this option if you need to reconfigure the global catalog on the domain controller during Active Directory reinstallation. This option will be selected by default if the original DC was a global catalog.

  • Preffered DNS server - Allows you specify a a preferred DNS server for the domain controller during its recovery. For more information, see Assigning a preferred DNS server during recovery.

Elements in the Backup, Access Credentials and Install Active Directory parameters areas

Use backup criteria to automatically select a backup - Allows you to automatically select a backup file that meets particular criteria. To specify your criteria, click the Backup Criteria button on the toolbar.

Backup - Displays the path and name of the currently selected backup file from which the domain controller will be restored. To manually select a backup file, make sure the Use backup criteria to automatically select a backup check box is cleared, and then click the Select button.

Backup password - Allows you to type the password to open a password-protected backup.

Temporary backup folder - Here you can specify the folder on the domain controller to store temporary forest backup data.

Access Credentials - Allows you to enter the user name and password with which you want to access the location that holds the backup specified in the Backup file box. The account you specify must have Read access to that location. For BMR backups, the account you specify must have Read and Write access to that location.

Wipe all disks on the target machine before restore from the backup - If this option is selected, Recovery Manager for Active Directory performs the DiskPart "clean all" command before recreating the disks. This command removes all partitions and cleans all disk sectors. The "Wipe all disks…" operation significantly increases the time of the restore process. *Only for the Bare Metal Active Directory Recovery method

Scan the selected backup (and Active Directory backup if applicable) for malware during the project verification - This option allows you to run antivirus checks for backups as a part of the settings verification process.

Restore from Active Directory Backup - This option allows you to restore the latest Active Directory/Registry data from the Active Directory backup. *Only for the Bare Metal Active Directory Recovery method.

DIT database path - Specifies the location of the DIT database. *Only for the Install Active Directory From Media and Install Active Directory methods.

Log files path - Specifies the location of Log files. *Only for the Install Active Directory From Media and Install Active Directory methods.

SYSVOL path - Specifies the location of SYSVOL. *Only for the Install Active Directory From Media and Install Active Directory methods.

 

Progress tab

You can use this tab to view progress of the recovery stages and steps applicable to the domain controller selected in the list. To view more information about a recovery step on this tab, point to that step, and then point to the question mark displayed next to it.

You can copy the information displayed on the Progress tab to the Clipboard and then paste it to another application (for example, a Microsoft Office Word file). To do so, point to the Progress tab, and then click the Copy button in the upper right corner of the tab. This copies all the information displayed on the Progress tab, including the current status of each recovery stage and step and any error messages displayed on the tab.

 

Events tab

You can use this tab to view recovery events related to the entire Active Directory forest, specific domain controllers, or both these categories of recovery events.

On this tab, you can use the following elements:

  • Show - Select a category of recovery events to view:

    • Forest-wide events. Shows recovery events related to the entire Active Directory forest.

    • Events for selected DCs. Shows recovery events related to the domain controllers selected in the list.

    • All events. Shows forest-wide events and events related to the domain controllers selected in the list.

  • Copy - Copies events in the list to Clipboard.

  • Save - Allows you to export events in the list to one of the following formats:

    • Text (Tab delimited) (*.txt)

    • CSV (Comma delimited) (*.csv)

 

Configuring advanced settings

You can change a number of advanced settings of the Forest Recovery Console. To do so, you need to modify the FRConsoleSettings.xml file that stores these advanced settings. You can find this file in the Recovery Manager for Active Directory installation folder (by default, this is %ProgramFiles%\Quest\Recovery Manager for Active Directory).

The changes you make in the FRConsoleSettings.xml file become effective right after you save the file. You do not need to restart the Forest Recovery Console.

The FRConsoleSettings.xml file includes the following XML elements you can modify:

SkipUnmodifiedFilesDuringRecovery

Enables or disables skipping the files that are identical on the domain controller and in the backup during restore operations. This element can take one of the following values:

  • TRUE. Enables skipping the files.

  • FALSE. Disables skipping the files.

PasswordsLength

Sets the length (in characters) for the passwords automatically generated by Recovery Manager for Active Directory.

PasswordsSymbols

Allows you to specify what symbols you want to use in the passwords automatically generated by Recovery Manager for Active Directory.

This element can take the following values:

  • Latin. Specifies to use English letters.

  • Number. Specifies to use Arabic numerals.

  • Upper. Specifies to use uppercase English letters.

  • Lower. Specifies to use lowercase English letters.

  • All. Specifies to use all of the above-listed characters.

You can specify multiple values in this element. When specifying multiple values, use a pipe (|) as a separator.

Example:

Latin | Number | Upper | Lower

MaximumBackupAgeInDays

Specifies the maximum age (in days) of the backups to be displayed on the GUI. Backups whose age exceeds the specified value will not be displayed.

DisableSystemPauses

Do not change the value in this element. This element is for internal use only.

EnablePersistence

Enables or disables the Recovery Persistence feature. This element can take one of the following values:

  • TRUE. Enables the Recovery Persistence feature.

  • FALSE. Disables the Recovery Persistence feature.

DaysBetweenProjectUpdates

Sets the maximum number of days between the updates of a recovery project. When the specified value is exceeded for a project, the Forest Recovery Console displays a warning.

SelectDnsTimeout

Sets a timeout for the DNS server search operation performed during a forest or domain recovery. Use the format hh:mm:ss.

DiagnosticsDataPath

Specifies the default location on the Forest Recovery Console computer for storing diagnostic data gathered with the Diagnostic Data Collector.

TargetGcOccupancyLevel

Sets the global catalog partition occupancy level value to be used when advertising a rebuilt GC fast.

This element can take one of the following values:

  • 0. No occupancy requirement.

  • 1. At least one read-only partition in site added by Knowledge Consistency Checker.

  • 2. At least one partition in site fully synchronized.

  • 3. All read-only partitions in site added by Knowledge Consistency Checker, at least one synchronized.

  • 4. All partitions in site fully synchronized.

  • 5. All read-only partitions in forest added by the Knowledge Consistency Checker, at least one synchronized.

  • 6. All partitions in forest fully synchronized.

UseRemoveLingeringObjects

If this parameter is set to FALSE, the Adjust to Active Directory changes operation will not call the "Remove lingering objects" command of the Repadmin tool.

UseUnhostRehost

If this parameter is set to FALSE, the Adjust to Active Directory changes operation will not call the "Unhost/Rehost" commands of the Repadmin tool.

EnsuresSingleInstance

Allows you to restrict the number of Forest Recovery Console instances that can be run simultaneously on this computer.

This element can take one of the following values:

  • TRUE. Only one instance of Forest Recovery Console can be run at a time.

  • FALSE. The number of Forest Recovery Console instances that can be run simultaneously is unlimited.

MaxAutomaticDnsCount

Limits the number of automatically selected DNS servers for domain controller DNS client settings.

RidPoolIncreaseValue

Specifies the value by which to raise the number of available RID pools.

If necessary, you can revert to the default values in the FRConsoleSettings.xml file.

RecoveryMediaHttpServicePort

Specifies the port used by the web server handling Recovery Media Images. Images are consumed by HP iLO management software to perform automatic server boots. By default, the port is set to 8080.

To revert to the default values
  1. Delete the FRConsoleSettings.xml file.

  2. Restart the Forest Recovery Console on the computer on which you deleted the file in step 1.

    Recovery Manager for Active Directory recreates the FRConsoleSettings.xml file and assigns default values to the elements in the file.

 

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione