Recovery Manager for AD Disaster Recovery Edition 10.3.2 - User Guide

Cloud Storage Upload Sessions

After a backup creation session completes for a computer collection and the backup is saved to configured primary storage locations (Tier 1), an upload session will be started to copy the backup to all cloud storage locations. Recovery Manager for Active Directory supports multiple Cloud Storage locations per computer collection.

The backup upload session is created and managed with the Quest Recovery Manager Cloud Storage service on the Recovery Manager console machine. Each backup upload session is displayed in the Backup Upload Sessions pane. For each session, you can view the backup file path, upload location, creation timestamp, finished timestamp, and the status of the upload.

To view a backup upload sessions for a cloud storage account

1. In the Recovery Manager for Active Directory console, expand the Storage node.

2. Select the Cloud Storage node in the console tree.

3. Select the registered cloud storage in the Cloud Storage pane. The backup upload sessions for the selected cloud storage will be displayed in the bottom pane Backup Upload Session. The backup path, upload to path, created timestamp, finished timestamp and current status will be displayed.

4. To filter the upload sessions for the cloud storage, you can select the toggle buttons at the top right corner of the pane.

   • Select Total (7 days) to view all upload sessions in the last 7 days.

   • Select Queued to view all upload sessions that are waiting in the queue to be processed.

   • Select In Progress to view upload sessions that are in progress and backup files are being uploaded.

   • Select Completed to view successful and completed upload sessions.

   • Select Failed to view failed upload sessions. Any failed upload sessions can be retried.

To cancel a backup upload session

1. In the Recovery Manager for Active Directory console, expand the Storage node.

2. Select the Cloud Storage node in the console tree.

3. Select the registered cloud storage in the Cloud Storage pane.

4. In the Backup Upload Session pane, select the session with the status of In Progress or Queued, right click and select Cancel.

5. Select Yes on the confirmation dialog.

To retry a backup upload session

1. In the Recovery Manager for Active Directory console, expand the Storage node.

2. Select the Cloud Storage node in the console tree.

3. Select the registered cloud storage in the Cloud Storage pane.

4. In the Backup Upload Session pane, select the failed session, right click and select Retry.

To remove a backup upload session

1. In the Recovery Manager for Active Directory console, expand the Storage node.

2. Select the Cloud Storage node in the console tree.

3. Select the registered cloud storage in the Cloud Storage pane.

4. In the Backup Upload Session pane, select the session, right click and select Remove.

5. Select Yes on the confirmation dialog.

Secure Storage Server

Recovery Manager for Active Directory (RMAD) provides the ability to set up a dedicated secure backup storage server which is not joined to any domain. If you use a Secure Storage server (a standalone server) in your environment, it helps prevent unauthorized modification or malware attacks on backup data, supporting your key data security and compliance initiatives. For more information on how a Secure Storage server is secured, see Hardening a Secure Storage server below.

Requirements

• Operating system: Microsoft Windows® 2016 or higher

• A stand-alone server to be used as your Secure Storage server. This server should be a workgroup server and MUST NOT BE JOINED to any Active Directory domain.

• An account that will be used to deploy the Storage Agent on the Secure Storage server (a standalone server). This account must also be a local Administrator on the Secure Storage server.

• Physical access (keyboard) to the Secure Storage server. Once the server is hardened, access with regular methods will be disabled (RDP).

• Sufficient storage space on the Secure Storage server for all backup files. For one backup file, the space required is at least the size of the backed-up Active Directory database file (Ntds.dit) and the SYSVOL folder plus 40 MB for the transaction log files. The space check performed also includes an extra 1 GB to ensure enough space is available.

Best Practices

• We highly recommend using a new, dedicated, clean physical server as your Secure Storage server (a standalone server) to help ensure access methods are kept to a minimum.

• Secure additional methods of accessing the Secure Storage server such as console or serial access.

• Recommend the Secure Storage (a standalone server) have additional volumes available in addition to the system drive. It is not advised to store backups on the system drive.

User Scenario

Backup data for all domain controllers can be accumulated on primary storage, and at the same time, you can make a copy of your backup data on a Secure Storage server. The Secure Storage agent will receive the backup securely either from Console or Backup Agent and write it to local storage while the firewall on the Secure Storage server remains in place. If disaster strikes, you could lose your backups on primary storage and even your installation of RMAD but your Secure Storage server will remain in place.

Adding a Secure Storage server

To add a Secure Storage server (a standalone server), it is recommended to install the agent manually. This method saves the agent installation package to the local machine. You must transfer the package manually to the Secure Storage server. This reduces the likelihood of any malware infecting your Secure Storage server by being exposed to your network before the server is secured. Your Secure Storage server (a standalone server) is only secured after the Storage Agent has been installed and the Secure Storage server is hardened.

To add a Secure Storage server (a standalone server) using manual method (Recommended)

1. In the Recovery Manager for Active Directory (RMAD) console, expand the Storage node and click the Secure Storage node.

2. In the Secure Storage Servers pane, click Add Server.

3. Type the DNS name or IP address of the server you want to use as your Secure Storage server.

4. In the Agent port field, type port number or use default port of 48001.

   NOTE: Ports cannot be changed after the Secure Storage server is added. To change the port after the Secure Storage server is added, the server must be removed and added again.

5. From the Agent installation method drop-down list, select Manual (recommended).

   

6. Type the path or browse to path to Save agent setup package to.

7. Click OK. The agent setup package is saved to your local machine.

8. Copy the package, SecureStorageAgent.zip, to the server being configured as your Secure Storage server. This requires console (physical) access to the Secure Storage server.

9. Extract the installation package on the Secure Storage server and double-click the SecureStorageAgent.msi file to install the agent.

10. A warning will be displayed and requires confirmation to proceed. IMPORTANT PLEASE READ: This server is about to be hardened and all network connections to this server will be lost including Remote Desktop. Ensure you have physical access to this server and have an available method to access such as console access or serial access. Select YES to acknowledge you understand and are prepared for the Secure Storage server to be installed and hardened. Recovery Manager for Active Directory cannot undo this operation without physical access to the server.

    NOTE: For quiet installation both the /qn switch and FORCE=true can be specified when launching the msi file from the command line.

11. The Storage Agent is installed and the server is hardened automatically. For more information on hardening, see Hardening a Secure Storage server below.

To add a Secure Storage server (a standalone server) using automatic method

1. In the RMAD console, click the Secure Storage node.

2. In the Secure Storage Servers pane, click Add Server.

3. Type the DNS name or IP address of the server you want to use as your Secure Storage server.

4. In the Agent port field, type port number or use default port of 48001.

   NOTE: Ports cannot be changed after the Secure Storage server is added. To change the port after the Secure Storage server is added, the server must be removed and added again.

5. From the Agent installation method drop-down list, select Automatic.

   

6. Specify a user account that will be used to automatically deploy the agent on the target Secure Storage server. Select Use current account to use the currently logged in user account or select Use this account. Type the user name and password for the user account to be used to deploy the agent.

7. Click OK.

To manually export the setup package

If you have misplaced the agent setup package or need to update the configuration for a Secure Storage server, you can manually export the package again.

1. In the RMAD console, click the Secure Storage node.

2. In the Secure Storage Servers pane, right-click the Secure Storage server that you want to manually export the setup package for.

3. Click Export setup.

To delete a Secure Storage server from RMAD console

1. In the RMAD console, expand the Secure Storage node.

2. Right-click the Secure Storage server and select Delete.

To export a list of all registered Secure Storage servers to a text file

1. In the Recovery Manager for Active Directory console, select the Storage node, then Secure Storage and right click.

2. In menu shown click on Export Servers…

3. In the Export storage servers dialog, select a location to save the file, enter a file name, and click Save .

Add an existing Secure Storage server on a clean RMAD installation after full disaster

If the RMAD server is lost, after installing the RMAD console on a new server, you can register the backups that are stored on the Secure Storage server (a standalone server) on your new RMAD server.

To add a Secure Storage server on a clean installation of RMAD console

1. In the new RMAD console, click the Secure Storage node.

2. In the Secure Storage Servers pane, click Add server.

3. Type the DNS name or IP address of the server you want to use as your Secure Storage server.

4. In the Agent port field, type port number or use default port of 48001.

   NOTE: Ports cannot be changed after the Secure Storage server is added. To change the port after the Secure Storage server is added, the server must be removed and added again.

5. From the Agent installation method drop-down list, select Manual (recommended).

6. Type the path or browse to path to Save agent setup package to.

7. Click OK. The agent setup package for the new RMAD console is saved to your local machine.

8. Copy the package, SecureStorageAgent.zip, to the existing Secure Storage server. This requires console (physical) access to the Secure Storage server.

9. Extract the package on the Secure Storage server and double-click the SecureStorageAgent.msi file to reinstall the agent and register the Secure Storage server with new Recovery Manager for Active Directory console.

10. In the RMAD console, you will now see the Secure Storage server (a standalone server) and can now retrieve your backups from the existing Secure Storage server for recovery purposes.

Default Storage Agent ports

The Storage Agent is used to manage backups on the Secure Storage server (a standalone server). By default, the Storage Agent port is 48001. If you want to use a different default port, you can configure it in the Secure Storage server Properties window or overwrite when adding each Secure Storage server.

To change the default Storage Agent port

1. In the RMAD console, right-click the Secure Storage node and select Properties.

2. In the Storage Agent port field, type a port number.

3. Click OK.

Storage Server Properties

To view Secure Storage server properties

1. In the RMAD console, click the Secure Storage node, in the Secure Storage Servers pane, select a Secure Storage Server, right-click and select Properties.

2. Properties of the Secure Storage server will be displayed. Properties include the Host name, Agent version, Agent port, and Server Status. All properties are read only and cannot be edited.

3. Additionally, all configured volumes are displayed in priority order. Each volume is shown with the amount of space taken by Existing Backups and the amount of Free Space available on the volume.

Hardening a Secure Storage server

After the Secure Storage server (a standalone server) has been added and the Storage Agent has been installed on it, the server is hardened automatically. The following list outlines what happens to a Secure Storage server when it is hardened:

• All SMB server roles are disabled (SMBv1 - SMBv3).

• All inbound and outbound TCP, ICMP and UDP protocols are blocked by IPSec policies, except for the high-level Secure Storage Agent ports (see below).

• ICMP traffic is blocked (i.e. the server cannot be pinged).

• Remote desktop (RDP) traffic is blocked.

• Only one TCP inbound agent port is left open on the server for communication with Recovery Manager for Active Directory, the Storage Agent port (by default, this is 48001).

• To allow the backups to be uploaded to remote locations (the "Copy to…" menu item in the Backups on the Secure Storage Servers pane), outbound TCP port 445 for SMB, outbound UDP 53 port for DNS, outbound UDP 5355 port for LLMNR, and outbound UDP 137 port for NetBIOS are opened.

• Agent traffic is encrypted by the public/private key pair.

• Logons to the server are only allowed via console (physical) access.

When a Secure Storage server is hardened, the lock icon next to the name of the Secure Storage server in the Secure Storage Servers window will be closed and it will have a Security Status of Secured.

To get the hardening status of a Secure Storage server

1. During the installation of the Secure Storage agent on the Secure Storage server, a PowerShell® module was installed and is located in the agent installation folder.

2. On the Secure Storage server, run the PowerShell® console. The module will be automatically imported.

3. To get the hardening status, run the cmdlet Get-RMADStorageServerHardeningStatus. For further details see the Management Shell Guide supplied with this release of the product.

To unharden a Secure Storage server

1. During the installation of the Secure Storage agent on the Secure Storage server, a PowerShell® module was installed and is located in the agent installation folder.

2. On the Secure Storage server, run the PowerShell® console. The module will be automatically installed.

3. To unharden a Secure Storage server, run the cmdlet Unprotect-RMADStorageServer. For further details see the Management Shell Guide supplied with this release of the product.

To harden a Secure Storage server manually

1. During the installation of the Secure Storage agent on the Secure Storage server, a PowerShell® module was installed and is located in the agent installation folder.

2. On the Secure Storage server, run the PowerShell® console. The module will be automatically installed.

3. To harden a Secure Storage server manually, run the cmdlet Protect-RMADStorageServer. For further details see the Management Shell Guide supplied with this release of the product.