지금 지원 담당자와 채팅
지원 담당자와 채팅

Recovery Manager for AD Disaster Recovery Edition 10.3.2 - User Guide

Overview Getting started
Permissions required to use Recovery Manager for Active Directory Recovery Manager Console Getting and using help Configuring Windows Firewall Using Computer Collections Cloud Storage Secure Storage Server Hybrid Recovery with On Demand Recovery Managing Recovery Manager for Active Directory configuration Licensing
Backing up data
Permissions required for the Backup operation Managing Backup Agent Using a least-privileged user account to back up data Using Managed Service Accounts Active Directory backups vs Windows System State backups Creating BMR and Active Directory backups Using the Backup Wizard Retrying backup creation Enabling backup encryption Backing up AD LDS (ADAM) Backing up cross-domain group membership Backing up distributed file system (DFS) data Backup scheduling Setting performance options Setting advanced backup options Using Forest Recovery Agent Unpacking backups Using e-mail notification Viewing backup creation results
Restoring data
Getting started with Active Directory recovery Managing deleted or recycled objects Restoring backed up Active Directory components Integration with Change Auditor for Active Directory Using granular online restore Restoring AD LDS (ADAM) Selectively restoring Active Directory object attributes Restoring objects in an application directory partition Restoring object quotas Restoring cross-domain group membership Performing a restore without having administrator privileges Reports about objects and operations Using complete offline restore Offline restore implications Restoring SYSVOL authoritatively Performing a granular restore of SYSVOL Recovering Group Policy Restoring data from third-party backups Using the Extract Wizard Restoring passwords and SID history
Full Replication Consolidating backup registration data Recovering an Active Directory forest
Forest recovery overview Deploying Recovery Manager for Active Directory Forest Edition (Disaster Recovery Edition) Permissions required to use Forest Recovery Console Forest Recovery Console Managing a recovery project Recovery methods Phased recovery Managing Forest Recovery Agent Rebooting domain controllers manually Resetting DSRM Administrator Password Purging Kerberos Tickets Managing the Global Catalog servers Managing FSMO roles Manage DNS Client Settings Configuring Windows Firewall Developing a custom forest recovery plan Backing up domain controllers Assigning a preferred DNS server during recovery Handling DNS servers during recovery Forest recovery approaches Deciding which backups to use Running custom scripts while recovering a forest Overview of steps to recover a forest Viewing forest recovery progress Viewing recovery plan Viewing a report about forest recovery or verify settings operation Handling failed domain controllers Adding a domain controller to a running recovery operation Selectively recovering domains in a forest Recovering SYSVOL Deleting domains during recovery Resuming an interrupted forest recovery Recovering read-only domain controllers (RODCs) Checking forest health Collecting diagnostic data for technical support
Restore Active Directory on Installed Active Directory method Restore Active Directory on Clean OS method Bare metal forest recovery Using Management Shell Appendices
Frequently asked questions Best practices for using Computer Collections Technical characteristics Best practices for creating backups Best practices for creating backups for forest recovery Best practices for recovering a forest Descriptions of recovery or verification steps Ports Used by Recovery Manager for Active Directory Forest Edition (Disaster Recovery Edition) Backup Wizard Online Restore Wizard Online Restore Wizard for AD LDS (ADAM) Group Policy Restore Wizard Repair Wizard Extract Wizard Events generated by Recovery Manager for Active Directory

Accessing a Secure Storage server

A dedicated, clean physical server, that is not joined to a domain, is to be used for a Secure Storage server. However, virtualized servers can be used, including a the virtual machine in the cloud. Virtualized servers that are in your on-premise site are not recommended for use, as they are vulnerable to attack.

Physical Server

To access the Secure Storage server (a standalone server) that is hosted on-premise, you must have physical access to the server and use interactive logon with a local administrator account.

Each Secure Storage server is installed with dedicated PowerShell® module to setup and maintain the storage server. For further details see the Management Shell Guide supplied with this release of the product.

WARNING

While Secure Storage server remains hardened, no RDP, PowerShell® Remote and other remote control services and protocols are available.

Virtualized Server

Virtualized on-premise server

If you have configured the dedicated virtual machine on your physical server you may use hypervisor capabilities to control the virtual Secure Storage server including virtual machine connections and execution of commands through the hypervisor services (such as PowerShell® Direct on Hyper-V® machines).

Virtualized server in the cloud

Amazon EC2

To access a Secure Storage server that is deployed in the Amazon EC2 you can use EC2 Serial Console.
To get more information on how to connect to the virtual machine refer to Connect to the EC2 Serial Console

Microsoft Azure®

To access a Secure Storage server that is hosted in Microsoft Azure® virtual machine you can use Serial Console access. Refer to Azure Serial Console

 

Upgrading a Secure Storage server

Upgrade an existing Secure Storage server

After upgrade of Recovery Manager for Active Directory (RMAD) it is recommended to upgrade the Secure Storage agent on the Secure Storage server (a standalone server) to the same version.

IMPORTANT

Secure storage agent is not compatible with RMAD 10.3.1 or lower versions. You must upgrade Secure Storage Agent to enable creating backups on Secure Storage server.

With a hardened Secure Storage server, RMAD does not automatically upgrade the agent and this must be completed with console (physical) access to the server.

  1. In the Recovery Manager for Active Directory console, click the Secure Storage node.

  2. In the Secure Storage Servers pane, select the Secure Storage server. The current version of the agent installed will be displayed.

  3. If the agent installed does not match the version of your RMAD installation, right-click the Secure Storage server that you want to manually export the setup package.

  4. Click Export setup.

  5. Copy the package, SecureStorageAgent.zip, to the existing Secure Storage server. This requires console (physical) access to the Secure Storage server.

  6. Extract the package on the Secure Storage server and double-click the SecureStorageAgent.msi file to upgrade the agent.

  7. A warning will be displayed. IMPORTANT PLEASE READ: This server is about to be hardened and all network connections to this server will be lost including Remote Desktop. Ensure you have physical access to this server and have an available method to access such as console access or serial access. Select YES to acknowledge you understand and are prepared for the Secure Storage server to be installed and hardened. Recovery Manager for Active Directory cannot undo this operation without physical access to the server.

    NOTE: For quiet installation both the /qn switch and FORCE=true can be specified when launching the msi file from the command line.

  8. The Storage Agent is installed and the server is hardened automatically. For more information on hardening, see Hardening a Secure Storage server above.

IMPORTANT

During upgrade the Secure Storage server may be unhardened for a short period of time (seconds).

To prevent temporary unhardening and before installing the new agent on the Secure Storage server, perform the following steps:

  1. On the Secure Storage server, open a command prompt.

  2. To retrieve the id for the current Quest Secure Storage agent, type and run: wmic product where "Name like 'Quest Secure Storage Agent'" get Name, Version, IdentifyingNumber

  3. Using the returned id, type and execute the following: msiexec /x {Identifying Number} AUTO_UNHARDENING=FALSE

 

Secure Storage server with Multiple Consoles

To set up a Secure Storage server across multiple Recovery Manager consoles

By default the Recovery Manager console uses its own set of TLS keys to communicate with the Secure Storage server. To set up a Secure Storage server (a standalone server) to be available on multiple Recovery Manager consoles you must use the same set of TLS keys on each console.

  1. Add Secure Storage server in primary console. Refer to Adding a Secure Storage server

  2. Open or create a recovery project in Forest Recovery Console.

  3. On the menu bar, select Tools | Fault Tolerance.

  4. Click Export communication keys….

  5. In File name:, the communication key file defaults to a location and file name, for example: C:\Users\administrator.RMAD.001\Documents\RMAD_NODE_2022-04-05_11-18.pfx

    Resources/Images/Export_Comm_key_Console.png

  6. Enter and confirm a password to protect the file.

  7. Click OK to save the key file.

    IMPORTANT: Ensure communication keys and access credentials are kept secret and protected.

  8. Then, launch the other instance of Forest Recovery Console.

  9. On the menu bar, select Tools | Fault Tolerance | Import secure communication keys…. Browse and select the Secure Communication Keys file saved in step 7 and click Open.

  10. Open the other instance of the Recovery Manager console.

  11. In the Recovery Manager for Active Directory console, click the Secure Storage node.

  12. In the Secure Storage Servers pane, click Add Server.

  13. Type the DNS name or IP address of original existing Secure Storage server.

  14. In the Agent port field, type port number used when Secure Storage server was first created.

  15. From the Agent installation method drop-down list, select Manual (recommended).

  16. Click OK.

After the Recovery Manager console connects to the existing Secure Storage agent running on the existing Secure Storage server, all backups will appear in the console for viewing.

WARNING

It is not recommended to use Recovery Manager consoles that are in different forests because if one of the forests is breached it may affect the backups of the other forest.

 

Configuring Allowed Volumes for a Secure Storage server

The Secure Storage server (a standalone server) is used to store critical backups. A server can have multiple volumes available for storage of backup files. Recovery Manager for AD provides the ability to configure which volumes are allowed to store backups, the order of the volumes to be used or you can allow RMAD to determine which volume to use automatically.

If no policy is set for allowed volumes, the Secure Storage server will use the first volume found. The system drive with the operating system will only be selected if it is the only available volume on the server.

Ensure your Secure Storage server has sufficient space for storing of backup files. The amount of space used on each volume is displayed for the Secure Storage server and the available free space. Recommendation is to monitor available free space and ensure that there is space available for backups. If a volume is running out of free space, a warning icon will be displayed in the Properties dialog.

To configure the policy for allowed volumes on Secure Storage server

  1. During the installation of the Secure Storage agent on the Secure Storage server (a standalone server), a PowerShell® module was installed and is located in the agent installation folder.

  2. On the Secure Storage server, run Windows PowerShell®. The module will automatically be imported.

  3. To configure backup retention policy, run the cmdlet Set-RMADStorageServerAllowedVolumes. For further details on Set-RMADStorageServerAllowedVolumes see the Management Shell Guide supplied with this release of the product.

To get the current policy for allowed volumes on Secure Storage server

  1. During the installation of the Secure Storage agent on the Secure Storage server (a standalone server), a PowerShell® module was installed and is located in the agent installation folder.

  2. On the Secure Storage server, run the PowerShell® console. The module will automatically be imported.

  3. To configure backup retention policy, run the cmdlet Get-RMADStorageServerAllowedVolumes. For further details on Get-RMADStorageServerAllowedVolumes see the Management Shell Guide supplied with this release of the product.

 

관련 문서

The document was helpful.

평가 결과 선택

I easily found the information I needed.

평가 결과 선택