Recovery Manager for AD Disaster Recovery Edition 10.3.1 - User Guide

Step 2: Gather remaining data manually

Perform the next steps for each domain controller from which you could not successfully collect data in Step 1: Use Diagnostic Data Collector to automatically gather data.

To gather diagnostic data manually

1. Create a temporary folder on the local disk of the target domain controller.

2. Copy Collectdcdata.cmd from the Recovery Manager for Active Directory installation folder to the folder you created in step 1 of this procedure.

3. Run the Collectdcdata.cmd file in the location you copied it to and wait for the script to complete.

   The collected diagnostic data is saved to the CollectedData folder created in the location where you ran the Collectdcdata.cmd file.

4. Rename the CollectedData folder so that its name reflects the name of the domain controller from which you collected data.

5. Add the folder to the .zip file created in Step 1: Use Diagnostic Data Collector to automatically gather data.

   Now you can submit the .zip file to Quest technical support.

Restore Active Directory on Clean OS method

Using the Restore Active Directory on Clean OS method you can restore the entire forest or any of its domains on the freshly installed Windows® machines. This recovery method can be used, for example, when existing BMR backups contain the infected OS image. In this case, Active Directory® backups can be used due to they do not contain binaries (except Sysvol files). Active Directory backups can be also checked for viruses.

Domain controllers that are running on virtual machines in Amazon Web Services (AWS) or Microsoft Azure can be restored with the Restore Active Directory on Clean OS method.

At the first stage of the Restore Active Directory on Clean OS recovery method, the DNS server role is installed on a domain controller. For this reason, it is recommended to use a backup that was made on the AD-integrated DNS server for Clean OS recovery. You can still use backups that were made on the non-AD-integrated DNS server but in this case you should not use Automatic DNS selection option on any domain controller in such a domain.

If your domain has AD-integrated DNS servers restored from backup, you need to specify the DNS settings manually.

After recovery, the domain controller that was restored by the Restore Active Directory on Clean OS recovery method synchronizes DNS partitions and continues to be a DNS server.

If your domain uses external DNS, you need to specify the DNS settings manually for every domain controller in the domain.

After recovery, the domain controller restored by the Restore Active Directory on Clean OS recovery method will run a non-functional DNS server so you can uninstall it.

If you are testing Forest Recovery in the lab environment and your production forest uses an external (non-AD integrated) DNS server.

1. You can prepare the lab by installing a new DNS server (e.g. on the RMAD server).

2. Create empty DNS zones on this server in accordance with your production DNS configuration.

3. Ensure that SOA and NS records created in the empty zone have the FQDN DNS name corresponding to this DNS server.

4. Create an A record pointing to this server IP address in each zone.

5. Ensure that non-secure DNS dynamic updates are enabled.

Recovery steps

Step 1. Install the clean Windows image on the existing hardware or virtual machine

A blank host should comply with the following requirements:

• The version of the Windows operating system must match the version deployed on the failed domain controller.

• A blank host must have the same drive letters as the source domain controller if the Use AD paths from backup check box is selected or the drive letters must match the custom paths specified in the project.

• A blank host should have enough free space for AD and SYSVOL data.

• The account that is specified in Forest Recovery Console to access the target blank host should be the local Administrator on this machine.

As noted above, it is important that the version of the Windows operating system match the version deployed. During the Verify operation, a warning is given if the target windows version does not match the backup windows version. The versions are reported in the status.

The following image shows the operation succeeding.

When the Major and Minor versions do not match, meaning that at least one of the OS versions is below 2016, an error is presented.

When both systems are 2016/2019/2022 but they do not match, a warning is presented. While it is possible that the operation will work, it is recommended that it should not be performed.

Step 2. Select any appropriate Active Directory backup

Select any appropriate Active Directory backup file ensuring it has the extension .BKF on the file.

Step 3. Use the Restore Active Directory on Clean OS recovery method

Recovery Manager for Active Directory promotes the selected Windows server to a domain controller and then restores Active Directory® data.

Create virtual machines in Microsoft Azure

You can use the Forest Recovery Console to create Microsoft Azure Virtual Machines. You can then use the Restore Active Directory® to Clean OS recovery method to restore Active Directory® on the virtual machine.

Prerequisites

Create Active Directory backups
Create a recovery project

To create a virtual machine in Microsoft Azure®

1. In the Forest Recovery Console, create a new project or select an existing recovery project.

2. Select the Domain Controller to be created as a virtual machine in Azure®.

3. From the Recovery Method drop-down list, select Restore Active Directory on Clean OS.

4. In the Server access credentials section, type the user name and password that you want to be created as a local account on the new virtual machine in Azure®. These credentials are used during the Forest Recovery process.

   NOTE: You cannot use 'Administrator' in the Local user name field as this name is reserved in Azure®.

5. In the Backup Access Credentials section, type the user name and password to access the selected backup file. The backup file must be accessible from the Forest Recovery Console and from the newly created DCs in Azure®. For example, if your backup is located on a file share in Azure®, supply credentials with access to the file share.

   NOTE: The backup file must be accessible from both the Forest Recovery Console server and the newly created DCs in the Azure® virtual network. For example, backup may be located on Azure® File Share or access to backup files located on premise from the Azure® virtual network may be configured by setting up a Site-To-Site VPN connection.

6. On the Infrastructure tab, from the Infrastructure drop-down list, select Microsoft Azure.

7. Click Edit to configure the infrastructure template and virtual machine settings.

8. In the Recovery Project Settings window, on the Infrastructure tab, click Login to sign in to the Azure® tenant. Provide a user account that is assigned an Azure role with create and write permissions for the required resource group and all other virtual machine resources. The Azure® built-in role of Owner or User Access Administrator on the subscription is recommended.

   IMPORTANT: Support has been added for accounts that have access to multiple tenants. The tenant where the account exists will be displayed in the Tenant field. The subscription drop-down menu will display all of the subscriptions in all tenants that the account has access. When you select a subscription then the tenant which the subscription is a part of, will be displayed in the Tenant field. Use caution when selecting a subscription as you should ensure it is from the correct tenant.

   IMPORTANT: To disconnect from the tenant you must use the Azure Az PowerShell module cmdlet Disconnect-AzAccount. To do this select Quest in the Start menu and then click on Management Shell. This opens the RMAD management shell and then enter Disconnect-AzAccount. It will take a few moments to disconnect from the Azure tenant and all of the settings will be cleared. To change to another tenant, without disconnecting, click Login, add the new tenant and authenticate.

   
   

   The minimal required permissions are:

   In case the target resource group does not exist:

   Permission	Scope
   */read	Subscription
   Microsoft.Resources/subscriptions/resourceGroups/write	Subscription
   Microsoft.Authorization/roleAssignments/write	Subscription

   
   
   In case the target resource group exists:

   Permission	Scope
   */read	Subscription
   Microsoft.Authorization/roleAssignments/write	Resource Group

   The RMAD service principal is automatically granted "Owner" role for the target resource group.

   NOTE: To create a virtual machine in Azure, the Az Powershell module is required. If the module fails to install automatically, click the link provided to download and install the module manually. After installation, click refresh to update the information on the Infrastructure tab.

   NOTE: In case the virtual network, network security group, or virtual network gateway are located in the resource groups other than the resource group where the virtual machine is created, the Owner permissions on that resource groups is required.

   NOTE: The RMAD service principal is automatically granted "Owner" role for the target resource group. In case the virtual network, network security group, or virtual network gateway are located in the resource groups other than the resource group where the virtual machine is created, the RMAD service principal is automatically granted "Contributor" role for that resource groups.

   

   After successful login, the fields on the Infrastructure tab are populated with information retrieved from the tenant. This includes available subscriptions, resource groups, networks, and security groups. If the resource already exists in the selected Azure® subscription RMAD will not create a duplicate. This reuse of resources is recommended for performance of your restore operation.

9. From the Subscription drop-down list, select the subscription to be used by the infrastructure template.

   IMPORTANT: Support has been added for accounts that have access to multiple tenants. The tenant where the account exists will be displayed in the Tenant field. The subscription drop-down menu will display all of the subscriptions in all tenants that the account has access. When you select a subscription then the tenant which the subscription is a part of, will be displayed in the Tenant field. Use caution when selecting a subscription as you should ensure it is from the correct tenant.

10. In the Infrastructure Settings section, configure the following settings:

    • Location: Select the location where the virtual machine will be created. When Location is selected ALL resource groups, security groups, virtual networks and VM sizes within this location are populated and displayed.

    • Resource group: Select an existing resource group for the virtual machine or click Create new to create a new resource group.

    • Security group: Select a Network Security group from the drop-down list of the network security groups within the Location that are displayed. Click Create new to create a new Network security group within the selected Resource group.

    • Network: Select the virtual network from the drop-down list of all of the networks within the Location that are displayed. Click Create new to add a new virtual network within the selected Resource group.

    • Subnetwork: Select a subnetwork from the drop-down list of all of the subnetworks within the Location that are displayed. Click Create new to create a new subnetwork within the selected Resource group.

    • IP range: Specify a custom private IP address space using public and private (RFC 1918) addresses. Azure assigns resources in a virtual network a private IP address from the address space that you assign.

    • Subnetwork IP range: Specify a subnetwork address range in CIDR notation (for example, 192.168.1.0/24) and it must be contained by the address space of the virtual network.

11. To assign a public IP address for the virtual machine to be created in Microsoft Azure select the Add public IP address to the virtual machine checkbox. After the template settings are configured and the Azure® template is applied to domain controllers a Public IP address will be assigned to the newly created VM.

12. To manually assign a static IP address for the virtual machine to be created in Microsoft Azure select the Manually assign a static IP address in the subnet's address range checkbox. After the template settings are configured and the Azure® template is applied to domain controllers, click the Infrastructure tab for the domain controller, under Target Virtual Machine. Type a valid IP address within the sub-network IP range for the virtual machine in Azure®. When the virtual machine (Domain Controller) is created in Azure®, the IP address will be statically assigned.

    

13. The Forest Recovery Console should have access to the virtual network where the Azure® virtual machine will be created. If there is no Point-to-Site or Site-to-Site VPN connection to the Azure® virtual network exists, select the Connect VMs using Virtual Network Gateway (VPN Connection) check box to connect to Azure® using an existing Virtual Network Gateway, or to create a new Virtual Network Gateway. When this checkbox is selected, a VPN connection to Azure® will be configured automatically on the Forest Recovery console machine for communication.
    
    When you select virtual network, all subnetworks for this network and virtual network gateways attached to this network are displayed.
    
    Next, complete the following steps:

    • From the Virtual network gateway drop-down list, select an existing Virtual network gateway from all of the gateways listed for the Location. Click Create new to create a new Virtual network gateway.

    • In the Address Pool field, an IP address received from the client address pool is listed for VPN clients that connect to the virtual network using this point-to-site connection.

    IMPORTANT: The Virtual Network Gateway(VPN connection) will take approximately 30 minutes to be created. If Connect VMs using Virtual Network Gateway (VPN Connection) and Delete Infrastructure after verification are both selected, the Virtual Network Gateway will be deleted as part of the infrastructure. Since the Virtual Network Gateway will need to be created again during the restore operation, the length of time required for the recovery will be increased by 30 minutes.

14. To remove only those resources created by the Verify Settings process, select the Delete infrastructure after verification check box. After the Verify Settings process is complete, only those resources created within the Resource group will be removed from the Resource group. This is useful for testing purposes or to manage cost. During recovery, the required Azure® resource will be created. If the Delete infrastructure after verification check box is not selected, resources created by the Verify Settings will remain and will be used for future verifications and recoveries.

    NOTE: If unused resources are not deleted, this may incur additional cost for your tenant.

15. In the Virtual machine Settings section, configure the following settings:

    • Virtual machine name: Type a name for the virtual machine or use the {DnsName} template.

    • Overwrite the VM if exists: Select this check box if you want the new VM to overwrite an existing one with the same name.

    • Delete VM after verification: Select this check box to delete the virtual machine after the Verify Settings process is complete. This is useful for testing purposes or if the machine is expected to be unused and to manage cost. The check box is automatically selected when the Delete infrastructure after verification is selected. If a recovery process is started, the machine is recreated.

    • Virtual machine size: Select the instance type for the virtual machine size that you want based on the number of CPUs and amount of memory. A full list of all available instance types is provided for selection.

    • Auto select virtual machine size: Select this check box to have the virtual machine size automatically selected based on the original domain controller configuration. When automatically selecting the virtual machine size, Recovery Manager for Active Directory uses the Microsoft Azure® Virtual Machine D-series for general purpose computing. The number of cores is then read from the backup and the closest match found. For cost efficiency the smallest available memory size is selected.

    • Storage type: Select the storage type. This affects performance.

    • Disk size: Select Use Original Sizes for the disk size to be determined by the size of the Active Directory data size (DIT, LOGS, SYSVOL) in the back up. Select Set Size to customize the size of the disk for the virtual machine.

    NOTE: The disk will have a minimum size (128 GB for an operating system disk and 8 GB for a data disk). If the selected disk size is not large enough for the restored data, the system will use the required size and this setting will be ignored.

16. Click Apply then click OK.

A service principal containing the settings you configured is created for the connection to Azure®.

To start recovery of Active Directory to Microsoft Azure® virtual machines

1. Click Verify Settings to start the project verification. During verification, resources will be created in Microsoft Azure® based on the infrastructure template assigned to the Domain controller(s) in the project.

2. After Verify Settings has successfully completed, click Start Recovery.

During recovery, the Active Directory backups of the domain controllers defined in the recovery project will be restored to newly created virtual machines in Microsoft Azure®.

Bare metal forest recovery

Active Directory® failure, which includes corrupted, completely lost, or unbootable domain controllers, is something that scares any administrator. There can be a lot of reasons for the loss of valuable data. It can be caused by any error, a virus, or a natural disaster. With our disaster recovery plan, you get an insurance policy for your business information.

This section contains recommendations for recovering an Active Directory® forest if forest-wide failure renders all domain controllers (DCs) in the forest incapable of functioning normally.

• Bare metal recovery requirements and limitations

• Preparing backups

• Secure Storage Server

• Restoring from standard Active Directory backup

• NIC teaming support

• Disaster recovery workflow

• Boot from the ISO image automatically

• Creating a virtual test environment using Disaster Recovery Edition