Chat now with support
Chat with Support

Recovery Manager for AD Disaster Recovery Edition 10.0.1 - User Guide

Overview Backing up data
Permissions required for the Backup operation Managing Backup Agent Using a least-privileged user account to back up data Creating backups Retrying backup creation Enabling backup encryption Backing up AD LDS (ADAM) Backing up cross-domain group membership Backing up distributed file system (DFS) data Backup scheduling Setting performance options Setting advanced backup options Using Forest Recovery Agent Unpacking backups Using e-mail notification Viewing backup creation results Getting started
Permissions required to use Recovery Manager for Active Directory Recovery Manager Console Icons in the user interface Getting and using help Configuring Windows Firewall Using Computer Collections Managing Recovery Manager for Active Directory configuration Licensing
Restoring data
Getting started with Active Directory recovery Managing deleted or recycled objects Restoring backed up System State components Using granular online restore Restoring AD LDS (ADAM) Selectively restoring Active Directory object attributes Restoring objects in an application directory partition Restoring object quotas Restoring cross-domain group membership Performing a restore without having administrator privileges Reports about objects and operations Using complete offline restore Offline restore implications Restoring SYSVOL authoritatively Performing a granular restore of SYSVOL Recovering Group Policy Restoring data from third-party backups Using the Extract Wizard Restoring passwords and SID history
Fault tolerance Consolidating backup registration data Monitoring Recovery Manager for Active Directory Recovering an Active Directory forest
Permissions required to use Forest Recovery Console Forest Recovery Console Managing a recovery project Install Active Directory from Media recovery method Install Active Directory recovery method Managing Forest Recovery Agent Rebooting domain controllers manually Specifying fallback IP addresses to access a domain controller Resetting DSRM Administrator Password Purging Kerberos Tickets Managing the Global Catalog servers Managing FSMO roles Manage DNS Client Settings Configuring Windows Firewall Forest recovery overview Selectively recovering domains in a forest Recovering SYSVOL Deleting domains during recovery Resuming an interrupted forest recovery Recovering read-only domain controllers (RODCs) Checking forest health Collecting diagnostic data for technical support
Bare metal forest recovery Using Management Shell Creating virtual test environments Using Recovery Manager for Active Directory web interface Appendices
Frequently asked questions Best practices for creating backups for forest recovery Best practices for recovering a forest Descriptions of recovery or verification steps Backup Wizard Online Restore Wizard Online Restore Wizard for AD LDS (ADAM) Group Policy Restore Wizard Repair Wizard Extract Wizard Events generated by Recovery Manager for Active Directory

Filtering the list of domain controllers

To filter domain controllers in the list

  1. In the list of domain controllers, point to the heading of the column by which you want to filter the domain controllers.
  2. Click the down arrow next to the column heading, and specify you filter criteria.

Connecting to a domain controller via RDP

To connect to a domain controller via RDP

  1. In the list of domain controllers, right-click the domain coat domain controller to which you want to connect.
  2. Click Connect via RDP on the shortcut menu.

Domain controller recovery settings and progress

For a diagram that illustrates the Forest Recovery Console elements, see Forest Recovery Console.

The Domain Controller Recovery Settings and Progress area has the Settings tab, the Progress tab, the Events tab, and a toolbar providing commands for managing the recovery of the domain controllers selected in the list.

In this section:

Settings tab

You can use this tab to specify recovery settings for one or more domain controllers selected in the list.

TIP: To specify recovery settings for multiple domain controllers at a time:

  1. Hold down CTRL, and then click to select domain controllers in the list of domain controllers.
  2. Use the Settings tab to specify recovery settings for the selected domain controllers.

The "Domain Controller Recovery Settings and Progress" area also provides the following commands for managing the recovery of domain controllers:

Table 19: Recovery-related commands

Command Description
Pause Next Operation Suspends the next operation performed during the current session on the selected domain controllers.
Resume Operation Resumes the suspended operation on the selected domain controllers.
Retry All Operations Retries all operations for the selected domain controllers. Before retrying all operations, you may specify a different recovery method for the domain controllers.
Retry Last Operation Retries the last operation performed during the current session on the selected domain controllers.
Skip and Continue Skips the error encountered for the selected domain controllers.
Abort Cancels the recovery or verify settings operation for the domain controllers selected in the list.

The Settings tab has the following areas:

  • Recovery method. Allows you to choose one of the following recovery methods for the domain controller selected in the list:

Table 20: Recovery Method

Recovery Method Description
Restore Active Directory from backup

Restores the domain controller from the backup you specify. For more information on backup selection methods, see Selecting backups for recovery.

During recovery, Recovery Manager for Active Directory Disaster Recovery Edition uses custom Internet Protocol security (IPSec) rules to isolate the domain controllers for which you selected this recovery method. For more information, see How does Recovery Manager for Active Directory Disaster Recovery Edition isolate domain controllers during forest recovery?

Bare Metal Active Directory Recovery

The recovery process follows Microsoft best practices by using the native recovery methods:

  • Recovery from BMR backup (Bare Metal Restore)
  • (Optional) Restore Active Directory and Registry data from RMAD backup to bring Active Directory to the latest state

For details, see Bare metal forest recovery.

Install Active Directory from Media

The selected servers will be promoted to Domain Controllers using Install from Media (IFM) option.

Note: Operating system version should be equal to the original DC operating system.

For details, see Install Active Directory from Media recovery method.

Restore SYSVOL

Restores contents of the SYSVOL share on the specified domain controllers. Read-only domain controllers (RODC) will be restored as well.

This method can be set only on the Recovery Mode tab of Recovery Project Settings. For details, see Recovering SYSVOL.

Install Active Directory

Installs Active Directory by using Microsoft’s native tools.

For domain controllers running Windows Server 2008 or earlier, this step uses the Dcpromo.exe tool.

For Windows Server 2012-based domain controllers, this step uses the native Windows PowerShell cmdlets Install- ADDSDomainController.

For details, see Install Active Directory recovery method.

Reinstall Active Directory

Uninstalls Active Directory and then installs it again by using Microsoft’s native tools.

For domain controllers running Windows Server 2008 or earlier, this step uses the Dcpromo.exe tool.

For Windows Server 2012-based domain controllers, this step uses the native Windows PowerShell cmdlets Install- ADDSDomainController and Uninstall-ADDSDomainController.

After the Active Directory reinstallation is complete, the domain controller replicates Active Directory data from other domain controllers that were restored from backups in the recovery project.

Note: The Reinstall Active Directory recovery method removes the global catalog by default if it is present on the domain controller being recovered. If you need to reconfigure the global catalog on the domain controller during Active Directory reinstallation, select the Configure the domain controller as a global catalog server option in the Additional Settings section.

Uninstall Active Directory

Performs a forced removal of Active Directory from the domain controller and then demotes it to a member server in the domain. Domain controller’s metadata is completely removed from Active Directory.

Note: When you use this method, the local Administrator password on the target domain controller is reset to the value you specify in the Set DSRM password and Confirm DSRM password text boxes in the Forest Recovery Console.

Adjust to Active Directory changes

This recovery method is available and selected automatically when the domain controller is a Global Catalog server and belongs to the excluded domain, and either .Rebuild GC, advertise normally or Rebuild GC, advertise fast is checked on the Global Catalog tab of the project settings

How the Adjust to Active Directory changes method works:

  1. The agent removes lingering objects, if any, using the Repadmin tool.
  2. If the previous step fails, the agent performs unhost and rehost operations using the Repadmin tool.
  3. Only if both previous steps fails, the agent rebuilds Global Catalog on this domain without attempts to remove lingering objects. In case of full reset of Global Catalog, the replication of Global Catalog data may require additional time.
Do not recover Isolates the domain controller from other domain controllers and completely removes it from the domain - no actions are performed on the domain controller itself. This option is used if the domain controller is inaccessible or you do not want to recover the domain controller due to any failures. Recovery Manager for Active Directory Disaster Recovery Edition removes all metadata of domain controllers that were not recovered from the Active Directory forest.
  • Computer Access. Allows you to specify the user name and password that will be used by Recovery Manager for Active Directory Disaster Recovery Edition to access domain controllers in the domain.

This area has the following text boxes:

Table 21: Text boxes in the Computer Access area

Element Description

Target machine

*Only for the Install Active Directory From Media and Install Active Directory methods.

 Using this option you can specify the IP address for the target machine where Active Directory will be installed.
Use Default Domain Access Credentials

This option lets you use the default domain credentials to access domain controllers. To configure the default domain access credentials, select the option and press the view link that opens Recovery Project Settings. For more details, see Specifying recovery project settings.

If the option is not selected, you can specify domain access credentials and DSRM password in the Domain Controller Access section. Otherwise, the Domain Controller Access section is not active.

  • User name
  • User password

Allows you to specify the user name and password with which Recovery Manager for Active Directory Disaster Recovery Edition will perform the following operations:

  • install, upgrade and check the Forest Recovery Agent
  • purge Kerberos tickets
  • manage FSMO roles
  • manage DNS client settings
  • manage Global Catalog servers
  • check forest health

These credentials are not used to access domain controllers during the project verification and forest recovery. Forest Recovery Agent uses RPC over SSL for communication. To get more details, see Managing Forest Recovery Agent.

CAUTION: The password for the specified account will be reset to the value specified in the project during the restore process. Make sure that the specified account existed in Active Directory at the time of the creation of the selected backup - the backup can be selected by a user or by the specified backup criteria. Otherwise, the password will not be reset.

DSRM administrator Allows you to specify the user name with which you want Recovery Manager for Active Directory Disaster Recovery Edition to access the selected domain controllers in Directory Services Restore Mode (DSRM).
  • Set DSRM password
  • Confirm DSRM password

Allows you to specify the DSRM password to be used by Recovery Manager for Active Directory Disaster Recovery Edition during the domain controller (DC) recovery.

When using these boxes, consider the current mode of the DC:

  • If the DC is already in DSRM mode. Use these boxes to specify the password of the account you entered in the DSRM administrator text box. Otherwise, the DC recovery will fail. This password will be set after recovery.
  • If the DC is not in DSRM mode. Use these boxes to set a DSRM password for the account you entered in the DSRM administrator text box. Recovery Manager for Active Directory Disaster Recovery Edition will use this DSRM password to restart the domain controller in DSRM during the recovery.

Target server network settings

  • IP Address
  • Subnet mask
  • Default gateway
  • DNS Server

*Only for the Bare Metal Active Directory Recovery method

Allows you to specify network settings applied to the recovered machine.
The network and DNS settings will be retrieved automatically from the BMR backup for the Bare Metal Active Directory Recovery method. If you need to edit the settings, click Change and specify the following options:

  • Retrieve network and DNS settings from a backup (used by default)
    This option gets network settings for the selected domain controller from the backup
  • Use the following address
    This option lets you specify network settings manually.
  • Select a DNS server automatically
    If this option is selected, DNS server will be selected automatically.
  • Use the specified DNS server
    This option lets you specify one DNS server or a list of DNS servers separated by semicolons.

NAT settings

*Only for the Bare Metal Active Directory Recovery method

This option lets you access recovered domain controllers that are located outside the network where Recovery Manager for Active Directory Disaster Recovery Edition is installed.
  • Additional Settings
    This area has the following options:
    • Install the domain controller as a read only.
      Use this option to install Read-Only Domain Controller (RODC).
    • Configure the domain controller as a global catalog server
      Use this option if you need to reconfigure the global catalog on the domain controller during Active Directory reinstallation.
    • Preffered DNS server
      Allows you specify a a preferred DNS server for the domain controller during its recovery. For more information, see Assigning a preferred DNS server during recovery.

Table 22: Elements in the Backup, Access Credentials and Install Active Directory parameters areas

Element Description
Use backup criteria to automatically select a backup file Allows you to automatically select a backup file that meets particular criteria. To specify your criteria, click the Backup Criteria button on the toolbar.
Backup Displays the path and name of the currently selected backup file from which the domain controller will be restored. To manually select a backup file, make sure the Use backup criteria to automatically select a backup file check box is cleared, and then click the Select button.
Backup password Allows you to type the password to open a password-protected backup.
Temporary backup folder Here you can specify the folder on the domain controller to store temporary forest backup data.
Access Credentials
  • Allows you to enter the user name and password with which you want to access the location that holds the backup specified in the Backup file box. The account you specify must have Read access to that location.
  • For BMR backups, the account you specify must have Read and Write access to that location.
    • Wipe all disks on the target machine before restore from the backup

    *Only for the Bare Metal Active Directory Recovery method

    If this option is selected, Recovery Manager for Active Directory performs the DiskPart "clean all" command before recreating the disks. This command removes all partitions and cleans all disk sectors.

    The "Wipe all disks..." operation significantly increases the time of the restore process.

    Restore from System State Backup

    *Only for the Bare Metal Active Directory Recovery method.

    		 This option allows you to restore the latest Active Directory/Registry data from the System State backup.
    Recovery Media Image

    *Only for the Bare Metal Active Directory Recovery method.

    		 Specifies the location of the Quest Recovery Media image file.

    Add third-party drivers

    *Only for the Install Active Directory From Media and Install Active Directory methods.

    		This option allows you to create the Quest Recovery Environment image supporting custom network cards and custom disks.

    Driver packages path

    *Only for the Install Active Directory From Media and Install Active Directory methods.

    		Specifies the location of driver packages.

    Add third-party drivers from bare Metal Backups

    *Only for the Install Active Directory From Media and Install Active Directory methods.

    		Adds third-party drivers from Bare Metal Recovery backup.
    DIT database path

    *Only for the Install Active Directory From Media and Install Active Directory methods.

    		 Specifies the location of the DIT database.

    Log files path

    *Only for the Install Active Directory From Media and Install Active Directory methods.

    		Specifies the location of Log files.

    SYSVOL path

    *Only for the Install Active Directory From Media and Install Active Directory methods.

    		 Specifies the location of SYSVOL.
    Related Documents