Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a requirement where I have a virtual domain controller and I have to migrate it to another virtual server in a different location. It is for test purposes to test out a DR scenario and the test will be deemed successful if the users that authenticate using the production DC can do so in the backup DC. I don't know much about this and thus don't know why it was assigned to me. So any assistance will be greatly appreciated. What I had in mind was:

  • To take a snapshot of the production server and then restoring it in the other server. But I was told that this is not the suggested way of doing it. I was not told why. Is that right? If a snapshot is to be taken then what is the best way to do it. Any ideas on where I can get the documentation for this?
  • Another way would be to build the test DC from ground up, match it to the specs of production DC and then perform the DR test. Is this a better option? What will be needed to perform such an activity? Where can I find documentation on that?

I apologise for the length of this query. As I said I am quite a novice and hope to get a better resolution. Any assistance will be greatly appreciated.

share|improve this question
add comment

1 Answer

When it comes to domain controllers: always move, never copy.

  1. Shut down the virtual machine.
  2. Move the disk file (.vmdk or otherwise) to the other virtual server.
  3. Start up virtual machine on new server.

Before you get started, I encourage you to read Microsoft's knowledgebase article: Things to consider when you host Active Directory domain controllers in virtual hosting environments.


With that said, your post raises quite a few red flags. It sounds like your normal duties don't include system administration, so it is very puzzling that you would be assigned an exercise in disaster recovery. This experience would be more useful to somebody who would be responsible when a disaster actually happens.

Are you already a member of the Domain Administrators group on this DC? If not, this could be considered a fairly wide breach of security. It is normally considered a very bad thing for non-administrators to have physical access to a DC. Or in this case, to the hypervisor hosting the DC. For reasons why, see the TechNet blog post on physical security of domain controllers.

Is this DC currently part of a production network that users rely on, or has it been set up exclusively for the purpose of DR testing? Once moved, is it intended to continue participating in the same domain, or will it be isolated? Your comment that the test will be deemed successful if users can authenticate makes it sound like this is all taking place in production networks, which is frankly terrifying.

Assuming that the DC is part of a production network, you will probably need to move it back to the original server that it was originally hosted on. Follow the exact same process, and ensure that you don't leave stale disk images behind that can cause problems if booted up later.

When organizing the movement of a domain controller, and especially when talking about a virtualized domain controller, it is essential to plan carefully and get it right the first time. There is a lot that can go wrong.

If this is outside of your normal duties, and you were provided with no guidance or support, I would suggest inquiring up the chain of command to make sure you should really be doing this.

share|improve this answer
    
Hi Nic thanks for –  Dips Feb 4 '11 at 4:28
    
Hi Nic thanks for your prompt answer and apologies for not responding earlier. I have already tried barking up that tree about how it shouldn't be my problem but its fallen to deaf ears. I have decided to get on with it. After being able to talk to the customer, it is now established that the plan is to take a copy of the existing DC and bring up in DR for the purposes of the DR Test only and he wants to know the best way to do it. I have heard taking a snapshot is not a good idea. The production DC is working now but the one for the DR test is not up and running. Any ideas? –  Dips Feb 8 '11 at 4:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.