I am in a lab environment practicing and learning to recover my primary domain controller in the event that both my DC's are gone and I have a full server backup in place for disaster recovery

in production I have 2 domains DC1 and DC2, DC1 is the FSMO holder for all roles and also hosts the DHCP server.

DC2 roles include ADDS and DNS both are GC servers

I created a VM with similar matching hardware to DC1 on a isolated network and then ran through the process of restoring the machine from the full server backup , this completed and the machine booted.

I seized the FSMO (they are already assigned on the backup but seems to be playing up so I went through the seizing process) and then proceed to do a metadata cleanup of DC2 (since its not around in this testing area)

started the required services DNS ect and everything seems to be going well so far.

when I run DCDIAG I get passed test for everything bar Netlogons & a few errors in the SystemLog relating to group policy

my error is a common one but the solutions I have tried have't worked for me ( setting the SysVolReady Flag to 0 then to 1)

the error is "unable to connect to the Netlogon share! <\DC1\netlogon>

[DC1] An net use of LSAPollicy operation failed with error 67 the network name cannot be found.

I am still quite new to the domain controller scene could anyone give me a little more information on what this is and a possible alternative solution?

as it stands I have a restored DC1 hosting ADDS, DNS, DHCP and all 5 FSMO roles

  • What's a "D1"? What does "seems to be playing up" mean exactly? Seizing is an act of last desperation and tends to not end well, especially if you're doing it for completely wrong reasons. Why are you messing with DC2's metadata if it's not in the testing area anyway - this is asking for even more trouble. Was the DNS service not starting on it's own? – Chris S Aug 12 '14 at 14:20
  • +1 because you are testing your backup strategy. – duenni Aug 12 '14 at 14:29
  • this is for Forest recovery procedure ie "recommendations for recovering an Active Directory® forest if forest-wide failure renders all domain controllers in the forest incapable of functioning normally" so if a full server backup is made of DC1 (that is the holder of the FSMO roles) then this backup is restored to a new machine (in the event of a forest recovery being implemented) do i not need to seize the roles? – GordonBpdZenith Aug 12 '14 at 14:47

As this stands now I'd throw away whatever VM you're working with and start over. First, it sounds like you have a physical DC1 and are restoring it to a VM, don't do that. If your intention is to restore to a VM, start with a VM, and backup the VM configuration so that when you restore it's actually an exact copy and not "similar matching". If you have to use a physical DC then test restoring to a physical box as well.

I'm not even going to address the other problems as they almost certainly caused by the way your doing this backup and restore, nothing to do with the way Domain Controllers work when doing a proper backup and restore. I've restored DCs a number of times, I never had any of the issues you're having.

| improve this answer | |
  • sounds like a plan ill build my own DC set up some users ect and settings > backup said server then run a full restore to get a more accurate test then, perhaps i have phrased it incorrectly but i am also wanting to try and test out if say the original hardware was not available to use in the event of a disaster according to Microsoft a full system backup can be used to restore different hardware can it not? not fully supported but it would be my only option if a "disaster" were to happen" – GordonBpdZenith Aug 12 '14 at 14:36
  • and can you point me to where it says you cant use a full system backup to restore a DC to a VM for a forest recovery so i can review the process and better understand it? that would be helpful. – GordonBpdZenith Aug 12 '14 at 14:42
  • I didn't say you couldn't restore to a VM - but if you want to restore to a VM I would highly suggest starting with a VM to avoid the multitude of problems you're encountering now. You're going to have to be realistic. If you're running this baremetal, be prepared to replace that hardware - this should not be a question, your DC's hardware should be warrantied and replaceable. If you should ever be in a forest recovery situation you do not want to be hacking about with different hardware and introducing even more issues into an already challenging situation. – Chris S Aug 12 '14 at 14:53
  • just to expand on this in the event of a real disaster that required a forest recovery i wouldn't be restoring the DC's as VM's they would be put onto hardware, this instance was merely to test the process so i can better understand the steps, prepare for potential errors and document the process for future reference, at your advice i will try and dig out some old hardware and run the restore to physical hardware rather than a VM hosted on a ESXI if you think that will give better results – GordonBpdZenith Aug 12 '14 at 15:19
  • Right, I've never had any of the problems you're encountering when restoring a DC to the same hardware or to the same VM configuration. I've done DC restores both in testing and in small shops who's one server crapped out. I've also done a number of P2V and V2V conversions of non-DC server, had plenty of minor issues - enough that I wouldn't try converting a DC. Also, MS's Best Practices for AD Backup and Restore has a section that starts "It is possible to restore a domain controller onto different hardware. However..." (emphasis mine) – Chris S Aug 12 '14 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.