How to Backup/Restore a Windows 2003 Domain Controller

How to Backup/Restore a Windows 2003 Domain Controller 

 
 
Posted by General Zod in Microsoft, Tech.
trackback A couple years back, I was working for a rather large company with hundreds of sites in about 50 different countries that were all linked by a single global network… except for 4 or 5 data center sites that were called “solution centers”.  I worked at one of these special sites.  The purpose of the solution centers was to house whatever services a customer company required us to while keeping it separate for our company’s global network.  As we were not part of the global network, we were considered the black sheep of the company… and I was the lone systems engineer responsible for keeping the servers at my site running.  No bother… I do my best work when I’m left to my own devices.
However, this did present many additional complications that others in my company did not have to contend with.  The largest challenge to overcome was our site’s disaster recovery plan.  We could not just assume to relocate to a new site because we would need to recover our own environment, which included our own domain.
Yes, I know… I could have just housed one of our domain controllers at another location and established a special VPN just for the communications between the DC’s.  That would be a valid solution, but just not good enough.  During a DR event, that would place me very dependent upon the IT staff at that other location… and call me crazy, but I want to be able to ensure that I would be able to perform the recovery 100% without the assistance of anyone else.
I spent a lot of time reading over Microsoft white papers and procedures written by various individuals, throwing ideas around with colleagues, and plucking away at ideas in an attempt to develop a procedure that would fulfill our needs.  Eventually, I developed the procedure that you’ll read below… and tested it successfully on several occasions.  Knowing that someone else out there is probably looking for the same thing, I figured it would be grand to share it with you.

How to Backup the Domain Controller(s)

Obviously, before you can restore your domain, you have to back it up first.  :)
Mainly what we’re interested in backing up is the System State of a Domain Controller.  So what is the System State?

The System State of your server includes the Registry, the Boot files, some System files, the Active Directory service, and other components.  (Read more about it here.)  You can not pick and choose between which components are backed up during a System State backup.  It’s an all or nothing situation.
Since this includes the whole of your Registry, you have to understand that this includes the information about the original System’s installed hardware.  This may complicate the restore process somewhat.  If you backed the System State from DC on an HP Proliant DL380 G5 series server… and attempt to restore it on a Dell PowerEdge T100… you will most likely have issues with booting up the OS afterwards because the hardware set is significantly different.
As part of your DR plan, I recommend making a point of documenting the hostname, IP address, Operating System, Service Pack level, and the hardware make/model of each of your domain controllers.  You may find this information useful when the time comes.

These instructions are going to use the hostname "DC123" as name of the domain controller, and assume that you want to run your System State backup every day at 3:00am.
Login to your domain controller, and perform the following steps:

1. Create a C:\Backup\ folder.
2. Click Start — All Programs — Accessories — System Tools — Backup.
3. Click [Next] — Select Backup Files and Settings — [Next].
4. Select Let me choose what to back up — [Next].
5. Expand My Computer — Check System State — [Next].
6. Set the location of the backup file to C:\Backup\ folder.
   Set the Name of the Backup to “DC123 System State”.
7. Click [Next] — [Advanced] — Select Normal — [Next].
8. Check the Verify Data after Backup box — [Next].
9. Select Replace the existing backups — [Next].
10. Select Later — Set the Job Name to “DC123 System State”.
11. Click [Set Schedule] — Schedule the job to run Daily at 3:00am.
12. Click [OK] — Enter a set of user credentials — [OK].
13. Click [Next] — Enter a set of the user credentials — [OK] — [OK] — [Finish].

The actual backup job itself will probably take somewhere between 15 – 30 minutes to run.  Then, you can backup the C:\Backup\ folder to tape.  Personally, I had preferred to schedule another task that would launch at 4:00am to “robocopy” (which can be found as part of the Windows Server 2003 Resource Kit Tools download) each of the backup files to another server where they were all dumped to tape a few hours later.
You only really need to backup 1 domain controller for this to work, but then your pretty much locked into a single hardware set when it comes time to do the restore.  Since I was never sure what kind of hardware I would have available to me when it came time to do the restores, I tried to make a practice of housing each domain controller on a different model of server… and backing each of them up individually.  Each backup ran me somewhere between 600 – 800 MB of disk space (which is rather a small pittance by today’s standards).

Yes, this was probably a significant amount of overkill on my part.  However, I find that the more paranoid you are, the better prepared you tend to find yourself.  And I tend to be rather paranoid about things like DR.

How to Restore the Domain Controller(s)

Now let’s pretend that a disaster has struck!
You’ve retrieved your tapes from off-site storage and acquired your target hardware, so let’s get to work!  (Remember that matching the hardware to the DC restore would be best, but you can make substitutions.  It’s not an exact science, so some experimentation may be required.)

Note:  These instructions are written with a few assumptions in mind.

1. We assume that your entire domain has been leveled by some catastrophic event.
2. We assume that your domain controllers are running a Windows 2003 operating system.
3. We assume that whomever is doing the work knows the login credentials (from the original domain) to the domain’s Administrator account or a user account that is a member of both the domain’s "Domain Admins" and "Schema Admins" groups.

1. Build a stand-alone Windows 2003 server, and bring it up to the same Service Pack level as the original DC.
2. Name the server with the same hostname as your original DC.
3. Restore your System State backup files from tape, and copy them to the new server’s local hard disk.
4. Reboot the server.
5. After POST, hit [F8] and select to boot into “Directory Services Restore Mode (Windows domain controllers only)”.
6. Click Start — All Programs — Accessories — System Tools — Backup.
7. Click [Next] — Select Restore files and settings — [Next] — Browse to the location of the backup file — [Next].
8. Expand File – System State Backup — Check the System State box — [Next].
9. Click [Advanced] — Select Original Location — [Next] — [OK] — Select Leave existing files (Recommended) — [Next].
10. Check the boxes for: *  Restore Security Settings
    *  Restore junction points, but not the folder and file data
    *  Preserve existing volume mount points
    *  When restoring replicated data sets, mark the restored data as the primary data for all replicas
11. Click [Next] — [Finish].
12. After the restore is completed, click [Close] — [Yes] to reboot the system.

If your server hardware is significantly different from the original DC, then you may experience difficulty with the boot to the GUI.  If this is the case, then you might be able to still recover the OS by booting into Safe Mode or by booting to an original Windows 2003 OS CD to perform a Repair.

Once you get into the GUI, you will need to login using the local Administrator password from the original DC.
Now you will be able to seize the FSMO roles.  (Note:  After each "seize" command, click [Yes] and allow 3-5 minutes for the task to complete.)

1. Click Start — Run — NTDSUTIL — [OK].
2. Type the following commands into NTDSUTIL. roles
   connections
   connect to server DC123
   q
   seize domain naming master
   seize infrastructure master
   seize PDC
   seize RID master
   seize schema master
   q
   q

Next, confirm that your DC is a Global Catalog server.

1. Launch AD Sites and Services
   (C:\Windows\System32\dssite.msc)
2. Expand Sites – Default-First-Site-Name – Servers – DC123.
3. Right-click and select NTDS Settings — On the General tab, verify that the Global Catalog box is checked.
4. Perform a clean reboot of the system.

Now we’ll clean the old domain controllers out of the AD database.

1. Click Start — Run — NTDSUTIL — [OK].
2. Type the following commands into NTDSUTIL. metadata
   cleanup connections
   connect to server DC123
   quit
   select operation target
   list domains
   select domain <#>
   list sites
   select site <#>
   list servers in site
   select server <# of bad DC>
   quit
   remove selected server
   quit
3. Launch Active Directory Sites and Services(C:\Windows\System32\dssite.msc).
4. Expand Sites – Default-First-Site-Name – Servers.
5. Right-click on — Select Delete.
6. Launch Active Directory Users and Computers (C:\Windows\System32\dsa.msc).
7. Expand the domain — Open the Domain Controllers container.
8. Right-click on — Select Delete.
9. Select The domain controller is permanently offline and can no longer be demoted using Active Directory Installation Wizard (DCPROMO).
10. Click [Delete] — [Yes] to confirm.

Your domain should now be successfully restored, but don’t consider yourself finished at this point.  This restored server should be considered hinky at best, and should not be kept as a long-term solution.
Before doing anything else, I recommend that you build a 2nd “clean” domain controller alongside this restored 1st DC.  Then, transfer the FSMO roles to the 2nd DC.  Finally, demote the 1st DC to a member server and retire it from the domain.  That will hopefully ensure that your domain is running on a clean and stable DC that you can rely upon.  Then, build a new 2nd DC to ensure some redundancy.
Congratulations!  Your domain is restored.  Now get to work on restoring everything else.  :)