Recovering Active Directory domain to isolated network for test purpose

Question

Recovering Active Directory domain to isolated network for test purpose

Sabir Mohamed 41

We are planning to do a restore drill to an isolated network. This will consist of AD restoration, DNS, and other critical apps restoring to this environment from the respective backup. AD restoration plan is to restore from snapshot veeam backup of existing 2 VM DCs out of the total 8 DCs. So, we aren't restoring all DCs but only these 2, to provide AD services to this isolated network. Please advise a best-suited plan for this kind of restore and verification points to make sure everything restored as required.

1 answer

Your answer

Answer 1

Anonymous

Hi,
Based on my understanding , you want to create a domain environment for just for test ,right?
First of all, please note that : Do not use the Snapshot feature as a backup to restore a virtual machine that was configured as a domain controller.
Then， If you need to restore Active Directory to different hardware, create full server backups and plan to perform a full server recovery.

Perform a full server restore in order to restore the operating system and all files and applications.
Perform a system state restore using wbadmin.exe in order to mark SYSVOL as authoritative.
For how to choose the restore DC, you can refer to:

More information about the :Recover the forest in isolation, you can refer to:
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-determine-how-to-recover

Best Regards,

Sabir Mohamed 41 Reputation points

2021-03-23T11:03:42.67+00:00

Hi Team,
Thanks for your reply.
Yes, we are doing it for the test. The isolated setup will be with few critical applications too, which also need to AD to authenticate the same way in production.

We are planning 2 DCs (out of 8) to restore in isolated environment. Both are virtual machines. These dont have FSMO roles right now, which we are planning to seize to one of the DC. All DCs are writeable.
The backup using to restore is latest which was done with veeam. This is an advanced kind of veeam full system backup, with which even we can do a granular restore of user, computer objects.
DNS is already moved to Infoblox and the same setup already restored to the isolated network.
BitLocker is not used in any of the systems.

So, I think, we are good to proceed with th restoration. Do we need to check anything else.
Is there any need of cleanup of DCs which we aren;t restoring.
Any other fine tuning to avail all the resources like sysvol, netlogon, replication etc
Anonymous

2021-03-24T03:19:55.237+00:00

Hi,
Yes, go ahead to the restore by referring to steps:
More information about the :Recover the forest in isolation, you can refer to:
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-determine-how-to-recover

Best Regards,

Share via

Recovering Active Directory domain to isolated network for test purpose

1 answer

Your answer