On-prem AD backup to Azure Backup

Question

Hello Azure Experts,

We are planning to backup the AD server to Azure using the recovery service key vault.
We have Many DCs in place at respective locations. We just want to take the only backup where FSMO roles are installed.
It is a physical server(let's call it "PDC").

We have installed Microsoft Azure backup agent in the PDC server and configured the system state backup to azure every day.

My question is, Consider if an attacker compromised On-prem DC servers including PDC and we have lost access to all the DCS.

Now we only have the system state backup in azure, can we restore that backup in any new server, and can we up all AD services back to normal ??

Please suggest if there are any alternative solutions.

Regards,
Ram

Answer 1

System State backups are intended to be restored on the same hardware. You can restore them on different hardware but there are risk of drivers issues that can make the entire thing a bit challenging. But nowadays with virtualization, the emulated hardware is easy to match so it is not often an issue...

I would suggest to have more than one DC backed up. It's okay if they are not FSMO holder as you can seize the role during a recovery.
I would also strongly recommend you test your backups in a lab environment (disconnect from your production environment) then you will be able to vouch for your backup, train on the recovery steps, and evaluate how long a recovery could be.

On another note, you can also use a bare metal backup (BMR). You could either backup the BMR in Azure Recovery Vault as files, or use Azure Backup Server to do directly BMR to the vault: https://learn.microsoft.com/en-us/azure/backup/backup-mabs-system-state-and-bmr

If you have DCs as VM in Azure, you can do BMR without having to deploy Azure Backup Server, so it make the backup and the recovery much easier.