Improve company productivity with a Business Account.Sign Up


Domain Controller VHD

Posted on 2013-06-13
Medium Priority
Last Modified: 2013-06-26
Hi experts,
Really quick question I believe.
I have a domain controller virtualized and I was wondering as I do full system backups from within the VM (guest) if I wanted to restore the domain controller do I just create a new vm, insert the 2008 cd, click repair, point to the image and click ok to the restore? Ultimately do I need to set the restore flag in dsrm after the restart or can I go straight into windows without entering safe mode and the other domain controller will automatically pick up the new domain controller and replicate to it?

I've read so many articles and all are so overly complicated.

Question by:dqnet
  • 3
  • 3
LVL 97

Assisted Solution

by:Lee W, MVP
Lee W, MVP earned 400 total points
ID: 39245297
Why would you restore a domain controller when you have a second one?

If you have two DCs, you don't restore, you rebuild (first removing the failed DC from AD).
LVL 10

Accepted Solution

172pilotSteve earned 1600 total points
ID: 39247438
First, I agree with LeeW..  Personally, the ONLY reason I'd restore a DC is if ALL of my DCs had massive replication corruption or data loss due to someone deleting objects from the AD, making it basically useless.  If one DC just goes down, the best and easiest thing to do is just forget the dead one, and reinstall a new DC, and let a good DC replicate the current data to the new DC.  If you've got a virtual server template stored somewhere, you can literally have a new DC installed in a few minutes.

That being said, to answer your specific question, I'll assume that you only have one DC, and so replicating isn't possible, because there's no valid source left to replicate from.  In that case, I'd just do as you imply - Just restore the old DC image or copy/restore the VHD(s) of the DC, and bring up a new DC with the old disks.  That will take you back to that point in time.

Most of the worries you read so much about regarding restoring DCs comes from the fact that each DC keeps track of the latest changes that all of the other DCs have gotten from it, so if "change 1" has been made, then you make a backup, and subsequently "change2" gets made, if you restore a DC that all the other DCs think has gotten "change2", it will never get sent to the DC, and you can have out of sync problems.  If you do not have more than one DC anyway, then you can treat it just as any other virtual server, and restore it pretty much any way you want...

Author Comment

ID: 39255757
Totally understand but it doesnt answer the question as such.
Yes, we do have 2 domain controllers one virtual and one physical but the question here is if the virtulised one goes down we have two backup copies 1. the host backup software backing up the guest and 2. the guest backing itself up using windows server backup 2008

(guest backing being active directory aware) and the host backup only takes a VSS backup and is not active directory aware.

My question is if the vhd gets corrupted or something happens, can I not just create a new VM on the fly and restore the VM from the guest Backup and not the host backup?

(no need for dcpromo, no need for cleaning the domain, no need for setting up DNS, just simply create a VM, put the dvd in, boot from CD and restore the domain controller)?
Is that not much faster? (let alone the question being, do I have to use DSRM after the restore)?
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

LVL 10

Expert Comment

ID: 39258088
Yes, that would be MUCH faster, but you will risk corrupting your domain, because it is likely that any changes made in the domain after the last backup, but before the crash, will have been assumed to already be replicated to the DC (because they were) but now you're putting an old DC image back, with old data.  That's why the recommendation is to not do that....

In that case, it really is better to install a new machine, and never bring back the old DC.  It's really not that much trouble.

I'd still be backing up the DC images, just in case you lose both..  it'd be possible that the virtual backup might someday be your best or ONLY option for restore.

Now that I've written all that, I do find one article that says that there is one supported way (on Server 2008) to backup and restore a DC, and that is to use WIndows Backup on the virtual itself, which kind of negates the advantages you're talking about getting by the fact that it's a virtual.  Here's the article:

There's a section in there specifically titled "Backup and Restore practices to avoid" which details NOT restoring VHDs for the reasons I stated above, but definitely check it out..  It's a better description!!

Good luck, and don't be afraid of the NTDSUTIL needed to force out a DC - It's not bad if you follow the instructions on Microsoft's site if you ever need to do it..  I've done it several times, but I wouldn't ever do it without the instructions handy, just to make sure I'm doing it properly...

Author Comment

ID: 39268952
I read that document a few times but I cant see where exactly it says how to restore from a full vhd backup created by Windows Backup itself. It just says avoid restoring from a VHD copy which is something I already do.

It does explain how to restore using windows backup 2008 but not how to do it when the domain controller is virtulised. The document gets very generic as you progress through it.

Can you make any sense of it?
LVL 10

Expert Comment

ID: 39272108
I think that's the whole key..  The only supported way to restore a domain controller would be if you were using the built-in Windows Server Backup sofrware, which would be ad database version aware.  Because you're talking about restoring a VM, that would be an image backup, restoring to a point in time which has a version of the AD database which is no longer valid, and doing any AD restore in that way is not recommended or supported.

Author Comment

ID: 39277524
I really cant believe how vague the document becomes!

Anyway thanks guys, points split best way I saw fit I guess :)

Featured Post

Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to and use offer code ‘EXPERTS’ to get 10% off your first purchase.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
Native ability to set a user account password via AD GPO was removed because the passwords can be easily decrypted by any authenticated user in the domain. Microsoft recommends LAPS as a replacement and I have written an article that does something …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

606 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question