What options to backup or to put into the roll back plan when the Exchange /prepareAD gone bad ?

Hi Folks,

Can anyone here please suggest me what are my options to perform backup or restore before performing Exchange Server AD Schema modification?

because when you perform Exchange Server SP3 upgrade, there is AD schema extension involved and I'm not sure what to backup or restore suppose it is gone bad ?

I got two Domain Controllers within the same AD Site with the Exchange Servers that are Virtual, creating VMware snapshot is not the way to go since it is not a supported environment.

LVL 11
Senior IT System EngineerSenior Systems EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Backup ALL your DCs and Exchange Servers at the same time before the change.
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
OK so there is no possible way to backup only the DC database only ?
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Why not just backup the entire VM ?
Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

It is super rare these days that these schema updates would fail and cause an issue (was more something you worried about way back). That said, Microsoft have a blog on how to prepare for, apply and back out of a schema update. See the blog article here:


Basically you just disable outbound replication + nic and if anything goes wrong seize the roles and metadata cleanup the failed DC. If successful re-enable outbound replication + nic and allow full forest replication to occur.

That said, the fact you're asking these questions during a schema upgrade means you should also be asking yourself what would you do if you had a massive failure now without an update. What is your backup solution? Do you have a recovery document you can follow? Have you taken a backup and done a POC and then test of this procedure off the network? Do all of this. Once you're comfortable coming back from a disaster with AD its all easy enough. There are also excellent applications like Dell's Quest Recovery Manager Forest Edition for recovery which make things quite easy but are very expensive.

Last point: always have backups.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
Thanks all for the reply.

No I do not have test environment in my company.

So basically just disable the vNIC on the VM and then enable it once it is completed successfully ?

Cool that sounds simple :-)
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
You should always have a FULL BACKUP before any production changes!

and no test environment, shame on you!

Clearly no ITIL Best Practices here!
Gareth GudgerSolution ArchitectCommented:
I am assuming you are disabling the vNIC so the schema updates don't replicate throughout the domain?

If so, you will need to make sure you are running those schema updates from the DC holding the Schema Master role. That DC also needs to be 64 bit to run those commands.
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
Yes it is that way as you described.

So once the scheme update successfully work, I can then remove the VM snapshot and reconnect the vNIC after reboot.
Gareth GudgerSolution ArchitectCommented:
Sounds good to me. Although Andrew is the VMware "Jedi" master.
Senior IT System EngineerSenior Systems EngineerAuthor Commented:
I'm just the apprentice I this case hence I ask this question :-)

In terms of supportability, is this a supported practice ?

Because from memory taking  snapshot is not a supported action.
Microsoft won't probably officially support a snapshot rollback on Server 2008 R2 officially but would provide best effort support. They will support a snapshot rollback for server 2012 DC's + VMware with compatability for snapping back (see http://technet.microsoft.com/en-us/library/hh831734.aspx). They would try their best to help though it might cost you :)

In your case though if you are following the Microsoft method (http://blogs.technet.com/b/samdrey/archive/2011/09/13/exchange-2010-sp1-general-schema-upgrade-procedure-with-back-out-plan.aspx) where by you disable the NIC and disable outbound replication; if anything goes wrong just seize the FSMO roles from that server and remove it from the domain rather than rolling back the snapshot. For you the only reason to revert a snapshot would be a complete domain failure and in that case seeing as you're running server 2008 DC's I would be rolling back a single domain controller and rebuilding your entire domain from that single domain controller as the source of truth. None of the other domain controllers could be trusted with a rollback of their snapshots (USN issues).

For removing a failed DC (or just a DC you don't want back on the domain): http://www.petri.com/delete_failed_dcs_from_ad.htm

For seizing FSMO roles: http://www.petri.com/seizing_fsmo_roles.htm (can also be done from the GUI).
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
The problem with Snapshots, when a VM is running on a snapshot (difference disk) performance is poor.

We would much rather have good backups in place of the environment, before any changes are made, also as this is Exchange we would also stop the Exchange Services (or at least stop any mail Entering the Mail Server).

So in the event of a rollback situation, you can restore all the DCs and Mail Servers, with out effecting any loss of mail.

Again, no matter what change, or service, you should have a Rollback plan, and Full Backups before any chance is completed.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.