Active Directory Domain/Forest Functional Level Rollback from 2008r2 to 2003

We're planning to upgrade our AD forest and domain functional levels from 2003 to 2008r2. Management would like a fallback strategy. All of our AD controllers are VMware virtual 2008r2's. What would be your suggested fallback strategy?

We're considering:
1. Shutting down each of our 4 DC's, FSMO role holder last, and taking VMware snapshots of each. To revert, we would take all DC's offline, revert to the snap on all, and boot each of them up.
2. MS System State restores - The domain would be taken offline, each DC would then be restored from a system state backup to its original state.

I'd greatly appreciate your suggestions and ideas!
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
We have recently been doing this, and we found, the more DCs you have, the more difficult the issue, so therefore, we came up with a solution, of just having a single DC kept for backup. (or turning off the DC with all the roles).

In the event of failure start that DC, evict all the other DCs, and rebuild new DCs.
Lee W, MVPTechnology and Business Process AdvisorCommented:
So, first, Raising functional levels is not a problem if you no longer have any 2003 DCs.  While I cannot promise you that some weird configuration on your network won't in some way make this problematic, I will say I've never heard of it causing any problems and I wouldn't hesitate to do it.

Later versions of AD CAN roll back to earlier versions, but NOT back to 2003.

Regarding DC snapshots, it sounds like you're trying to think this out.  IN GENERAL, I would say don't do it.  Until 2012 R2 which supports it.  BUT, if you are METICULOUS about how you do this, and how you restore, you could.  I would take ALL DCs offline first.  No chance that they are replicating with anything else.  THEN and only then take a snapshot of each.  Should you want to restore, repeat procedure - SHUTDOWN ALL DCs first.  Then revert to the previous versions, then turn on.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Lee W, MVPTechnology and Business Process AdvisorCommented:
And Andrew's suggestion is the alternate way of doing it that I'd concur with.
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

AvacadoGreenAuthor Commented:
Do you gents have any other suggestions/caveats about a VMware restore? It would shorten our recovery time significantly, in comparison to a system-state restore and rebuild.
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
We do the following:-

1. Shutdown the DC which has all the roles. (e.g. power off!). e.g. netdc1
2. We then use the VMware vSphere vCenter Server CLONE feature to make a backup.

so we then have netdc1-backup.

This is the VM, we use when all goes wrong, we just power this on, evict all the other DCs, create new DCs, but not using the names of the Dcs we used before.

We alter DHCP to issue new IP Addresses, as the IP Addresses have changed of the DNS.


We do not even both with backup and restore of DCs.

We already have templates ready to go of all our OS, and they are patched, so it takes us 1-2 minutes to deploy from template, we then just add AD role, wait for replication, and we are done, domain is back.
Will SzymkowskiSenior Solution ArchitectCommented:
Do you gents have any other suggestions/caveats about a VMware restore? It would shorten our recovery time significantly, in comparison to a system-state restore and rebuild.

Restoring your AD environment by doing VMware snapshot roll backs is an UNSUPPORTED method, unless of course you are using the new DC cloning feature in server 2012/R2. If not then it is unsupported.

When you raise the domain/forest functional level it is an irreversible task and if you require to restore from a backup it needs to be a System State Backup. From there you would do the following...
- restore your FSMO role holder DC (authoritative Restore)
- you would then perform a system state restore of ALL other domain controllers (NON-AUTHORITATIVE)

Non-Authoritative restore will allow the domain controllers to get all replicating changes from the current FSMO role holder which will allow replicaiton to be synced properly across all of the DC's after you restore them.

A side from that there is nothing else that is required. However if your replication and DC health is good, you should not have any issues performing Domain/Forest Functional Level raise.

Lee W, MVPTechnology and Business Process AdvisorCommented:
While Will is correct that snapshots are unsupported for restores, *IF* done appropriately, it should be fine.  The problem I will grant you is that appropriately can be tricky if you're not EXACTLY CERTAIN and you're not VERY careful.
AvacadoGreenAuthor Commented:
Forest/Domain functional level upgrade went off without a hitch. We performed system state backups, in addition to turning each VM off for a clean-snapshot. The FSMO role holder was snapped last, and would be the first to be restored in the event of a disaster.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.