Jan. 12, 2011, 6:06 a.m.
posted by sensei
Restoring a Domain Controller
One of the benefits of Active Directory is built-in redundancy. When you lose a single domain controller, the impact can be insignificant. With many services, such as DHCP, the architecture dictates a dependency on a specific server. When that server becomes unavailable, clients are impacted. Over the years, failover or redundancy has been built into most of these services, including DHCP. With Active Directory, the architecture is built around redundancy. Clients are not dependent on a single DC; they can failover to another DC seamlessly if a failure occurs.
When a failure does occur, you should ask yourself several questions to assess the impact:
These questions can help you assess the urgency of restoring the domain controller. If you answered "no" to all of the questions, the domain controller can stay down for a short period without significant impact.
When you've identified that you need to restore a domain controller, there are two options to choose from: restoring from replication or restoring from a backup.
Restore from Replication
One option for restoring a domain controller is to bring up a freshly installed or repaired machine and promote it into Active Directory. You would use this option if you had a single domain controller failure due to hardware and either did not have a recent backup of the machine or you didn't want to go through the process of restoring the DC from a backup. This method allows you to replace the server in AD by promoting a newly installed machine and allowing replication to copy all of the data to the DC. Here are the steps to perform this type of restore:
The biggest potential drawback with this method is the restore time. Depending on the size of your DIT file and how fast your network connections are between the new DC and the server it will replicate with, the restore time could be several hours or even days. Restore time can be dramatically reduced with a new option in Windows Server 2003, called Restore from Media. It allows you to take files from a system state backup from one domain controller and use them to quickly promote another domain controller. It may possibly be faster to copy these backup files over the network to the remote site or ship the files on some other media to the site versus trying to replicate the entire DIT over the WAN. If this is problematic or too slow for you, you'll want to look at the restore from backup option that we describe next.
Manually removing a domain controller from Active Directory
One of the key steps with the restore from replication method is removing the objects that are associated with the domain controller before it gets added to AD again. This is a three-step process. The first step is to remove the associated metadata. That can be accomplished with the ntdsutil utility. The following example shows the commands necessary to remove the DC3 domain controller, which is in the RTP site, from the emea.mycorp.com domain:
C:\>ntdsutil ntdsutil: metadata cleanup metadata cleanup: connections
Next, we need to connect to an existing domain controller in the domain that contains the domain controller you want to remove. In this case, we connect to DC2:
server connections: connect to server dc2 Binding to dc2 ... Connected to dc2 using credentials of locally logged on user. server connections: quit metadata cleanup: select operation target
Now we need to select the domain the domain controller is in. In this case, it is emea.mycorp.com:
select operation target: list domains Found 2 domain(s) 0 - DC=mycorp,DC=com 1 - DC=emea,DC=mycorp,DC=com select operation target: select domain 1 No current site Domain - DC=emea,DC=mycorp,DC=com No current server No current Naming Context
Next we must select the site the domain controller is in. In this case, it is the RTP site:
select operation target: list sites Found 4 site(s) 0 - CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=mycorp,DC=com 1 - CN=RTP,CN=Sites,CN=Configuration,DC=mycorp,DC=com 2 - CN=SJC,CN=Sites,CN=Configuration,DC=mycorp,DC=com 3 - CN=NYC,CN=Sites,CN=Configuration,DC=mycorp,DC=com select operation target: select site 1 Site - CN=RTP,CN=Sites,CN=Configuration,DC=mycorp,DC=com Domain - DC=emea,DC=mycorp,DC=com No current server No current Naming Context
After listing the servers in the site, we must select the server we want to remove. In this case, it is DC3:
select operation target: list servers in site Found 3 server(s) 0 - CN=DC1,CN=Servers,CN=RTP,CN=Sites,CN=Configuration,DC=mycorp,DC=com 1 - CN=DC2,CN=Servers,CN=RTP,CN=Sites,CN=Configuration,DC=mycorp,DC=com 2 - CN=DC3,CN=Servers,CN=RTP,CN=Sites,CN=Configuration,DC=mycorp,DC=com select operation target: select server 2 Site - CN=RTP,CN=Sites,CN=Configuration, DC=mycorp,DC=com Domain - DC=emea,DC=mycorp,DC=com Server - CN=DC3,CN=Servers,CN=RTP,CN=Sites,CN=Configuration,DC=mycorp,DC=com DSA object - CN=NTDS Settings,CN=DC3,CN=Servers,CN=RTP,CN=Sites, CN=Configuration,DC=mycorp,DC=com Computer object - CN=DC3,OU=Domain Controllers,DC=emea,DC=mycorp,DC=com No current Naming Context select operation target: quit
The last step removes the metadata for the selected domain controller:
metadata cleanup: remove selected server
At this point, you should receive confirmation that the DC was removed successfully. If you receive an error that the object could not be found, it might have already been removed if you tried to demote the server with dcpromo.
You will then need to manually remove a few more objects from Active Directory, including the computer account and FRS object in the domain-naming context and the server object in the configuration container. See MS Knowledge Base article 216498 for details.
Restore from Backup
Another option to reestablish a failed domain controller is to restore the machine using a backup. This approach does not require you to remove any objects from Active Directory. When you restore a DC from a backup, the latest changes will replicate to make it current. If time is of the essence and the backup file is immediately available, this will be the quicker approach, because only the latest changes since the last backup, instead of the whole directory tree, will be replicated over the network.
Here are the steps to restore from backup:
It is also possible to restore the backup of a machine onto a machine that has different hardware. Here are some issues to be aware of when doing so:
Because there are numerous things that can go wrong with restoring to different hardware, we highly suggest you test and document the process thoroughly; refer to MS Knowledge Base article 263532. The last thing you want to do is troubleshoot hardware compatibility issues when you are trying to restore a crucial domain controller.