CHAPTER8 8 Monitoring and Maintaining the Active Directory Environment Terms You’ll Need to Understand ✓ Active Directory log files ✓ Authoritative restore ✓ Directory Services Restore Mode (DSRM) ✓ Defragmentation ✓ Linked value replication ✓ Network Monitor ✓ Nonauthoritative restore ✓ Ntds.dit ✓ Reliability and Performance Monitor ✓ Server Performance Advisor ✓ System state data ✓ Task Manager ✓ Wbadmin.exe ✓ Windows System Resource Manager (WSRM) Concepts/Techniques You’ll Need to Master ✓ Backing up Active Directory ✓ Performing primary, normal, and authoritative restores of AD DS ✓ Using removable media to perform backups and restores ✓ Backing up, restoring, exporting, and importing GPOs ✓ Performing offline defragmentation and compaction of AD DS ✓ Using Windows Server 2008 monitoring tools to monitor AD DS 346 Chapter 8: Monitoring and Maintaining the Active Directory Environment In previous chapters, you learned how Active Directory Domain Services (AD DS) replicates its database across the entire forest. You learned about the struc- ture of AD DS, how to delegate authority to various components of AD DS, and how to use Group Policy to configure and secure the network environment. Now it’s time to turn your attention to monitoring and troubleshooting of AD DS. Things can and do go wrong, often in subtle ways. You need to know how to restore Active Directory from a backup, which is often the fastest way to recover from these problems. Further, you need to know how to back up Active Directory before you can restore it. You also need to know how to monitor your servers and use the information obtained to locate and repair problems before they become disruptive to your entire network’s operations. Backing Up and Recovering Active Directory All computers fail sooner or later. And people (maybe even you) accidentally delete valuable data. A good backup and recovery strategy is vital to an organi- zation’s continued well-being. Without it, your organization’s existence could be threatened. Backup and recovery is just as important for your AD DS database as it is for your critical production files. Windows Server 2008 includes a new backup application called Windows Server Backup. This application works somewhat differently from the older backup application included with Windows 2000 and Windows Server 2003. The fol- lowing are some of the more significant differences: . Windows Server Backup works by backing up critical volumes. These are the volumes that are required for recovering AD DS and include the SYSVOL volume, the system and boot volumes, and the volumes that host the Ntds.dit database file and the Active Directory log files. The composition of the system state data depends on the server roles installed on the server and the volumes that host the critical operating system and role files. System state consists of at least the following items and can include more depending on the installed server roles: . Registry . COM+ Class Registration database . System and boot files . AD DS and Active Directory Certificate Services (AD CS) databases 347 Backing Up and Recovering Active Directory . SYSVOL folder . Cluster service information . Internet Information Services (IIS) metadirectory . System files that are under Windows Resource Protection . Windows Server Backup enables you to choose between three recovery modes: full server recovery, system state recovery, and file/folder recovery. You can use Windows Server Backup to perform a manual backup, or you can schedule automated backups to a dedicated backup volume on the server. In addition to local and network-based hard disk volumes, you can use CDs or DVDs as backup media. Magnetic tape volumes are no longer supported. Windows Server Backup does not enable you to back up individual files or folders. You must back up the entire volume that hosts the files or folders to be backed up. NOTE Members of the Backup Operators group can perform manual backups but cannot sched- ule backups by default. You must possess administrative credentials to schedule backups, and you cannot delegate this privilege. Use of Windows Server Backup Windows Server Backup enables you to protect against all types of data loss for reasons ranging from hardware or storage media failure to accidental deletion of objects or the entire AD DS database. This section looks at installing Windows Server Backup, using it to back up to different types of media and scheduling backups. Installing Windows Server Backup Unlike previous versions of Windows, Windows Server Backup is not installed by default; you must install it as a server feature from Server Manager. Use the following procedure to install Windows Server Backup: 1. Open Server Manager, and select the Features node. 2. In the Details pane, click Add Features. 348 Chapter 8: Monitoring and Maintaining the Active Directory Environment 3. Scroll the features list to select Windows Server Backup Features. If you also want command-line tools for performing backups, expand Windows Server Backup Features and select this option. 4. If you receive a message asking to install required features, click Add Required Features. Then click Next. 5. Review the information provided by the Confirm Installation Selections page, and then click Install. 6. When you’re informed that installation has completed, click Close. EXAM ALERT Be aware of the new backup utilities in Windows Server 2008 and the need to install them before use. Windows Server 2008 no longer supports the ntbackup.exe utility or the Automated System Recovery (ASR) tool, as an exam question might attempt to trick you on. Backing Up Critical Volumes of a Domain Controller Windows Server Backup enables you to back up your domain controller to dif- ferent types of media, including a fixed or removable hard disk volume installed on the server, a network share, or removable media such as CDs or DVDs. To perform this type of backup, you must be a member of the Administrators or Backup Operators group, and an appropriate backup volume must be available. To perform a single backup of critical volumes, proceed as follows: 1. Click Start, Administrative Tools, Windows Server Backup. You can also open Server Manager, expand Storage, and then select Windows Server Backup from this location. 2. From the Action menu, select Backup Once. This starts the Backup Once Wizard with a Backup Options page, as shown in Figure 8.1. 3. If you have previously scheduled a backup on this server, you can use the option The Same Options That You Used in the Backup Schedule Wizard for Scheduled Backups to perform this backup. Otherwise, click Different Options, and then click Next. 4. On the Select Backup Configuration page, select Custom, and then click Next. 349 Backing Up and Recovering Active Directory FIGURE 8.1 The Backup Options page provides options for using previous options if available and configuring different options. 5. On the Select Backup Items page, ensure that the Enable System Recovery option is selected, and then click Next. This ensures that all critical volumes are backed up. 6. On the Specify Destination Type page, select either Local Drives or Remote Shared Folder as required, and then click Next. 7. If you choose the Remote Shared Folder option, type the path to the shared folder on the Specify Remote Folder page. If you select the Local Drives option, select a suitable volume. Then click Next. 8. Choose the type of Volume Shadow Copy Service (VSS) backup you want from the options shown in Figure 8.2, and then click Next. FIGURE 8.2 The Specify Advanced Option page presents two options for performing a VSS backup. 350 Chapter 8: Monitoring and Maintaining the Active Directory Environment 9. Review the options presented by the Confirmation page, and then click Backup to perform the backup. 10. The Backup Progress page charts the status of the backup operation. When you are informed that the backup is complete, click Close. Windows Server Backup displays this backup and its results in the main portion of the application window. TIP You can use a similar procedure to back up the entire server. From the Select Backup Configuration page at step 4, select the Full Server (Recommended) option. The Wbadmin Command You can perform backups from the command line with the new wbadmin.exe utility, which is installed with the Add Features Wizard when you select the option described earlier to add command-line tools. This tool supports subcom- mands that enable or disable scheduled backups, run one-time backups, list details of available backups as well as items included in the backups, provide the status of a currently running backup, and perform system state backups and recoveries. The use of this command in running system state recoveries is dis- cussed later in this section. To obtain information on the available subcommands, type wbadmin /? at a command prompt. For example, to back up the system state, you would run the wbadmin start systemstatebackup command. To obtain information on this and other available subcommands, type wbadmin subcommand /?, where subcommand is the subcommand you want to obtain information for. Scheduling a Backup You can schedule a backup to take place when the server utilization is mini- mized, such as during the night. Scheduling a backup also ensues that the back- up will be performed on a regular basis without administrator intervention. The procedure for scheduling a backup is similar to that described in the previ- ous section. From the Windows Server Backup application, click Backup Schedule to start the Backup Schedule Wizard. After selecting an option from the Select Backup Configuration page, you are presented with the Specify Backup Time page shown in Figure 8.3. Select one or more times a day for the 351 Backing Up and Recovering Active Directory backup to take place. Then select a destination disk and accept the warning that the selected disk will be reformatted.