Microsoft Active Directory Backup and Recovery in Windows Server 2008 written by Shawn Barker Product Manager, Quest Software, Inc. © Copyright Quest® Software, Inc. 2008. All rights reserved. This guide contains proprietary information, which is protected by copyright. The software described in this guide is furnished under a software license or nondisclosure agreement. This software may be used or copied only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying and recording for any purpose other than the purchaser's personal use without the written permission of Quest Software, Inc. WARRANTY The information contained in this document is subject to change without notice. Quest Software makes no warranty of any kind with respect to this information. QUEST SOFTWARE SPECIFICALLY DISCLAIMS THE IMPLIED WARRANTY OF THE MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Quest Software shall not be liable for any direct, indirect, incidental, consequential, or other damage alleged in connection with the furnishing or use of this information. TRADEMARKS All trademarks and registered trademarks used in this guide are property of their respective owners. World Headquarters 5 Polaris Way Aliso Viejo, CA 92656 www.quest.com e-mail: [email protected] Please refer to our Web site for regional and international office information. Updated—April 2, 2008 WPW_RMAD_Win_040208_AG CONTENTS INTRODUCTION ..........................................................................................1 CHANGES TO ACTIVE DIRECTORY BACKUP AND RECOVERY IN WINDOWS SERVER 2008 ..............................................................................................2 BACKUP ..................................................................................................... 2 TROUBLESHOOTING........................................................................................ 3 RESTORE .................................................................................................... 3 ENTERPRISE EXAMPLE: BACKING UP AND RECOVERING ACTIVE DIRECTORY ITEMS USING WINDOWS SERVER 2008 NATIVE TOOLS .............................................................. 4 QUEST RECOVERY MANAGER FOR ACTIVE DIRECTORY................................6 BACKUP ..................................................................................................... 6 TROUBLESHOOTING........................................................................................ 7 RESTORE .................................................................................................... 8 COMPARISON: AD BACKUP AND RECOVERY IN THE ENTERPRISE................9 SUMMARY .................................................................................................11 MORE INFORMATION .................................................................................... 11 ABOUT THE AUTHOR .................................................................................12 ABOUT QUEST SOFTWARE, INC. ................................................................13 CONTACTING QUEST SOFTWARE....................................................................... 13 CONTACTING QUEST SUPPORT......................................................................... 13 NOTES.......................................................................................................14 i White Paper INTRODUCTION Microsoft released Windows Server 2008, its first major server platform since Windows Server 2003, in February, 2008. Anticipated by many enterprises, it includes new technical, security, management, and administrative features designed to increase server reliability and flexibility. Windows Server 2008 also includes a number of Active Directory improvements and extensions. The core Active Directory functionality in Windows Server 2003 is renamed Active Directory Domain Services (AD DS) in Windows Server 2008, distinguishing it from new components such as Active Directory Certificate Services (AD CS), Active Directory Federation Services (AD FS), Active Directory Lightweight Directory Services (AD LDS), and Active Directory Rights Management Services (AD RMS). Read-Only Domain Controller (RODC) is a new AD DS security feature that is garnering considerable attention. An RODC allows you to deploy a read-only copy of the domain database in environments where physical or administrative security is weaker, such as in branch offices. RODCs contain all AD DS objects and attributes, except for account passwords. Since changes cannot originate at an RODC, a malicious or inexperienced user cannot create unwelcome changes that will replicate throughout the entire AD forest. AD DS is still vulnerable to human error, equipment failure, or mis-configured software, any of which can corrupt AD and Group Policy data. Corruptions and deletions can negatively impact application response times, user productivity, or business metrics, which is why it’s critical to have a reliable recovery plan. Correcting and restoring AD objects and attributes using Windows Server 2003 native tools has typically been a time-consuming and error-prone process. A recent survey1 of over 150 enterprises revealed that 60 percent of them had at least one AD accident in the past year. Depending on the nature of the problem, these accidents can take hours or even days to rectify. Windows Server 2008 introduces some changes to the backup and recovery of AD. While Microsoft has introduced a new backup mechanism—and a tool for browsing backup data—AD objects are not significantly easier or quicker to recover than they have been in the past. Since the new backup method is neither similar nor backwards-compatible with the tools used in Windows Server 2003, AD administrators with mixed Windows environments will be forced to run separate backup mechanisms, complicating both training and business processes. This white paper provides an overview of the new AD backup and recovery features included in Windows Server 2008, and examines the tools that will be available to help enterprises prevent downtime and the resulting impact on users during an AD recovery. It introduces Quest Recovery Manager for Active Directory, and how it works with the new features to simplify the complexity of Windows Server 2008. 1 Microsoft Active Directory Backup and Recovery in Windows Server 2008 CHANGES TO ACTIVE DIRECTORY BACKUP AND RECOVERY IN WINDOWS SERVER 2008 The new functionality and changes affecting the Active Directory backup and recovery process in Windows Server 2008 can be broken down into three subsections: backup, troubleshooting, and restore. Backup Windows Server Backup is the utility in Windows Server 2008 that replaces the NTBackup utility available in previous server releases. According to Microsoft 2 literature, Windows Server Backup is a “basic backup and recovery solution” whose “simple design makes it especially well-suited for smaller organizations or 3 individuals who are not IT professionals. ” Reading between the lines, enterprise IT professionals may find it does not meet the specific needs of their AD environment. There are a number of new features introduced in Windows Server Backup. A Microsoft Management Console (MMC) Backup snap-in allows IT administrators or backup operators to manage both local and remote server backups through the same user interface on a single server. Windows Server Backup can now backup data from applications such as Microsoft SQL Server™ and Windows SharePoint® Services using Volume Shadow Copy Service (VSS). Both full and incremental backups are now supported. However, there are some limitations in Windows Server Backup that can affect enterprise backup processes in general and Active Directory backups in particular. Windows Server Backup is not backwards-compatible, so you cannot recover backups created via NTBackup. Windows Server Backup is also less granular than previous backup utilities. Considering the multiple domain controllers (DCs) established in many larger organizations, this can complicate the Active Directory backup and recovery process. For example, the Windows Server Backup graphical interface does not allow you to create backups of just the System State, so every volume hosting AD components must be backed up in its entirety. Depending on where the AD database, logs, SYSVOL, Windows directory, and boot files are located, this may involve backing up multiple server partitions. While it is possible to create System State backups using the WBADMIN.EXE command line utility, these backups include system protected files and still result in large backups regardless of the size of the AD database. While there are performance improvements to the Windows Server 2008 backup utility, its large backups consume additional storage. This will result in slower restore times, as IT administrators must manually sift through large backups. 2 White Paper Troubleshooting Windows Server 2008 includes a new feature called AD DS Snapshot Viewer, designed to make it easier to view backed-up data. With Snapshot Viewer, you can browse VSS-created snapshots of the AD database to determine whether they contain the desired data before attempting a restore. You can browse these read- only snapshots on a domain controller without starting the domain controller in Directory Services Restore Mode (DSRM). In contrast, Windows Server 2003 had no way of viewing multiple AD backups taken at different