Active Directory disaster recovery with DPM

active-directorydisaster-recoveryrestorescdpmsystem-state

I have a sort of catch-22 question here.

Suppose I'm using Microsoft System Center Data Protection Manager (2010 or 2012, it works the same way) to backup, amongst various other things, my Active Directory environment (as in "the System State of my domain controllers").

Then, a complete data center lost occurs. I have to start fresh on new hardware, I only have my tape backups available because they were stored off-site. So I buy some new servers, a new tape library, new storage, and so on.

Now, everyone knows (or should know) that in order to perform an Active Directory disaster recovery I need to at least restore the system state of a domain controller; of course, this can get… tricky if I need to restore it on different hardware from the original server, but let's also assume this point is covered.

Howewer, and here's the catch, DPM needs Active Directory in order work; it won't even install on a standalone server. But, of course, a working DPM server is needed in order to get back those backups from the tapes.

How can I restore my Active Directory environment starting with only new servers and DPM tape backups?

N.B. Using virtual domain controllers and backing up the full VMs could make the restore easier, but actually doesn't change the question at all: a working AD environment is still needed in order to even install DPM.

Best Answer

So far, I've been able to come up with the following procedure, but I really hope there is some simpler way:

  • Install the operating system on a new server
  • Create a new "dummy" domain and make the server its domain controller
  • Install the operating system on a second server
  • Join the server to the "dummy" domain
  • Install DPM on the second server and connect it to the tape library
  • Restore the DPM database (*)
  • Find the tape with a system state backup of a domain controller
  • Restore the system stabe backup to a network location
  • Throw away everything except the restored backup
  • Install the operating system on the new domain controller
  • Restore the system state backup on the new domain controller
  • Verify that the restored AD is working properly
  • Install the operating system on the new DPM server
  • Join the new DPM server to the restored domain
  • Install DPM on the new DPM server and connect it to the tape library
  • Restore the DPM database
  • Start restoring everything else according to your DR plan

This solution is clumsy, long and somewhat awkward, but it should work; my only concern is about restoring the DPM database for the first time (the step marked with (*) in the list), because I don't know if this could work when running on a different AD domain. If this doesn't work, then the only solution would be manually importing the tape containing the system state backup of a DC... and good luck finding it if you have decent-sized backups.
But of course, this also applies to finding the backup of the DPM database in the first place...

Related Topic