To permit each DC to join a desired site when it's promoted to DC status, you'll want to add the appropriate subnets to each delayed-replication site. I suggest precreating a 32-bit subnet (one node) for each system's IP address before promoting the DCs into their respective sites. Again, you'll need to use the Active Directory Sites and Services snap-in to perform this task. Navigate to the Subnets container and select New Subnet from the Action menu. Enter the correct subnet information and associate the subnet with the delayed-replication site you desire. Figure 2 illustrates this process for a system with IP address 10.1.1.5.
Beware of Stale Data
Bear in mind that because these recovery DCs will replicate on a delayed schedule, you must take measures to prevent these DCs from servicing user authentication or directory lookups. Because replication will lag behind by several days, you should consider the data on the recovery DCs as stale. A changed phone number attribute on a production DC user object, for example, won't change on the recovery DC until replication occurs. To prevent user authentication and directory lookups, you can apply a special Group Policy setting to the AD sites that host the recovery DCs. This Group Policy setting essentially hides the DC from the rest of the environment and allows for replication only with partner DCs. The site-based DC Locator DNS Records not registered by the DCs
Group Policy Object (GPO), which Figure 3 shows, prevents the delayed-replication DCs from registering SRV and other DNS records. You'll find this GPO in Group Policy Editor (GPE) under \administrative templates\system\netlogon\DC Locator DNS Records.
Your goal is to permit the registration of only the GUID Cname record in DNS, along with the A record for the DC nodename (because the GUID Cname points to this A record). It's important that you don't let Netlogon register any other DNS records, including the domain A record, any SRV records, and the Global Catalog (GC) A record. Each record classification is represented by a mnemonic to help make policy application easier. For each record type that you don't want to register in DNS, you must enter that mnemonic into a space-delimited list in Group Policy. DsaCname is the only mnemonic that should be missing from the list of space-delimited mnemonics that need to be entered into Group Policy. Table 1 shows the complete list of mnemonics for Group Policy.
If you're running a Win2K forest, you'll need to manually enter these settings into the registry of each delayed-replication DC, as the Microsoft article "How to Optimize the Location of a Domain Controller or Global Catalog That Resides Outside of a Client's Site" (http://support.microsoft.com/?kbid=306602) describes.
It's also important to prevent these DCs from registering in WINS, in which down-level clients might be attempting to resolve the 1C record to find a suitable DC in the domain. Each DC in the domain registers a 1C record in WINS. This record maps a domain name to an IP address, permitting client systems to find an appropriate DC according to the domain name. To prevent the registration of the 1C record, don't specify WINS resolvers in the IP configuration.
The Recovery Process
To be able to restore an object (or subtree of objects) in AD, you must first know the object's specific DN. The DN is the object's directory path that Ntdsutil will use to find and restore the object. Many times, you won't know the exact DN of an object you need to restore, so you might need to search for the object to garner that information. After you determine the DN, you'll use Ntdsutil in Directory Services Restore Mode on the delayed-replication DC to restore the object. You'll then need to replicate the recovered object back into the production environment.
Find the deleted object's DN. To find an object's DN, log on to the delayed-replication DC you want to use to restore the deleted item and perform a search for the object. Use the Support Tools utility ADSIedit.msc to perform the query, as
follows:
-
Open the tool and connect to the delayed-replication DC, then right-click the domain partition and select New, Query.
- Type a name (e.g., FindUser) for the query.
- In the Root of Search section, select the Browse option. Press Enter to select the domain.
- Under Query String, type cn= and the first part of the DN—for example, cn=jesse.
- Ensure that Subtree Search is selected, and click OK.
- Expand the domain and view the results of the query, as Figure 4 shows.
- Right-click the found object and open the object's Properties dialog box. Ensure that the Show optional attributes check box is selected. Find the value of the Distinguished Name attribute and copy the value. You'll need this text string for the authoritative restore, so be sure to save it accurately.
|
Register
