AD Disaster Recovery

Active Directory (AD) is the foundation for Windows 2000's new technologies. AD serves as a central storage location and access point for a tremendous amount of information, making its health and availability crucial to your network's ongoing operations. If AD fails, chances are that your IT services infrastructure is pretty much useless, so having a good AD recovery plan is vital.

Proper disaster-recovery planning begins long before a failure occurs. An AD recovery plan can include clustering, RAID, and backup and restore procedures as well as ensuring that you have an adequate number of domain controllers (DCs) for each of your domains and geographical locations. Knowing the minimum information that you need to back up so that you can perform a successful restore will help you determine which recovery method will work for your situation and will help you get AD back online.

DCs Are Key
Each DC in a domain maintains a copy of that domain's AD partition, so having an AD disaster-recovery plan is really a matter of being prepared to recover or replace one or more DCs. Each Win2K AD-enabled DC has a read/write copy of the directory and uses multimaster replication to ensure that changes to its copy of the directory are transferred to other DCs in the domain. Because your Win2K network isn't dependent on one particular PDC in each domain, Win2K is more scalable and fault tolerant than Windows NT 4.0 is. However, the multimaster replication model makes performing certain types of recovery operations fairly complicated, requiring an understanding of the AD replication process.

What to Back Up
For a successful restore operation, you must have backups of the right data. Because AD resides on your network's DCs, to fully recover AD requires that you have a full backup of every DC. At a minimum, you should have a backup of all the Global Catalog (GC) servers and all Operations Masters for each domain in your forest. Although a full backup of these machines is ideal, the specific data that you need to back up for each DC is in the system partition and the System State. The System State on a DC includes AD and the files that AD-dependent services require (e.g., the registry, boot files, Sysvol, the Certificate Services database, Microsoft Cluster service). Because of DNS's importance to AD, only AD-integrated zones are included in the System State. This detail is one reason to back up the system partition, which will include standard zones. (For more information about backing up the System State, see "Related Articles.")

Although you have your choice of several third-party Win2K-certified backup applications, you don't need anything more than the backup application that ships with Win2K. Microsoft has improved Windows' backup application in Win2K, giving it the ability to back up to media other than an attached tape device and to schedule backups at regular intervals without using a batch file. To use this application to back up a DC's System State, on the DC, click Start, Programs, Accessories, Backup. Alternatively, you can click Start, Run, and type

ntbackup

in the Open text box. In the resulting Backup window, select the System State check box in the left pane of the Backup tab, which Figure 1 shows. To back up the System State, you must be a member of the Backup Operators or Administrators group; to restore the System State, you must be a member of the local Administrators group. The only backup type that the System State supports is Normal (i.e., you can't use the Copy, Daily, Differential, or Incremental backup types). Although Normal backups take longer than other types to create, you can create the backup while the server is online. However, Win2K's backup application has a limitation that doesn't plague third-party programs: Win2K's backup application lets you perform only a local AD backup; you can't back up the System State on a remote machine.

Additional Information
In addition to calling for backups, a good disaster-recovery plan provides up-to-date information about which DCs are serving as GC servers and Operations Masters. GC servers maintain a copy of every object in a forest, enabling searches of your entire AD without requiring communication with a DC in every domain. You can use the Microsoft Management Console (MMC) Active Directory Sites and Services snap-in to determine which DCs host the GC. (In the console, right-click a server's Ntds object and select Properties. In the resulting dialog box, the Global Catalog check box will be selected if the server is a GC server.)

Operations Masters are DCs that play specific roles within their domains or forests for crucial AD functions that don't utilize AD's multimaster replication functionality. For example, AD schemas define what types of objects users can create, and the Schema Master DC is the only DC in the forest that can accept schema updates. (For more information about Operations Masters, see "Related Articles.") You can use the MMC Active Directory Users and Computers snap-in to determine which DCs are serving as Operations Masters for all roles except the Schema Master role, which requires you to use the MMC Schema Manager snap-in. (To use the Active Directory Users and Computers snap-in to view Operations Masters, right-click the domain name in the console's left pane and select Operations Masters from the resulting menu.) Alternatively, you can use the Ntdsutil command-line utility.