-- Main.ctucker - 04 Nov 2005

Procedure for Recovering a Domain Controller in the CSCF Active Directory from Backup

Location of Backup Files

As outlined in the Disastor Recovery plan, there are three domain controllers which are designated for recovery from backup should the entire CSCF Active Directory forest be lost or if even one domain in the forest is destroyed.

• elisa in CSCF
• serverus in CS-GENERAL
• canadenis in CS-TEACHING

Each of the above listed domain controllers automatically stores a copy of its daily system state backup to the following locations on the network and on the server's local hard drive.

• \\cs-appserv.cscf\ADBACKUPS\(Domain Name)\(Server Name)\DailyStateBackUp.bkf
• C:\Temp\backup\DailyStateBackUp.bkf

The backup process first creates the server's state backup on the local hard drive and then this file is copied to the designated network file server.

Restoration of Domain Controller from a Backup File

1. Install CSCF Standard Windows 2003 Enterprise Server image onto the server hardware.
   • A copy of this OS image can be found on the core share of the CSCF app server cs-appserv.cscf.
2. Follow through with driver installation and network configuration.
   • Specify elisa and eponina as Primary and Secondary DNS servers respectively.
   • Enable DNS registration.
   • Disable unused network adapter.
3. Apply the corresponding service pack which the domain controller was running before failure.
4. Copy the System State backup file onto the server harddrive.
5. Activate the NTBACKUP utility.
6. Run the Restore from File option specifying the location of the System State backup file.
7. Reboot the domain controller.
8. Logon to the domain controller and patch the system using the Windows Update feature of Internet Explorer.

Nature of Backups

Windows 2003 servers have a built-in backup programme called NTBACKUP (C:\WINDOWS\system32\ntbackup.exe). It is this utility that is used to backup the "System State" of a domain controller.

As a Schedualed Task (Control Panel applet), Normal type System State backups are performed once per day at 12:01am. Only the "System State" and openssh server installations (if present) are backed up on CSCF forest domain controllers.

According to Microsoft the System State encompasses the following elements of a domain controller. All of which are nessesary and sufficient to restore a failed domain controller.

• System startup (boot) files.
• System registry
• Class registration database of component services.
• System volume (SYSVOL). SYSVOL is the default location for shared files with common access throughout a domain. The SYSVOL (C:\WINDOWS\SYSVOL) folder contains the following:
  • Net Logon shared folders. These folders usually host user logon scripts and policy settings for network clients that are running pre–Windows 2000 operating systems.
  • User logon scripts.
  • System policies.
  • Group Policy settings.
  • File system junctions.
  • File Replication service (FRS) staging directories and files that are required to be available and synchronized between domain controllers
• Active Directory, including the following:
  • The Active Directory database (Ntds.dit)
  • The checkpoint file (Edb.chk)
  • The transaction logs, each 10 megabytes (MB) in size (Edb*.log)
  • Reserved transaction logs (Res1.log and Res2.log)

Much of this information is copied directory from the following Microsoft web page covering Active Directory Backup and Restoration. http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/Operations/b3d615b9-2bc9-4a4f-89cb-7697f94d527d.mspx