DC replication and recovery
As part of our DR strategy we replicate or servers to our DR site. This now includes a couple of 2008 R2 Domain Controllers. For DR testing we will bring these replicas up and then the other servers in the isolated environment. However, bring the DC up in isolated seems to cause a problem. this varies fom never being able to log on to having to wait for an hour before we can logon.
Once we have logged on thy event log seems to indicate a problem with DNS, and yet I can't as nail what the problem is.
One of the problems we face is that we set up or domain wrong in the first place. For those of you that remember the Windows 2000 AD design exam we should have gone for the multi forest Ski lodge model but ended up with a single domain and bunch of autonomous sub domains, this was fine under Windows/Exchange 2000 (just) and 2003 (better) but under Windows 2008/R2 and Exchange 2010 is starting to look severely broken or at least more awkward to mange then it needs to be.
Now whether the issue we are seeing is down to this sub domain thing since we moved to 2008 I can't say, but it seems to me that it isn't helping. We used to physically remove a mirrored disc from our global catalog domain controller and store it off site and then use that for our DR testing, bung it in a server seize the roles and job done. but the virtual equivalent of that with 2008 R2 just doesn't seem to work.
A lot of the Microsoft documentation on Virtual DCs says don't snapshot and if you bring it up then you must recover from a system state backup. Well that is a good pointer, but in order to do a system state restore you need to log on to the DC, but my experience is that if the DC can't see another DC it won't let you log on, you can log on with cached credentials in Safe Mode but then you can't actually run Windows backup utility so you can't do a restore, and before you suggest it doing an authoritative restore of AD doesn't work either. It's a whole catch 22 situation.
In a full DR invocation it is likely we would just build a new DC as it is possible that bringing up a replicated DC could cause more issues than the short time gain that you get from this process, but in a DR test in an isolated environment booting a replicated DC is the only real option as moving a DC from live to DR environments means you leave a mess in Live that will need to be tidied up afterwards.
Something seems to have broken between 2003 and 2008R2 domains that gets in the way of life, if I ever work out what it is and how to fix it I'll post but don't hold your breath.
Once we have logged on thy event log seems to indicate a problem with DNS, and yet I can't as nail what the problem is.
One of the problems we face is that we set up or domain wrong in the first place. For those of you that remember the Windows 2000 AD design exam we should have gone for the multi forest Ski lodge model but ended up with a single domain and bunch of autonomous sub domains, this was fine under Windows/Exchange 2000 (just) and 2003 (better) but under Windows 2008/R2 and Exchange 2010 is starting to look severely broken or at least more awkward to mange then it needs to be.
Now whether the issue we are seeing is down to this sub domain thing since we moved to 2008 I can't say, but it seems to me that it isn't helping. We used to physically remove a mirrored disc from our global catalog domain controller and store it off site and then use that for our DR testing, bung it in a server seize the roles and job done. but the virtual equivalent of that with 2008 R2 just doesn't seem to work.
A lot of the Microsoft documentation on Virtual DCs says don't snapshot and if you bring it up then you must recover from a system state backup. Well that is a good pointer, but in order to do a system state restore you need to log on to the DC, but my experience is that if the DC can't see another DC it won't let you log on, you can log on with cached credentials in Safe Mode but then you can't actually run Windows backup utility so you can't do a restore, and before you suggest it doing an authoritative restore of AD doesn't work either. It's a whole catch 22 situation.
In a full DR invocation it is likely we would just build a new DC as it is possible that bringing up a replicated DC could cause more issues than the short time gain that you get from this process, but in a DR test in an isolated environment booting a replicated DC is the only real option as moving a DC from live to DR environments means you leave a mess in Live that will need to be tidied up afterwards.
Something seems to have broken between 2003 and 2008R2 domains that gets in the way of life, if I ever work out what it is and how to fix it I'll post but don't hold your breath.
Comments
Post a Comment