Tips for protecting a domain controller in Active Directory
When protecting a domain controller with Veritas System Recovery, be aware of the following:
-
If your domain controller is Windows Server 2008, it supports Microsoft Volume Shadow Copy Service (VSS). Veritas System Recovery automatically calls VSS to prepare the Active Directory database for backup.
-
To participate on a domain, every domain computer must negotiate a trust token with a domain controller. This token is refreshed every 30 days by default. This time frame can be changed, and is referred to as a secure channel trust. But a trust token that is contained in a recovery point is not updated automatically by the domain controller. Therefore, a computer that is recovered using a recovery point containing an outdated token cannot participate in the domain. For such a computer to participate in the domain it must be re-added to the domain by someone who has the proper credentials.
In Veritas System Recovery, this trust token can be re-established automatically if the computer participates in the domain when the recovery process is started.
-
In most cases, domain controllers should be restored non-authoritatively. Restoring domain controllers non-authoritatively prevents outdated objects in the Active Directory from being restored. Outdated objects are referred to as tombstones. Active Directory does not restore data older than the limits it sets. Restoring a valid recovery point of a domain controller is the equivalent of a non-authoritative restore. To determine which type of restore you want to perform, please refer to the Microsoft documentation. A non-authoritative restore prevents tombstone conflicts.
For additional details about protecting non-VSS aware domain controllers, see the white paper titled "Protecting Active Directory," located on the Web.
You can also refer to the Veritas Knowledge Base:
Related information