As I read it, The KB cited does NOT say that 'having a DC in a Virtual Server environment is not supported'. In fact, MS has published a paper (http://www.microsoft.com/downloads/details.aspx?FamilyId=64DB845D-F7A3- 4209-8ED2-E261A117FC6B&displaylang=en) with explicit guidance on how to successfully run DCs on virtual server.
The cited KB DOES explain that bringing a backed up virtual DC online to recover from a failure will cause problems (because of the USN rollback issue). As has been pointed out many times on this list, restoring a failed DC from a disk image (Ghost, .vhd file, whatever) is a spectacularly Bad Idea. As I understand it, this is primarily because all DCs track some metadata about the state of the AD NC replicas on their replication partners (the High-Watermark Vector, the Up-To-Date vector, and the GUID of the replica itself, for example). If a failed DC is 'restored' by reviving an old image, the partner DCs will believe the DC is more up-to-date than it really is, and replication will suffer. The hotfix in the cited KB article will protect you somewhat by logging an event and stopping netlogon, but you still need to clean it up. On the other hand, restoring a DC using normal System State restore procedures causes the restored replica to get a new GUID, so it's obvious to the replication partners that they're dealing with a 'different' replica and normal replication can allow it to catch up. So, "DC on VS" = OK, but "restoring a disk image of a DC" = BAD. Dave -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] Sent: Thursday, October 06, 2005 9:15 AM To: [email protected] Subject: Re: [ActiveDir] AD Restore Problem <stupid question alert> Okay so unless you are insane SBS.. images of your DCs are ixnay. What does Sun, Linux, Mac or any other competing Server OS do in their world to ensure the Kingdom easily and quickly comes back up? <yeah I know they don't have AD but they have to have some competing glue, right?> What have they done if anything? How to detect and recover from a USN rollback in Windows Server 2003: http://support.microsoft.com/?kbid=875495 That KB is interesting as it clearly indicates that having a DC in a Virtual Server environment is not supported... yet we SBSers have gotten word that once Exchange 2003 sp2 supports Vserver all of the parts of the 'standard' box will be supported in a virtual environment. Brett Shirley wrote: >If you have any replicas of those servers, when you restore those >VMWare images, you will have corrupted your forest during restore. > >-BrettSh [msft] > >This posting is provided "AS IS" with no warranties, and confers no >rights. > > >On Thu, 6 Oct 2005, Carroll Frank USGR wrote: > > > >>I am working my way down the VMWare path also for my ultimate DR "ace >>in the hole". The environment is a TLD with 4 child domains. I am >>planning on running a single VMWare server that has virtual DCs for >>all 5 domains. I am going to peel off a dedicated site/vlan and put >>the physical VMWare server and all of the DC virt servers in that >>site. None of the virtual DCs are going to be GCs. The reason for the >>dedicated site is so I can keep people from using them for validation >>in production. >> >>Once I have them running, I plan to use the VM scripting to gracefully >>shut them down once a day and then shoot the image file of the >>shutdown DC off to tape, which then goes off-site. After the backup >>completes I then restart the virtual servers. >> >>This plays into the different hardware scenario since I can use VMWare >>to abstract the hardware. >> >>Of course, this whole process is the backup to the normal system state >>backup of all my backbone DCs. >> >>FWIW - Frank >> >>________________________________ >> >>From: [EMAIL PROTECTED] >>[mailto:[EMAIL PROTECTED] On Behalf Of Coleman, >>Hunter >>Sent: Wednesday, October 05, 2005 5:37 PM >>To: [email protected] >>Subject: RE: [ActiveDir] AD Restore Problem >> >> >>You will still need to abandon the snapshot/image approach. Go to >>http://www.mail-archive.com/[email protected]/ and search >>for "usn rollback". You can get the same information by searching >>support.microsoft.com, but without the colorful and enlightening >>commentary that the list provides. >> >>Hunter >> >> >> > > List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
