Veritas™ System Recovery 18 Service Pack 3 Management Solution Administrator's Guide

When protecting a domain controller with Veritas System Recovery 18 Management Solution, be aware of the following:

• If your domain controller is Windows Server 2008, it supports VSS. Veritas System Recovery 18 Management Solution automatically calls VSS (Volume Shadow-copy Service) to prepare the Active Directory database for backup. Windows 2000 domain controllers do not support VSS. In cases where the domain controller is running on a Windows 2000 server, the Active Directory database must be backed up using NTbackup. This backup should be done before you use Veritas System Recovery 18 Management Solution to protect the full system. This process can be automated using an external command that Veritas System Recovery 18 Management Solution calls. When you configure a backup job, you have the option to enter external commands. This option provides a process for protecting the domain controllers that do not support VSS.

  See About running command files during a backup.

• To participate on a domain, every domain computer must negotiate a trust token with a domain controller. This token is refreshed every 30 days by default. This time frame can be changed, and is referred to as a secure channel trust. The domain controller does not automatically update a trust token that a recovery point contains. Therefore, when you recover a computer using a recovery point that contains an outdated token, the computer cannot participate in the domain. The computer must be added to the domain by someone who has the required credentials.

  In Veritas System Recovery 18 Management Solution, this trust token can be re-established automatically if the computer already participates in the domain at the time the recovery process starts.

• In most cases, domain controllers should be restored non-authoritatively. This action prevents outdated objects in the Active Directory from being restored. Outdated objects are referred to as tombstones. Active Directory does not restore data older than the limits it sets. Restoring a valid recovery point of a domain controller is the equivalent of a non-authoritative restore. To determine which type of restore you want to perform, please refer to the Microsoft documentation. A non-authoritative restore prevents tombstone conflicts.