2011 (Windows)

Backing up Active Directory
This appendix includes the following topics:
■ About the role of Active Directory
About the role of Active Directory
When protecting a domain controller with Symantec System Recovery, be aware
of the following:
■ If your domain controller is Windows Server 2003, it supports Microsoft Volume
Shadow Copy Service (VSS). Symantec System Recovery automatically calls
VSS to prepare the Active Directory database for backup.
■ To participate on a domain, every domain computer must negotiate a trust
token with a domain controller. This token is refreshed every 30 days by default.
This time frame can be changed, and is referred to as a secure channel trust.
But a trust token that is contained in a recovery point is not updated
automatically by the domain controller. Therefore, a computer that is recovered
using a recovery point containing an outdated token cannot participate in the
domain. For such a computer to participate in the domain it must be re-added
to the domain by someone who has the proper credentials.
In Symantec System Recovery, this trust token can be re-established
automatically if the computer participates in the domain when the recovery
process is started.
■ In most cases, domain controllers should be restored non-authoritatively.
Restoring domain controllers non-authoritatively prevents outdated objects
in the Active Directory from being restored. Outdated objects are referred to
as tombstones. Active Directory does not restore data older than the limits it
sets. Restoring a valid recovery point of a domain controller is the equivalent
of a non-authoritative restore. To determine which type of restore you want
C
Appendix