Domain controller replication case

Hi Ivaylo,

Is your question around can this be done, or are you asking something else? If you’re asking if this can be done, the answer is yes. You could either replicate the DC with ZVR and isolate during testing, or you can replicate the DC live on the network using AD replication/architecture and (clone, then) isolate this DC from production during testing.

~harry

At a high level, Zerto can protect any VM and there are no unique needs of Zerto in protecting MS Active Directory Domain controllers (AD DC), however the requirements to protect and recover an AD DC can change depending on the version of Windows Server being used. You can refer to Microsoft documentation on protection and recovery of AD DCs by Windows Server version. Depending on the version you may be able to simply protect the VM and fail it over, or you may need to have one or more changes take place on the guest or in AD post-recovery. These changes can also impact the disaster recovery plan in other ways.

Since you are a Zerto partner I suggest connecting with your Zerto account team on a design discussion. I do not recommend trying to solve this here on the forums since the customer network topology, any number of unique customer requirements, and so on may impact the final design.

In our case, once we started using zerto vss agent, we were able to successfully start not only vm, but also all AD DS on that DR isolated DC.

Hope that may help other guys having similar issues.

so is it supported to replica Windows Active Directory Servers?I usually say to customer hey use Windows replication but not sure about that now

Carlos, it’s neither supported nor unsupported. Zerto protects virtual machines, the contents are irrelevant (besides requirements for things like IP reconfiguration). The question any individual organization would need to ask is does our application support recovery from crash-consistent states, such as with Live Failover to the latest or any timestamped checkpoint? I’d estimate somewhere around 99% of applications are successful with this based on customer feedback. There are still those applications that require recovery from a transactionally-consistent checkpoint through Zerto VSS, and you can determine this through testing since it is zero impact.

In addition you need to ask the question, and plan for the answer to, whether you are changing the IP address on failover and how will AD react to that. Again, nothing to do with Zerto other than us changing the IP address, instead it’s all about the application.

Hey Slawomir,

Out of curiosity what kind of fail over situation were you trying to accomplish here?

Was it vmWare to AWS? Was it Hyper V to Azure?

Please review my post and chime if you can: https://www.zrto-dev.com/myzerto/forums/topic/ms-server-2012-r2-domain-controller-to-aws/

Hi Patrick,

We failed over from hyper-v to vmware.

Yes, we were surprised that failover was fine on OS level, but AD DS were simply corrupted and not loading. In past tests (vmware-to-vmware) we never had issues with failing over domain controller. We’ve tested hundreds scenarios and check points. One domain controller simply refused to come clean in application crush consistent sense.

We’ve even powered off the server (what should prepare it for migration and save RAM cache to files) and run test failover for various check points around shutdown time with no luck.

Only vss snapshot allow successfully bring replica up with all DC services working fine.

Yes, Carlos is right, active directory should be replicated with windows tools, yet what about pure DRaaS scenario? All servers, AD DC inclusive, should be DR prepared and failed over. If you offer to customer only space for DR, customer should not be forced to run new dedicated DC in DR as it would have to be maintain, license and resources paid. Other scenario is when production network is failed over with servers at the same time – thus no way new DC can run on DR platform.

No, Sean, content of virtual machines is the core for the customer business and that is why customer would invest in DR. If you care about VM only then customers will walk away from your product. The expectation is that in fastest possible time, without hit and miss of multitude of check points customer critical applications will be serving end users. No body cares about virtual platform and vms until they serve the purpose.

Our observation suggests that this vm was somehow incorrectly build or got issues down the line, yet as it was customer critical DC (lots dependant applications and services tied to that DC) we couldn’t rebuild that server and it had to be failed over with other servers.

Anyways, in our case vss did the job, but I need to warn you that zerto vss agent is not fully developed and we had many issues with it. Starting with licensing that caused the project to hold for a week, ending on massive problem that zertoVssAgent is not able to talk to protected site ZVM via ZCC and that is defeating the purpose of separating customer network from CSP one.

I hope there will be more customers nagging zerto developers to fix those fundamental flaws.

Cheers

Slawomir