Windows Server 8 AD Cloning, Virtualization, and Snapshots Warning

Windows Server 8 Beta has a lot of nice features.  Two features that are getting a lot of buzz in the Active Directory World are the ability to easily clone domain controllers and the support to restore Active Directory using snapshots.

Using snapshots can cause USN Rollback and other problems.  Mark Ramey from the Microsoft AD team has an excellent blog entry that you can read for more info.

I added the word Warning to the title of this blog because I've seen a few blogs, posts, and articles that may lead people to believe that this can all be done with a few mouse clicks.  This is not the case, it is not hard but there are some major prerequisites and steps that people have to be aware of.

A few screenshots from my lab using VMware workstation.  These options exist in most hypervisor  products.

Cloning in VMware Workstation 8

Snapshot in VMWare Workstation 8

***WARNING***  You can't just use the GUI and start cloning and taking snapshots without causing issues in a domain/forest with multiple DCs.  You can't manually copy the virtual machine files.  VMWare workstation 8 and the current VMWare products don't support these features.

To take advantage of these features the virtualization host must support VM Generation ID.   I'm guessing by the time Windows 8 is released all major vendors will support this but that means most folks will have to upgrade their hypervisor.

Microsoft currently has two really good documents that are a must read for anyone interested in these new features

Test Lab Guide:  Demonstrate Virtualized Domain  Controller (VDC) in Windows Server "8" Beta

Understand and Troubleshoot Virtualized Domain Controller (VDC) in Windows Server "8" Beta  - written by Ned Pyle - Outstanding document!!

I won't repeat the documents but some important sections


Steps to deploy a cloned virtualized domain controller

1.       Create the customized DcCloneConfig.xml file on a source domain controller

2.       Detect incompatible programs on the source domain controller

3.       Ensure the PDC emulator runs Windows Server "8" Beta, is not the clone source, and is available

4.       Authorize the source domain controller for cloning

5.       Shutdown the source domain controller and copy its disk

6.       Create a new clone virtual machine using the copied disks

7.       Start the source and cloned domain controller, then allow cloning to occur

For those that are fans of the GUI

There is no task-oriented graphical management program for VDC cloning in Windows Server "8" Beta; the provisioning steps are performed manually or using Windows PowerShell 

 Steps to restore a DC snapshot

1.       Take snapshot of DC

2.       Create a new Group Policy

3.       Validate GP replication (SYSVOL replication)

4.       Restore DC Snapshot

You can read the the documents to get a lot more info.   Ned's document is 162 pages...Ned is the king of documentation and writing :)

As I start using this feature more and eventually use this in production in the future I hope to write more on these features.  I won't try to replicate Ned's excellent document but there is going to be more to come.

Windows Server 8 Member Server - ADAC Recycle Bin

Windows Server 8 Beta was released a few weeks ago and I understand that many organizations may be hesitant to start deploying domain controllers.

One nice thing is that some of the new features can easily run on a member server or workstation and work fine in your current domains.  You don't need to convince anyone about a schema update or new Windows 8 Domain Controllers right now.  Enjoy the new features with no risk (I'd argue there is not a lot of risk in adding a domain controller but I understand leadership wanting to wait on domain controllers)

One of those features is the AD Recycle Bin GUI. That is a nice addition that system administrators have been asking for since 2008 R2 was released. Your forest does have to be at 2008 R2 Forest Functional Level to enable the recycle bin.

Many people enabled and used the AD Recycle Bin in 2008 R2  There are even some 3rd party tools that can help and put a GUI front end around the Recycle Bin. In my opinion the GUI in Windows Server 8 is much nicer and is definitely a reason to add a Windows Server 8 member server now.

In my lab I have a 2008 R2 (forest functional level 2008 R2) Domain Controller and a Windows Server 8 Beta member server.

Windows 2008 R2 Domain

SIDE NOTE: As you can see my test domain is named USMCThanksForYourService.mil I've heard there might be some Marines stationed in Afghanistan reading this entry so a heartfelt thanks for all you all do. It takes a lot of courage to be in the military right now and you all are on the front lines. THANK YOU!!


SIDE NOTE II:  .  Any other military members reading my blog?  Leave a comment, I'd love to hear from you.

So people don't think I'm cheating I'll first verify that the Recycle Bin is not enabled by using the powershell command Get-ADOptionalFeature -Filter {name -like "*Recycle Bin*"} If EnabledScopes is empty that indicates the Recycle Bin has not been enabled.

AD Recycle Bin not enabled

I also join the Windows Server 8 Beta machine to the domain.

Adding Windows 8 Server to the domain

Once the server is added to the USMCThanksForYourService.mil domain I have to install the Remote Server Administration Tools (RSAT) Feature for Active Directory so I can have access to the necessary AD tools and fetures.

Adding Roles and Features in Server Manager

Adding RSAT Features

Adding RSAT Features Part II

Once the RSAT tools have been installed you are ready to use Active Directory Administrative Center (ADAC) against your 2008 R2 domain.

You can enable the AD Recycle Bin from the GUI now instead of the old way using Powershell 

Selecting ADAC from Server Manager in Windows 8

Enabling the AD Recycle Bin from Windows Server 8 Member Server ADAC

AD Recycle Bin Confirmation 1

AD Recycle Bin Confirmation 2

Just want to confirm that the AD Recycle Bin has been enabled.  Notice this time the same command yielded an entry in "EnabledScopes"...success

AD Recycle Bin Enabled - Confirmation

 A quick tutorial of the new feature now that it is enabled and the member server is up and ready to go.

As you can see there is a user named Dakota Meyer who is in the group "MedalofHonor"

A young contractor was really excited and lost his mind and accidentally deleted the account.   Luckily the USMC leadership had allowed this Windows 8 Member Server and Dakota's account would be restored in a few clicks.

In ADAC Navigate to the Deleted Objects Container

Notice the deleted user is listed.  Right click on the user for Restore Options

In ADAC we confirm that the user has been successfully restored

On the 2008 R2 DC the restore is confirmed using ADUC

Windows Server 8 Beta - Schema Version - Update

I previously posted a "quick-hitter" blog about the Active Directory Schema version in Windows 8 Developers Preview.

Windows Server 8 Beta has been out for over a week now and I have a domain controller in my lab for testing.  The schema version is now 52


I once again used adfind to quickly find the schema version.

I've updated the Active Directory Schema version table below.

Windows Server 8 Beta	52
Windows 2008 R2	47
Windows 2008	44
Windows 2003 R2	31
Windows 2003	30
Windows 2000	13

Windows Server 8 DCPromo Error - FIXED

In a previous post  I showed that there was an error if trying to set the forest and domain functional levels to Windows 8 during DCPROMO using Windows 8 Developers Preview.

Now that Windows Server 8 Beta/Consumer Release Preview has been released I tested the promotion process again.

I once again selected Windows Sever 8 for my functional levels

I am very pleased to report that I no longer receive the same error that I mentioned with Windows Server 8 Developers Preview.

After the promotion is done the Functional Levels are set to Windows Server 8

Nice job with the fix Microsoft AD Team!  

I don't have a comprehensive list of features that are dependent on Windows Server 8 functional levels (forest & domain).  When I have that list I'll post it.

Enjoy Windows Server 8 Beta!