On-prem AD backup to Azure Backup

Ramanjaneyulu Butharaju 421 Reputation points
2021-07-07T04:52:20.623+00:00

Hello Azure Experts,

We are planning to backup the AD server to Azure using the recovery service key vault.
We have Many DCs in place at respective locations. We just want to take the only backup where FSMO roles are installed.
It is a physical server(let's call it "PDC").

We have installed Microsoft Azure backup agent in the PDC server and configured the system state backup to azure every day.

My question is, Consider if an attacker compromised On-prem DC servers including PDC and we have lost access to all the DCS.

Now we only have the system state backup in azure, can we restore that backup in any new server, and can we up all AD services back to normal ??

Please suggest if there are any alternative solutions.

Regards,
Ram

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,124 questions
Azure Backup
Azure Backup
An Azure backup service that provides built-in management at scale.
1,132 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,898 questions
Windows Server Backup
Windows Server Backup
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Backup: A duplicate copy of a program, a disk, or data, made either for archiving purposes or for safeguarding valuable files from loss should the active copy be damaged or destroyed.
452 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pierre Audonnet - MSFT 10,166 Reputation points Microsoft Employee
    2021-07-22T01:52:26.623+00:00

    System State backups are intended to be restored on the same hardware. You can restore them on different hardware but there are risk of drivers issues that can make the entire thing a bit challenging. But nowadays with virtualization, the emulated hardware is easy to match so it is not often an issue...

    I would suggest to have more than one DC backed up. It's okay if they are not FSMO holder as you can seize the role during a recovery.
    I would also strongly recommend you test your backups in a lab environment (disconnect from your production environment) then you will be able to vouch for your backup, train on the recovery steps, and evaluate how long a recovery could be.

    On another note, you can also use a bare metal backup (BMR). You could either backup the BMR in Azure Recovery Vault as files, or use Azure Backup Server to do directly BMR to the vault: https://learn.microsoft.com/en-us/azure/backup/backup-mabs-system-state-and-bmr

    If you have DCs as VM in Azure, you can do BMR without having to deploy Azure Backup Server, so it make the backup and the recovery much easier.

    1 person found this answer helpful.
    0 comments