SAM 8.0 Backup and Restore Guide SafeNet Integration Guide Revision A November 2012
SAM 8.0 Backup and Restore Guide - SafeNet Integration Guide Introduction Copyright 2012 SafeNet, Inc. All rights reserved. All attempts have been made to make the information in this document complete and accurate. SafeNet, Inc. is not responsible for any direct or indirect damages or loss of business resulting from inaccuracies or omissions. The specifications contained in this document are subject to change without notice. SafeNet, SafeNet Authentication Manager and SafeNet Authentication Client are either registered with the U.S. Patent and Trademark Office or are trademarks of SafeNet, Inc., and its subsidiaries and affiliates, in the United States and other countries. All other trademarks referenced in this Manual are trademarks of their respective owners. SafeNet Hardware and/or Software products described in this document may be protected by one or more U.S. Patents, foreign patents, or pending patent applications. Please contact SafeNet Support for details of FCC Compliance, CE Compliance, and UL Notification. Date of Publication: November 2012 Last update: November 2012 ii
SAM 8.0 Backup and Restore Guide - SafeNet Integration Guide Introduction Support We work closely with our reseller partners to offer the best worldwide technical support services. Your reseller is the first line of support when you have questions about products and services. However, if you require additional assistance you can contact the SafeNet technical support team help-desk which is available 24 hours a day, seven days a week: Country/Region Telephone USA +1-800-545-6608 International +1-410-931-7520 Email You can send a question to the SafeNet technical support team at the following email address: support@safenet-inc.com Website You can submit a question through the SafeNet portal: http://c3.safenet-inc.com/secure.asp iii
Table of Contents Introduction... 1 Software Prerequisites... 1 SAM 8.0 Backup... 2 SAM 8.0 Configuration Store Located on AD... 2 Windows Server 2003... 2 Windows Server 2008 / 2008 R2... 6 SAM 8.0 Configuration Store Located on ADAM or LDS... 8 Windows Server 2003... 8 Windows Server 2008 / 2008 R2... 12 SAM 8.0 Server Restore... 16 Restoring SAM 8.0 Server Installed on a Production Domain... 16 Windows Server 2003... 16 Windows Server 2008 / 2008 R2... 21 Restoring SAM 8.0 Server Installed on ADAM... 27 Restoring SAM 8.0 Server Installed on AD LDS... 31 Appendix... 36 v
Chapter 1 Introduction Microsoft Backup is a tool for backing up and restoring the Active Directory. This enables data or system components to be restored in the event of an unforeseen failure. Since SAM 8.0 data is stored in the Active Directory database, it is recommended to use the Microsoft Backup tool to back up and restore all the SAM 8.0 components. The Microsoft Backup tool enables backing up and restoring the following: Entire server Selected files System State data The System State data includes the Active Directory, and all other system components and services on which Active Directory is dependent. On a Windows Server 2003 / 2008 / 2008 R2 domain controller, the System State data encompasses the system startup files, system registry, COM+ class registration database, File Replication service (the SYSVOL directory), Certificate Services database (if installed), Domain Name System (if installed), Cluster service (if installed) and Active Directory. The Domain Name System (DNS) data includes DNS zone information that is Active Directory integrated. The Cluster service data includes all registry checkpoints and the quorum log containing the most recent cluster database information. For more information regarding the backup and restore process using Microsoft tools, see the appropriate link: AD LDS Backup and Restore: http://technet.microsoft.com/en-us/library/cc725665(v=ws.10).aspx Active Directory Backup and Restore: http://technet.microsoft.com/en-us/library/bb727048.aspx http://technet.microsoft.com/en-us/library/cc754097(ws.10).aspx Software Prerequisites The user must know how to use the following components: SAM 8.0 Microsoft Server 2003 SP2, or Microsoft Server 2008 SP2, or Microsoft 2008 R2 SP1 For more information on any of these products, please refer to the relevant documentation. 1
SAM 8.0 Backup Chapter 2 SAM 8.0 Backup The SAM configuration store can be stored on one of the following: Active Directory (AD) Active Directory Application Mode (ADAM), under Windows Server 2003 Active Directory Lightweight Directory Services (AD LDS), under Windows Server 2008 or Server 2008 R2 SAM 8.0 Configuration Store Located on AD For a SAM 8.0 installation on Active Directory, back up the Active Directory on which SAM 8.0 is installed. This section describes the steps to back up all SAM 8.0 components as part of the Active Directory backup procedure. Windows Server 2003 To back up Active Directory on Windows Server 2003: 1. From the Start menu, go to Programs > Accessories > Systems Tools > Backup. 2
SAM 8.0 Backup The Backup or Restore Wizard opens. 2. Click Next. The Backup or Restore options are displayed. 3. Select Back up files and settings, and click Next. 3
SAM 8.0 Backup The What to Back Up window opens. 4. Select Let me choose what to back up, and click Next. The Items to Back Up window opens. 5. In the left panel, under My Computer, select System State, and click Next. 4
SAM 8.0 Backup The Backup Type, Destination and Name window opens. 6. In Choose a place to save your backup, enter the location to save the backup file, or click Browse and navigate to the required location. 7. Click Next. The Completing the Backup or Restore Wizard window opens. 8. Click Finish. The backup process begins. 5
SAM 8.0 Backup Upon completion, the Backup Progress window opens. 9. To see detailed information, click Report. 10. Click Close. Windows Server 2008 / 2008 R2 To back up Active Directory on Windows Server 2008 or Windows Server 2008 R2: 1. In the server manager, go to Add Features Wizard > Select Features, and add all the Windows Server Backup Features. 2. Click Next, and finish installing the features. 3. Ensure that the system is running with Administrator rights. 4. From the Start menu, go to Run, enter cmd, and click OK. The command line window opens. 6
SAM 8.0 Backup 5. To begin the backup, run the command: wbadmin start systemstatebackup -backuptarget:<targetdrive>: -quiet where <targetdrive> identifies the local volume or the physical disk drive letter to receive the backup. Note: A system state backup cannot be stored on a network shared drive. If the -quiet parameter is not specified, a prompt to proceed with the backup operation is displayed. Click Y to proceed with the backup. 6. Wait for the backup to finish. 7. Close the window. Caution In Windows Server 2008 R2, you need to enable the command before running it. To enable the command, run: dism/online/enable-feature/featurename:windowsserverbackup Note: In Windows Server 2008 R2, there is another method to perform the backup using the GUI. For more information about this method refer to http://technet.microsoft.com/enus/library/cc754097(ws.10).aspx 7
SAM 8.0 Backup SAM 8.0 Configuration Store Located on ADAM or AD LDS If the SAM configuration store is not stored on Active Directory, it can be stored on Active Directory Application Mode (ADAM) for Windows Server 2003, or Active Directory Lightweight Directory Services (AD LDS) for Windows Server 2008 or Windows Server 2008 R2. Windows Server 2003 To back up a configuration store instance stored on ADAM: 1. From the Start menu, go to Programs > Accessories > Systems Tools > Backup. The Backup or Restore Wizard opens. 2. Click the link for Advanced Mode. 8
SAM 8.0 Backup The Backup Utility window opens. 3. Select the Backup tab. 4. From the Job menu, select New. A new job opens. 5. From the Tools menu, select Options. 9
SAM 8.0 Backup The Options window opens. 6. Select the Restore tab. 7. Select Always replace the file on my computer, and click OK. 8. In the left panel, expand the ADAM instance s root folder. 9. Select the ADAM instance s root folder and all the ADAM instance folders to back up. The following table lists the default ADAM folders. Directory Contents \%ProgramFiles%\Microsoft ADAM\<instancename> where <instancename> is the ADAM instance name Database files and log files \%windir%\adam Program files and administration tools 10
SAM 8.0 Backup 10. To back up the System State, in the left panel, select My Computer > System State. 11. In the Backup destination dropdown box, select one of the following: File:To back up files and folders to a file. Tape drive:to back up files and folders to a tape. If a tape drive is not connected to the computer, the Backup destination option is automatically set to File and is disabled. 12. In Backup media or file name, enter the path and file name of the location to which the backup will be written. When backing up files and folders to a file, type a path and file name for the backup (.bkf) file. Alternatively, click Browse to navigate to the required folder, or to find a file. When backing up files and folders to a tape, select the tape to use. Note: To select other backup options, such as Backup type and Backup log type, select Tools > Options from the menu. 13. Click Start Backup. 11
SAM 8.0 Backup The Backup Job Information window opens. 14. Ensure that all the settings are appropriate, and click Start Backup. Caution: If data is backed up from an NTFS volume, it is recommended that the data be restored to an NTFS volume of the same version to prevent loss of data. Windows Server 2008 / 2008 R2 To back up a configuration store instance stored on AD LDS: 1. In the server manager, go to Add Features Wizard > Select Features, and add all the Windows Server Backup Features. 2. Click Next, and finish installing the features. 3. From the Start menu, select All Programs > Administrative Tools > Windows Server Backup. 12
SAM 8.0 Backup The Windows Server Backup window opens. 4. In the Actions panel, select Backup Once. The Backup options window opens. 5. Select Different options, and click Next. 13
SAM 8.0 Backup The Select backup configuration window opens. 6. Select Custom, and click Next. The Select Items for Backup window opens. 7. Click Add Items to add the volume or volumes containing the AD LDS database; then click Next. 14
SAM 8.0 Backup The Specify destination type window opens. 8. Do one of the following: Select Local drives if the backup is to be stored locally. Select Remote shared folder, if the backup is to be stored remotely. 9. Click Next. The Select Backup Destination window opens. 10. Specify the appropriate drive on which the backup is to be written, and click Next. The Confirmation window opens. 11. Click Backup to complete the wizard and begin the backup. 12. After the backup is complete, close the Windows Server Backup window. Caution: If data is backed up from an NTFS volume, it is recommended that the data be restored to an NTFS volume of the same version to prevent loss of data. 15
SAM 8.0 Restore Chapter 3 SAM 8.0 Restore The restore process returns objects to the state they were in when the backup process was performed. An Authoritative Restore is a restore process that is performed on a designated object or container of objects. The SAM 8.0 Server Restore uses an Authoritative Restore process to restore SAM 8.0 objects only. All SAM 8.0 objects are marked as authoritative, enabling the replication process to restore them to all the other domain controllers in the domain. Restoring SAM 8.0 Server Installed on a Production Domain The production domain backup process backs up all Active Directory objects. When running the SAM 8.0 Restore, only the SAM 8.0 objects are to be restored. The other Active Directory objects should be managed by general Active Directory maintenance. Caution: Follow all steps. Do not restart your computer at the end of the Restore process!!! Click No when requested to restart the computer. If the computer is accidentally restarted, a regular, non-authoritative Restore is performed. Windows Server 2003 To restore a SAM 8.0 server installed on a production domain: 1. Restart the computer in DSRM (Directory Services Restore Mode): a. From the Start menu, go to Run, enter cmd, and click OK. The command line window opens. b. Run the command: bcdedit /set safeboot disrepair 2. After the computer restarts, log on as a local administrator. 16
SAM 8.0 Restore 3. From the Start menu, go to Programs > Accessories > Systems Tools > Backup. The Backup or Restore Wizard opens. 4. Click Next. 17
SAM 8.0 Restore The Backup or Restore options are displayed. 5. Select Restore files and settings, and click Next. The What to Restore options are displayed. 6. Select the most recent backup file saved, and click Next. 18
SAM 8.0 Restore The Completing the Backup or Restore Wizard window is displayed. 7. Click Finish. A warning message is displayed. 8. Click OK to restore the System State. Upon completion, the Restore Progress window opens. 9. To see detailed information, click Report. 10. Click Close. A message is displayed. 19
SAM 8.0 Restore 11. Do one of the following: If the production domain was restored, click No because further steps must be performed. The procedure ends. If objects other than the production domain were restored, click Yes. 12. If the production domain was restored, from the Start menu, go to Run, enter ntdsutil, and click OK. The Ntdsutil prompt opens. 13. Enter ac i ntds, and press Enter. 14. Enter authoritative restore, and press Enter. 15. Enter the following command to restore the SAM 8.0 components: restore subtree CN=TMS_DB,DC= domain_name,dc= domain name prefix For example, if the domain is corp.banana.com, enter the following: restore subtree CN=TMS_DB,DC=corp,DC=banana,DC=com 16. Press Enter. A prompt is displayed asking if you are sure you want to perform the Authoritative Restore. 17. Click Yes. Ntdsutil attempts to mark the object as authoritative. An output message is displayed, indicating the operation s status. 20
SAM 8.0 Restore 18. Enter quit, and press Enter, at the following prompts: authoritative restore ntdsutil 19. In the command line, run: bcdedit /deletevalue safeboot. 20. Restart the domain controller in normal operating mode. 21. Synchronize the replication with all partners. Windows Server 2008 / 2008 R2 To restore a SAM 8.0 server installed on a production domain: 1. Restart the computer in DSRM (Directory Services Restore Mode): a. During the boot, press the F8 key repeatedly. Do this immediately after BIOS POST screen, before the Windows logo appears. A text menu will appear. b. Use the up/down arrow keys to select Directory Services Restore Mode or DS Restore Mode. Then press Enter. 2. Log on as a local administrator. 3. From the Start menu, select All Programs > Administrative Tools > Windows Server Backup. 21
SAM 8.0 Restore The Windows Server Backup window opens. 4. In the Actions panel, select Recover. The Recovery Wizard opens. 22
SAM 8.0 Restore 5. Select A backup stored on another location, and click Next. The Specify Location Type window opens. 6. Choose your backup location type, and click Next. The Select Backup Location window opens. 7. Select the backup file s location, and click Next. 23
SAM 8.0 Restore The Select Server window opens. 8. Select the server, and click Next. The Select Backup Date window opens. 9. Select the date of the most recent backup, and click Next. 24
SAM 8.0 Restore The Select Recovery Type window opens. 10. Select System state, and click Next. The Select Location for System State Recovery window opens. 11. Select the following: Original location Perform an Authoritative restore of Active Directory files 12. Click Next. A notification is displayed. 25
SAM 8.0 Restore 13. Click OK. A second notification is displayed. 14. Click OK. The Confirmation window opens. 15. Click Recover to complete the wizard and begin the restore. A warning message is displayed. 16. Click Yes. 26
SAM 8.0 Restore The recovery process begins. When the process completes, a Restart message is displayed. 17. Click Restart. When the restart completes, a notification is displayed. 18. Press Enter. Restoring SAM 8.0 Server Installed on ADAM Caution: Follow all steps. Do not restart your computer at the end of the Restore process!!! Click No when requested to restart the computer. If the computer is accidentally restarted, a regular, non-authoritative Restore is performed. To restore a SAM 8.0 server installed on ADAM: 1. In Administrative Tools, select Services, and stop the ADAM instance. 27
SAM 8.0 Restore 2. From the Start menu, select Programs > Accessories > System Tools >Backup. The Backup or Restore Wizard opens. 3. Click the link for Advanced Mode. 28
SAM 8.0 Restore The Backup Utility window opens. 4. Select the Restore and Manage Media tab. The Restore and Manage Media tab opens. 5. Select the backup file to be restored for the instance. 6. In the Restore files to dropdown box, select Original location. 7. From the Tools menu, select Options. 29
SAM 8.0 Restore The Options window opens. 8. Select the Restore tab. 9. Select Always replace the file on my computer, and click OK. 10. Click Start Restore. Upon completion, the Confirm Restore window opens. 11. Click OK. Upon completion, the Restore Progress window opens. 12. To see detailed information, click Report. 13. Click Close. 14. From the Start menu, select All Programs > ADAM > ADAM Tools Command Prompt. The ADAM tools command prompt opens. 15. Enter dsdbutil, and press Enter. 16. Enter activate instance <instancename> where <instancename> is the service name of the ADAM instance for which data is to be restored. 17. Press Enter. 18. Enter authoritative restore, and press Enter. 19. Enter the following command to restore the SAM 8.0 components: restore subtree CN=TMS_DB,DC= domain_name,dc= domain name prefix For example, if the domain is corp.banana.com, enter the following: restore subtree CN=TMS_DB,DC=corp,DC=banana,DC=com 20. Press Enter. 30
SAM 8.0 Restore A prompt is displayed asking if you are sure you want to perform the Authoritative Restore. 21. Click Yes. dsdbutil attempts to mark the object as authoritative. An output message is displayed, indicating the operation s status. 22. Enter quit, and press Enter, at the following prompts: authoritative restore dsdbutil 23. In Administrative Tools, select Services, and start the ADAM instance. Restoring SAM 8.0 Server Installed on AD LDS Caution: Follow all steps. Do not restart your computer at the end of the Restore process!!! Click No when requested to restart the computer. If the computer is accidentally restarted, a regular, non-authoritative Restore is performed. To restore a SAM 8.0 server installed on AD LDS: 1. In Administrative Tools, select Services, and stop the AD LDS instance. 2. From the Start menu, select All Programs > Administrative Tools > Windows Server Backup. 31
SAM 8.0 Restore The Windows Server Backup window opens. 3. In the Actions panel, select Recover. The Recovery Wizard opens. 32
SAM 8.0 Restore 4. Depending on where the backup files are located, select one of the following, and click Next. This server A backup stored on another location The Select Backup Date window opens. 5. Select the date of the most recent backup, and click Next. The Select Recovery Type window opens. 6. Select Files and folders, and click Next. 33
SAM 8.0 Restore The Select items to recover window opens. 7. Browse to, and select, the folder containing the instance data files. By default, AD LDS database and log files are located in %ProgramFiles%\Microsoft ADAM\<instance_name>\data where <instance_name> is the AD LDS instance name. 8. Click Next. The Specify Recovery Options window opens. 9. Select the following, and click Next. Original location Overwrite the existing versions with the recovered files 34
Appendix The Confirmation window opens. 10. Click Recover to complete the wizard and begin the restore. 11. After the restore is complete, close the Windows Server Backup window. 12. From the Start menu, right-click Command Prompt, and select Run as administrator. The command prompt opens. 13. Enter dsdbutil, and press Enter. 14. Enter activate instance <instancename> where <instancename> is the service name of the ADAM instance for which data is to be restored. 15. Press Enter. 16. Enter authoritative restore, and press Enter. 17. Enter the following command to restore the SAM 8.0 components: restore subtree CN=TMS_DB,DC= domain_name,dc= domain name prefix For example, if the domain is corp.banana.com, enter the following: restore subtree CN=TMS_DB,DC=corp,DC=banana,DC=com 18. Press Enter. A prompt is displayed asking if you are sure you want to perform the Authoritative Restore. 19. Click Yes. dsdbutil attempts to mark the object as authoritative. An output message is displayed, indicating the operation s status. 20. Enter quit, and press Enter, at the following prompts: authoritative restore dsdbutil 21. In Administrative Tools, select Services, and start the AD LDS instance. 35
Appendix Appendix This document describes the backup and restore of a SAM database only. The SAM database is encrypted using the SAM Settings File. Without this file, a restored SAM database cannot be used. To ensure the full recovery of SAM, use the SAM Configuration Manager to back up the SAM Settings File whenever the SAM database is backed up. To back up the SAM Settings File: 1. From the Start menu, go to Programs > SafeNet > SafeNet Authentication Manager > Configuration Manager. The SAM Configuration Manager opens. 2. From the Action menu, select Settings File > Export. 3. Create a password for the backup file, and export the file. To restore the SAM Settings File: 1. From the Start menu, go to Programs > SafeNet > SafeNet Authentication Manager > Configuration Manager. The SAM Configuration Manager opens. 2. From the Action menu, select Settings File > Import. 3. Enter the location and the password of the backup file, and import the file. 36