Microsoft Active Directory

The Microsoft Active Directory (MSAD) integration allows Plakar Control Plane to protect Windows Active Directory Domain Controllers by creating and restoring Windows System State backups.

The integration is built on top of Plakar’s VSS integration. Plakar connects to the Windows host over SSH and creates a System State backup on a dedicated NTFS volume, then takes a VSS snapshot of that volume and transfers the backup files over SFTP into the Kloset store. During recovery, Plakar restores the System State backup to the NTFS volume, allowing Windows Server Backup to restore the Domain Controller once booted into Directory Services Restore Mode (DSRM).

The Microsoft Active Directory integration creates System State backups while a Domain Controller is healthy and online, and restores them when needed. It is intended for disaster recovery scenarios such as hardware failure, data corruption, or ransomware, where no healthy Domain Controller remains available to recover from through normal replication.

Currently no managed inventory has the capability of discovering Microsoft Active Directory resources. You must configure a self-managed inventory before adding an Active Directory resource.

When using a self-managed inventory, you must register resources manually or import them from a CSV file.

To add a Windows Domain Controller, use Database as the class. For the endpoint, use the hostname or IP address of the Domain Controller. See the resources documentation for more information on configuring resources in a self-managed inventory.

flowchart TD

subgraph Windows["Windows Server Domain Controller"]
  AD["Active Directory"]
  WB["Windows System State
 Backup"]
  Drive["Dedicated NTFS
 Backup Volume"]
  VSS["VSS Snapshot"]
end

subgraph Plakar["Plakar Control Plane"]
  Source["MS AD
Source app"]
  Backup["Backup process
Encrypt & deduplicate"]
end

Store["Kloset Store"]

AD --> WB
WB --> Drive
Source -->|"SSH: starts System State
 backup"| WB
Source -->|"SSH: requests
 VSS snapshot"| VSS
Drive --> VSS
VSS -->|"SFTP: transfers
 backup files"| Source
Source --> Backup
Backup --> Store

flowchart TD

Store["Kloset Store"]

subgraph Plakar["Plakar Control Plane"]
  Destination["MS AD
Destination app"]
  Restore["Restore process"]
end

subgraph Windows["Windows Server Domain Controller"]
  Drive["Dedicated NTFS
 Backup Volume"]
end

subgraph Manual["Manual recovery (user-performed)"]
  DSRM["Boot into DSRM"]
  WSB["Windows Server Backup
Recovery Wizard"]
  AD["Active Directory
restored"]
end

Store --> Restore
Destination --> Restore
Restore -->|"SFTP: restores backup files"| Drive
Drive -.->|"user boots into DSRM"| DSRM
DSRM --> WSB
WSB --> AD

Before configuring the integration, the Domain Controller needs Active Directory Domain Services and OpenSSH Server installed and running, along with a dedicated NTFS volume for storing System State backups. The backup volume needs at least 20 GB of available space, though 40 GB or more is recommended.

The dedicated NTFS volume is used to store Windows System State backups before they are transferred into the Kloset store. If the server does not already have a suitable backup volume, initialize one before configuring the integration.

The msad integration relies on OpenSSH Server being installed, running, and reachable on the Windows host before it can be used, with a dedicated SSH key authorized for the administrative account Plakar connects as.

See Setting Up OpenSSH Server on Windows for step-by-step instructions on installing OpenSSH Server, opening port 22, and authorizing an SSH key.

The following settings are available when configuring both source and destination apps.

• Port: The SSH server port. Defaults to 22 if left empty.
• Root: The letter of the Windows drive used to store System State backups, e.g. C:, D:. Required when configuring the destination app.
• Username: Required. The administrative account used to create and restore System State backups.
• SSH Private Key: To authenticate with the remote machine, PCP uses SSH key-based authentication. Generate a dedicated SSH keypair for PCP and add the public key to the Windows host’s authorized keys before configuring this field (see Setting up SSH access on the Windows host above), then copy the private key in full, including the header and footer lines, into this field:

  -----BEGIN OPENSSH PRIVATE KEY-----
  ...
  -----END OPENSSH PRIVATE KEY-----

To restore a Domain Controller from a System State backup, prepare a new host running the same version of Windows Server as the failed Domain Controller. A clean installation is sufficient; it does not need to match the failed server’s hostname or IP address.

Install the Active Directory Domain Services role, but do not configure it, along with the Windows Server Backup feature:

Install-WindowsFeature -Name AD-Domain-Services, Windows-Server-Backup

Configure the destination resource in Plakar and restore the System State backup to the dedicated backup volume before continuing.

Windows Server Backup supports two Active Directory recovery modes, and it is important to choose correctly before running the recovery wizard:

• Authoritative restore marks the recovered Active Directory objects as newer than the copies held by other Domain Controllers, so they replicate outward and overwrite those copies. Use this mode when every Domain Controller has failed, since there is no other copy of Active Directory to preserve. Any changes made after the backup was taken (group membership, application attributes, etc.) will be lost.

• Non-authoritative restore brings the Domain Controller back and lets it pull the latest changes from any Domain Controller that is still healthy, through normal replication. Use this mode whenever another healthy Domain Controller is available.

Before restoring the System State backup, boot the server into Directory Services Restore Mode (DSRM), either through System Configuration (msconfig) by enabling Safe boot > Active Directory repair on the Boot tab, or from an elevated command prompt:

bcdedit /set safeboot dsrepair
shutdown /r /t 0

After the restart, sign in with the local DSRM Administrator account, using the account name in the form .\Administrator.

Open Windows Server Backup (wbadmin.msc) and start the Recovery Wizard.

1. Select A backup stored on another location.
2. Select the dedicated backup volume restored by Plakar.
3. Select the backup date to restore.
4. Choose System State as the recovery type.
5. Select Original location, and, based on the recovery mode chosen above, enable or leave disabled Perform an authoritative restore of Active Directory files.

Windows Server Backup will warn that the backup originates from a different server and that recovery will trigger replication resynchronization once the server comes back online; both warnings are expected in this scenario.

Complete the wizard and let Windows Server Backup finish restoring the System State backup, then restart the server when prompted. The server’s hostname will change to match the Domain Controller recorded in the backup.

After the restore completes, disable DSRM boot:

bcdedit /deletevalue safeboot

Restart the server and sign in with a domain administrator account. If the password is not known, it can be reset once the Domain Controller is back online.

After the server starts normally, confirm Active Directory is functioning. If Active Directory Users and Computers reports that the server is not operational, check whether the SYSVOL and NETLOGON shares are present:

net share

If they are missing, enable the SysvolReady registry value:

1. Open Registry Editor (regedit.exe).
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
3. Change SysvolReady from 0 to 1.
4. Restart the Netlogon service:

   net stop netlogon
   net start netlogon

Confirm the SYSVOL and NETLOGON shares are now available and that the Active Directory Users and Computers console opens successfully.