If you are an Active directory admin, there is no need to mention the importance of DNS. A DNS sever is potentially the single point of failure in an AD environment… where an interruption of its service or corruption of any DNS records can bring the whole service down. This demands the need for a proper backup strategy for DNS servers.
Most preferred method for taking back up of DNS server is to do a system state backup. But this cannot be useful in many cases as it requires you to restore AD, Registry settings, DNS etc. while business requirement only needs you to restore the DNS server.
Also there may be cases where the system state restore catalog may be corrupted and you could not restore it. Personally, I have faced situations where the clients are complaining about corrupt system state backups where the users are not able to restore the DNS data using it. So it is always best to keep an independent backup of DNS server along with your normal system state backup.
Before mentioning how these independent backups can be taken for DNS servers, it’s worth mentioning about different AD zones in an AD environment.
• Primary and Secondary zones.
• Active directory integrated zone.
Microsoft recommends using Active directory integrated zone in DNS servers on an AD environment.
Now let’s check how independent backups can be taken on DNS server.
Primary and secondary zones:
Here the zone information will be stored in plain text files. The backup and restore process is pretty straight forward where you can take a copy of text file containing the zone information using XCOPY.
The below command can be used to backup.
XCOPY %SYSTEMROOT%\system32\dns c:\backup\dns /y
To restore the primary and secondary zone information, you only need to simply copy the files from the
\backup\DNS folder to the %SYSTEMROOT%\system32\dns folder
Active Directory integrated zones:
You may be aware that the zone information for Active Directory integrated zone will be stored in AD database rather than as a text file. So the first step in taking the backup is to export the zone information to a file.
DNSCMD /zoneexport test.com backup\test.com.dns.bak
The backup file will be placed in the %systemroot%\system32\dns\backup folder, and will be named test.com.dns.bak.
You can use the backup file just created to restore the AD integrated zone if needed. However, the restore process is bit more complex.
The restoration is a 2 step process.
a. You need to create a primary zone by using the backup file you have created earlier.
b. Converting the primary zone to AD integrated zone.
Before performing the first step, you need to copy the backup file you had created to %systemroot%\system32\dns folder from the backup location. Now, execute the following command.
DNSCMD /zoneadd test.com /primary /file test.com.dns.bak /load
The above command will setup a primary zone in the DNS server using the zone information in the file test.com.dns.bak
Now, you need to convert the primary DNS zone you just created to an AD integrated zone. You can use the following command for that.
DNSCMD /zoneresettype test.com /dsprimary
Note: If you want to enable secure dynamic updates, then you must enter the following command:
DNSCMD /config test.com /allowupdate 2
As a general back up guideline is always a best practice to test the integrity of the backup files at regular intervals by doing test restores on any test network.
Blog by Harivishnu