Active Directory and VMware snapshots

Few thoughts on snapshotting (and reverting to those snapshots) Active Directory Domain Controllers.

"Hey, I'm going to patch this Domain Controller, I'll just snapshot it in case something goes wrong!"

This is just fine. Just throw away the snapshot once you have deemed all is ok. And if your VM got network access, also throw away the snapshot (throw away = delete = commit). Why so?

If you let the DC replicate with other domain controllers, and THEN shut it down and revert a snapshot, you may experience some serious replication problems. So just don't do it, ok? This Microsoft article describes what happens quite well: "How to detect and recover from a USN rollback in Windows Server 2003".

Another very good MS article on virtual DCs is this: "Considerations when hosting Active Directory domain controller in virtual hosting environments".  I agree with the recommendation of keeping the important FSMO roles on a physical Domain Controller for now.

So be careful out there with your DCs.

This short Veeam whitepaper has come out. It explains the issues and how they can be avoided (VSS enabled restores). And of course touts their backup product .