Windows Domain Controller: Create a test environment from a production environment

Question

I need to create a working test environment of a domain we have. I need to have all the data from the production environment in the test environment. What is the best way to go about doing this?

Here are some ideas I have but I am not sure if there is a better/recommended way of doing this.

1. Use Vmware converter to create a VM of one of the production DCs
2. create a VM and promo it on the real domain and move the vm to my test environment.
3. use some kind of backup utility to backup the domain info and restore it to my vm I created.

Thanks in advance for any help!

Solution 1

Personally, I'd just bring up a VM in the production environment and promote it to being a domain controller and let AD fully replicate to it. I'd make a copy of the VM onto a server in the test environment and set it aside. Then I'd demote the VM back out of the production environment.

I'd bring the test machine up on an isolated network, seize all the FSMO roles, and never, ever, EVER bring it up attached to the production network again. (I'd probably make it a DNS server and a client of itself, too.)

That gets around all the P2V-related activities and gets you a "clean" domain controller VM (w/o artifacts of the old physical machine).

For a short time you might have logons serviced by the VM domain controller when it's living in the production environment. I don't see that as a major problem, so long as you handle time sync on the VM in the right manner as suggested by your hypervisor manufacturer.

Solution 2

The easiest way , if your test environment is completely separate from your live one (whihc it should be!), is to take an image of your domain controller and restore this to a machine in your test environment.

Be this using VMware to create a Vm for your test DC, or using a tool like Acronis to clone your DC to new hardware. This way you should just be able to power the new machine backup and be ready to go.

If you find you need to update your test DC with AD data from your live network, you can always do a system state backup and restore AD on the test machine.

Solution 3

1. is a good option, this will also remove any constraints around harware.

2. could get messy.

3. Any system backup software should work, although you'll need to restore it to a server with exact or similar hardware.

Make sure if you take a backup or make an image that your image the server with all the FSMO roles. By default this is the first DC created in a domain, but it's worth checking.

Comments

[J. Singh]

This is the best, fastest, and simplest answer for quickly creating a DC in your one-off test environment. However, it is potentially a good practice to test restoration of the production active directory (via whatever backup software is used) in creating your test domain. You can't test your DR plans often enough.