Backup and restore a domain

This topic shows you how to do the following tasks in Managed Service for Microsoft Active Directory (Managed Microsoft AD):

  • Take a backup of your existing domain which saves the current state of your domain.
  • List the backups available for your domain.
  • Restore domain to a previous state using domain backup.
  • Get metadata information about a specific domain backup.
  • Update labels for your domain backup.
  • Delete backups which you no longer need.

Overview

Managed Microsoft AD supports backing up and restoring your domains. There are three types of backups available:

  • On-demand backup: You can create up to five on-demand backups manually.
  • Scheduled backup: Scheduled backup is created every 12 hours automatically.
  • Schema extension backup: Managed Microsoft AD creates a backup automatically when you initiate schema extension.

You can use any of these backup types to perform an authoritative restore, which returns the domain to a previous point in time.

The backup operation takes backup from the primary region domain controller. When restored, it replicates automatically to all regions.

If a domain already contains five on-demand backups, you must delete one before you can create a new one.

Note that during a restore, you cannot use your domain.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  3. Make sure that billing is enabled for your Cloud project. Learn how to check if billing is enabled on a project.

  4. Enable the Managed Microsoft AD, Cloud DNS, and Compute Engine APIs.

    Enable the APIs

  5. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  6. Make sure that billing is enabled for your Cloud project. Learn how to check if billing is enabled on a project.

  7. Enable the Managed Microsoft AD, Cloud DNS, and Compute Engine APIs.

    Enable the APIs

  8. Make sure that you have created a Managed Microsoft AD domain.
  9. Make sure that you have any one of the following IAM user roles:
    • Google Cloud Managed Identities Backup Admin (roles/managedidentities.backupAdmin)
    • Google Cloud Managed Identities Domain Admin (roles/managedidentities.domainAdmin)
  10. For more information, see Cloud Managed Identities roles.

Gather information

You need the following information to create or restore a backup:

  • Domain name: The name of your Managed Microsoft AD domain. For example, my-domain.example.com.
  • Backup name: The name for your backup must follow these rules:

    • Must start with a letter.
    • Must contain between 1-63 characters.
    • Must end with a number or a letter.
    • Must be unique within the domain.

Create a domain backup

To create a domain backup, run the following gcloud CLI command from the project where you created your Managed Microsoft AD domain.

  gcloud active-directory domains backups create BACKUP_NAME
    --domain=DOMAIN_NAME
    --project=DOMAIN_RESOURCE_PROJECT_ID
  

Replace the following:

  • BACKUP_NAME: A name for your domain backup. For example, my-domain-backup.
  • DOMAIN_NAME: The name of your Managed Microsoft AD domain. For example, my-domain.example.com.
  • DOMAIN_RESOURCE_PROJECT_ID: The project ID of the domain resource project. For example, my-project.

You receive the following response that indicates that backup creation has started:

  Create request issued for: [BACKUP_NAME]
  Waiting for operation [OPERATION_ID] to complete...
  

It can take up to 90 minutes to create a backup. Alternatively, you can add the --async flag to execute the command in the background. Note that you can repeat this process to create up to five independent on-demand backups for a domain.

Restore a domain from a backup

Before you restore a domain, make sure you refer these important considerations.

To restore the domain, run the following gcloud CLI command from the project where you created your Managed Microsoft AD domain.

  gcloud active-directory domains restore DOMAIN_NAME
    --backup=BACKUP_NAME
    --project=DOMAIN_RESOURCE_PROJECT_ID
  

Replace the following:

  • DOMAIN_NAME: The name of your Managed Microsoft AD domain. For example, my-domain.example.com.
  • BACKUP_NAME: The name of your domain backup. For example, my-domain-backup.
  • DOMAIN_RESOURCE_PROJECT_ID: The project ID of the domain resource project. For example, my-project.

You receive the following response that indicates that the restore process has started:

  Request issued for: [DOMAIN_NAME]
  Waiting for operation [OPERATION_ID] to complete...
  

It can take up to 90 minutes to restore a domain. Alternatively, you can add the --async flag to execute the command in the background.

Manage backups

To manage your backups, you can run the following gcloud CLI commands from the project where you created your Managed Microsoft AD domain.

List backups

You can list the backups created for a specific domain. Run the following gcloud CLI command:

  gcloud active-directory domains backups list
    --domain=DOMAIN_NAME
    --project=DOMAIN_RESOURCE_PROJECT_ID
  

Replace the following:

  • DOMAIN_NAME: The name of your Managed Microsoft AD domain. For example, my-domain.example.com.
  • DOMAIN_RESOURCE_PROJECT_ID: The project ID of the domain resource project. For example, my-project.

Get backup information

You can retrieve all the information specific to a domain backup. Run the following gcloud CLI command:

  gcloud active-directory domains backups describe BACKUP_NAME
    --domain=DOMAIN_NAME
    --project=DOMAIN_RESOURCE_PROJECT_ID
  

Replace the following:

  • BACKUP_NAME: The name of your domain backup. For example, my-domain-backup.
  • DOMAIN_NAME: The name of your Managed Microsoft AD domain. For example, my-domain.example.com.
  • DOMAIN_RESOURCE_PROJECT_ID: The project ID of the domain resource project. For example, my-project.

Update labels for a backup

You can update labels for a domain backup that you created manually. Run the following gcloud CLI command:

  gcloud active-directory domains backups update BACKUP_NAME
    --domain=DOMAIN_NAME
    --project=DOMAIN_RESOURCE_PROJECT_ID
    --update-labels=KEY=VALUE
  

Replace the following:

  • BACKUP_NAME: The name of your domain backup. For example, my-domain-backup.
  • DOMAIN_NAME: The name of your Managed Microsoft AD domain. For example, my-domain.example.com.
  • DOMAIN_RESOURCE_PROJECT_ID: The project ID of the domain resource project. For example, my-project.
  • KEY and VALUE: A key-value pair that you want to add to your domain backup. For example, backupcount=1.

Delete a backup

To delete a domain backup, run the following gcloud CLI command:

  gcloud active-directory domains backups delete BACKUP_NAME
    --domain=DOMAIN_NAME
    --project=DOMAIN_RESOURCE_PROJECT_ID
  

Replace the following:

  • BACKUP_NAME: The name of your domain backup. For example, my-domain-backup.
  • DOMAIN_NAME: The name of your Managed Microsoft AD domain. For example, my-domain.example.com.
  • DOMAIN_RESOURCE_PROJECT_ID: The project ID of the domain resource project. For example, my-project.