Windows Domain Controller: Create a test environment from a production environment

Solution 1:

Personally, I'd just bring up a VM in the production environment and promote it to being a domain controller and let AD fully replicate to it. I'd make a copy of the VM onto a server in the test environment and set it aside. Then I'd demote the VM back out of the production environment.

I'd bring the test machine up on an isolated network, seize all the FSMO roles, and never, ever, EVER bring it up attached to the production network again. (I'd probably make it a DNS server and a client of itself, too.)

That gets around all the P2V-related activities and gets you a "clean" domain controller VM (w/o artifacts of the old physical machine).

For a short time you might have logons serviced by the VM domain controller when it's living in the production environment. I don't see that as a major problem, so long as you handle time sync on the VM in the right manner as suggested by your hypervisor manufacturer.

Solution 2:

The easiest way , if your test environment is completely separate from your live one (whihc it should be!), is to take an image of your domain controller and restore this to a machine in your test environment.

Be this using VMware to create a Vm for your test DC, or using a tool like Acronis to clone your DC to new hardware. This way you should just be able to power the new machine backup and be ready to go.

If you find you need to update your test DC with AD data from your live network, you can always do a system state backup and restore AD on the test machine.

Solution 3:

  1. is a good option, this will also remove any constraints around harware.

  2. could get messy.

  3. Any system backup software should work, although you'll need to restore it to a server with exact or similar hardware.

Make sure if you take a backup or make an image that your image the server with all the FSMO roles. By default this is the first DC created in a domain, but it's worth checking.