{"id":303,"date":"2017-10-29T14:49:21","date_gmt":"2017-10-29T14:49:21","guid":{"rendered":"http:\/\/www.ciraltos.com\/?p=303"},"modified":"2023-03-24T00:40:45","modified_gmt":"2023-03-24T05:40:45","slug":"recover-encrypted-windows-azure-vm","status":"publish","type":"post","link":"https:\/\/www.ciraltos.com\/staging2\/recover-encrypted-windows-azure-vm\/","title":{"rendered":"Recover Encrypted Windows Azure VM"},"content":{"rendered":"

\"DiskThe number one rule in disaster recovery is to keep a copy of your resume off site.\u00a0 Number two is test backups and recovery.\u00a0 An unrecoverable backup is useless and a disaster is no time to find out something went wrong.\u00a0 This is a second part of a previous post on encrypting Windows hard drive in Azure.\u00a0 The first part is available here<\/a>.\u00a0 In this post I will go over how to backup and recover encrypted Windows Azure VM using Recovery Services Vault.<\/p>\n

<\/h2>\n

Before we begin<\/h2>\n

This would not be a complete post without qualifications and cautions to start with.\u00a0 First, much of the post below comes from the Microsoft document here<\/a>.\u00a0\u00a0There is a lot of good information in this document and I suggest taking a look.<\/p>\n

This post will skip configuration and implementation of the Recovery Services Vault for brevity.\u00a0 This post assumes you have a Recovery Services Vault setup in the same region as the VM you want to back up and are successfully backing up non-encrypted VM\u2019s.\u00a0 If you don\u2019t have this setup you can start from here<\/a>.<\/p>\n

My previous post here <\/a>indicates there is some conflicting information on the need for a KEK to recover a VM or if a BEK only will work.\u00a0 This post will stick with the KEK method only.\u00a0 And for the record, I\u2019m using non-managed disks.<\/p>\n

Permissions<\/h2>\n

Before you can restore a server, you must back it up (thank you Captain Obvious).\u00a0 Backing up encrypted servers is the same as non-encrypted servers with one important exception; the encryption keys need to be backed up with the virtual hard drive.<\/p>\n

The encryption keys are stored in the Key Vault.\u00a0 In order for the Recovery Vault service to back them up, it needs read access to the Key Vault with those keys.\u00a0 The following steps will give the Recovery Vault service access to the Key Vault that has the keys.<\/p>\n

First, log into Azure and open the Key Vault that has the Keys used to encrypt your VM.\u00a0 From there, go to Access Policies and Add New.<\/p>\n

Under Select Principal, search and select Backup Managed Service.\u00a0 Next, go to Configure From Template (optional) and select Azure Backup.\u00a0 In the end, it should look like this:<\/p>\n

\"restore<\/a><\/p>\n

Backup<\/h2>\n

Next, Backup those encrypted VM\u2019s.\u00a0 The Azure Recovery Vault now has access to the keys and will back up the keys along with the server.\u00a0 Servers can be backed up from the Recovery Vault or from Backup under the server blade or by schedule just like a non-encrypted server.<\/p>\n

Restore, the bad news<\/h2>\n

This is where things get interesting.\u00a0 For non-encrypted disks, you have three options to restore VM\u2019s as outlined in the articles below.\u00a0 They include creating a new VM from backup, restoring disks or recovering files.<\/p>\n

https:\/\/docs.microsoft.com\/en-us\/azure\/backup\/backup-azure-arm-restore-vms<\/a>
\nhttps:\/\/docs.microsoft.com\/en-us\/azure\/backup\/backup-azure-restore-files-from-vm<\/a><\/p>\n

But this post covers VM\u2019s with encrypted disks and as it turns out, options are limited.\u00a0 The only option available is to restore the disks to a storage account.<\/p>\n

Restore, the good news<\/h2>\n

Although some of the options are missing, such as file level restore, it\u2019s not that difficult to recover an encrypted VM.\u00a0 Start by restoring the disks from a recovery point.\u00a0 Once the disks are restored a new VM will be created from those disks.<\/p>\n

The following steps will require a Storage Account to recover the disks to.\u00a0 Consider using a dedicated Resource Group and Storage Account if the recovered VM will be temporary.\u00a0 This will simplify removal of the VM and associated resources when finished.<\/p>\n

Go into the Recovery Services Vault and navigate to the Backup Items, Azure Virtual Machine, and select the VM you want to recover.<\/p>\n

At the top of the server selected in Backup Items, select the option for Restore VM.<\/p>\n

\"encrypted<\/a><\/p>\n

The Restore blade will open and you will be prompted to select a recovery point.\u00a0 Select the point in time you want to recover from and click OK.<\/p>\n

\"encrypted<\/a><\/p>\n

A note about Date Consistency:<\/h4>\n

There are three consistency options for the VM recovery points.\u00a0 Below is a brief description of each.<\/p>\n