Go Premium for a chance to win a PS4. Enter to Win


Authoritative restore on entire Domain Controller generates LDIF files?

Posted on 2014-07-18
Medium Priority
Last Modified: 2014-07-29
I'm running some disaster recovery tests by restoring our Win 2003 SP2 DC VMs from backup into a test environment. We use VSS compliant backups. The first DC I bring up holds the FSMO roles and I start it in DSRM and use ntdsutil to do an authoritative restore on the database. Once it's done, it generates who LDIF files containing back links for AD objects.

Now, from reading the MS documentation and from my own experiments, because I'm doing an authoritative restore on the entire database (instead of an individual object) and since I have a single domain, I should NOT have to import the LDIF files to restore membership information.

Is this correct?
Question by:donohoe1
  • 4
  • 3
LVL 38

Expert Comment

ID: 40205359
In reality you should not use AD authoritative restore unless you have strong reason to do so
Authoritative restore only recommended when your AD is corrupted, you cannot logon to AD or if you have to revert functional levels from later version to previous versions

You may get restored user group membership with complete AD database authoritative restore but its not required and not recommended

Your testing should include deletion of some users and groups and then restore them authoritatively. Check below article

Normally 2003 and above functional levels authoritative restore will restore group membership as well when groups are created post LVR, however Due to active directory limitations, sometimes your authoritative restore on domains that are having 2003 and above functional levels still unable to restore group membership due to AD replication order.

In addition to standard way of restoring backlinks the alternate solution to your Problem:
The easiest solution to this problem is to perform the authoritative restore of the groups a second time. After you perform the first authoritative restore, reboot into normal mode and make sure that replication takes place properly. Then reboot back into DSRM and run NTDSUTIL to perform an authoritative restore of the groups the user was a member of. This guarantees that when you boot back into normal mode, the user object will have replicated out before the group objects referring to it replicate.

Author Comment

ID: 40205367
I'm not looking at restoring just one or a couple active directory objects, I'm looking at restoring the entire servers. The test I'm running is restoring the entire network from the ground up. It's a disaster recovery scenario where we've lost the server room and need to get things running again from only our backups.
LVL 38

Expert Comment

ID: 40205419
In that case just check 1st link in my comment above
It state about AD forest recovery scenario from scratch
In that case you don't have to restore backlinks again because you don't have any other domain controllers online and the DC that you will restore will be the 1st restored DC and rest of the DCs will be created as standard ADC process or can be just restored with non-authoritative restore process
NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.


Author Comment

ID: 40205452
That first link actually did help me. In the "Restore the first writeable domain controller in each domain" section it states:

Because this is the first writeable DC in the domain, you must perform a nonauthoritative restore of AD DS and an authoritative restore of SYSVOL. The restore operation must be completed by using an Active Directory-aware backup and restore application, such as Windows Server Backup (that is, you should not restore the DC by using unsupported methods such as restoring a VM snapshot).

Therefore I can just bring up my first DC as nonauthoritative (which is very easy to do) and the just set the SYSVOL to authoritative (als very easy) and then bring up the additional DCs.
LVL 38

Expert Comment

ID: 40205601
That's right, however series of steps you need to follow to do forest recovery
You can download AD forest recovery guide for full information.
Normally you should not attempt that step unless Microsoft has suggested to do that because it is last step, in case of data center outage you don't have any choice other than forest recovery

Author Comment

ID: 40205731
Per the article Microsoft only wants you to restore one DC and then use promotion to add the rest. Do you know why that's the case? If you have good backups of the other DCs why not restore them as well?
LVL 38

Accepted Solution

Mahesh earned 2000 total points
ID: 40206191
Probably below post should gives you answer

With windows 2008 and above MS has removed \ silently dropped "restore entire Database" under authoritative restore in ntdsutil.
They have not published this for external world, you may be found some documentation with MS internally
MS has found serious problems with that command and hence it is been removed.

The scenario you are looking for can be bit simple
After restoring 1st DC with auth-Sysvol there is one step to remove references to all DCs, you need to skip this step and then you can restore another DCs with backup non-authoritatively, if you removed references at 1st place, then you are forced to deploy new ADC from scratch.
As a fact if you restore AD with authoritative Sysvol option on 1st DC, in reality AD get restored non authoritatively except Sysvol and hence it cannot replicate \ enforce restored version to another  non-authoritatively restored DC (another DC from backup without auth Sysvol option) and if another restored DC has some changes with higher USN (Ex user deletion, functional level raise) etc, those will get replicated to 1st DC

If your AD health is clean and healthy before disaster, you can use this approach, however you need to ensure that backups used for restore are within same time range and there should not be any major changes between restored system state backup otherwise it may generate unpredictable results.

However if AD database level corruption occurs and already replicated to all DCs and its also backed up with system state backups, you should not use above approach in order to get clean AD environment again

As a fact what MS is recommending \ wants you to restore one DC and then use promotion to add the rest.

Hope that helps


Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Backups and Disaster RecoveryIn this post, we’ll look at strategies for backups and disaster recovery.
Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

877 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question