Active Directory Authoritative and Non Authoritative restore

Focus: Authoritative and Non Authoritative restoration

 Non Authoritative Restore
  • Non-Authoritative restore brings back the DC to its state at the time of backup.
  • After the restoration, other DCs will replicate with the newly restored DC with the changes occurred after the backup.
  • This method is mainly used when a DC fails due to hardware/software issue.
  • Non-Authoritative restore is performed in Directory Service Restore Mode (DSRM).

 Authoritative Restore
  • Authoritative restore is to help administrators to revert or undo any change made in AD mainly caused by human errors
  • The most common example is the restoration of a deleted object.
  • When an Authoritative restoration of an object is done, the version number of all attributes of that object will be incremented thereby making it authoritative.
  • After restoration, as with the non authoritative restore, the restored DC contacts other DCs and the newly restored object will be replicated to the other DCs due to its higher version number which makes it appear to be more recent.
  • Authoritative restore makes use of ntdsutil tool for restoration.
  • Authoritative restore is performed in Directory Service Restore Mode (DSRM).

How to restore ?
  • First and foremost, a genuine backup should be there. Take the backup after installing Windows Server Backup feature.
  • The account should have domain admin privilege
  • Restart the server in DSRM
  • Open Command prompt and execute the below command to get the list of available backups :
    •  wbadmin get versions
  • Once you get the list of available backups, restore using the below command:
    • wbadmin start systemstaterecovery -version:<version id of the backup to be used>
  • Now you have completed the non authoritative restore of AD
If you want to authoritatively restore an object (testuser) follow the below steps as well in DSRM:
    • In command prompt type ntdsutil and press Enter
    • activate instance NTDS
    • Authoritative restore
    • Now restore the deleted object using the below command
    • Restore Object “CN=Testuser,CN=Users,DC=testdomain,DC=com”
    • Restart the DC

Comments

Post a Comment

Popular posts from this blog

VMware and Windows Interview Questions: Part 2

Image
VMware and Windows Interview Questions: Part 1 VMware and Windows Interview Questions: Part 2 VMware and Windows Interview Questions: Part 3 VMware and Windows Interview Questions: Part 4 VMware and Windows Interview Questions: Part 5 VMware and Windows Interview Questions: Part 6 VMware and Windows Interview Questions: Part 7 VMware and Windows Interview Questions: Part 8 Follow this link for scenario based VMware interview questions. Maximum number of LUNs that can be attached to a host (ESXi 5.0) 256 Maximum number of vCPUs that can be assigned to a VM (ESXi 5.0) 32
Deep dive »

VMware and Windows Interview Questions: Part 3

What is vSAN ? It is a hypervisor-converged storage solution built by aggregating the local storage attached to the ESXi hosts managed by a vCenter.  Recommended iSCSI configuration? A separate vSwitch, and a separate network other than VMtraffic network for iSCSI traffic. Dedicated physical NICs should be connected to vSwitch configured for iSCSI traffic. What is iSCSI port binding ? Port binding is used in iSCSI when multiple VMkernel ports for iSCSI reside in the same broadcast domain and IP subnet, to allow multiple paths to an iSCSI array that broadcasts a single IP address.
Deep dive »

VMware vMotion error at 14%

Issue While performing vMotion, the operation fails at 14% with the below error : A general system error occurred: Migrtion to host <Destination ESXi IP> failed with erro Connection closed by remote host, possibly due to timeout (0xbad003f). Migrate virtual machine:A general system error occurred: Migration to host <Destination ESXi IP> failed with error Connection closed by remote host, possibly due to timeout (0xbad003f). vMotion migration [-1062729272:1406020861428172] (19-71629048648008) failed to receive...  Scenarios Scenario 1: Your management network and vmotion network are in the same subnet using the same physical NIC.
Deep dive »