Herb
Thu Mar 20 09:52:36 PDT 2008
"Jorge de Almeida Pinto [MVP - DS]"
<SubstituteThisWithMyFullNameSeparatedByDots@gmail.com> wrote in message
news:%23BNhPjudIHA.5208@TK2MSFTNGP04.phx.gbl...
> no, I did not miss your target.... you wanna go back in time with your AD
> domain to a certain point in time....
>
> the command "restore database" in NTDSUTIL does not need to be used, as
> there is no valid reason to use it. Better yet, it has been removed in
> W2K8
> independent of how many DCs you have.......
I don't understand what you are saying here. If he restores (physically)
the
database on ONLY 1 of several DCs, but skips the Authoritative Restore
procedure the OTHER DCs will subsequently overwrite the restored information
that conflicts with LATER (or USN precedence based) updates.
> 1ST of AD domain --> a non-authoritative restore of AD with a primary
> restore of the SYSVOL
>
> ALL other DCs in the AD domain:
> * rebuild and repromote
> OR
> * non-authoritative restore of AD and non-auth restore of the SYSVOL
>
> for more info on AD and backups/restores see:
>
http://blogs.dirteam.com/blogs/jorge/archive/2006/03/08/597.aspx
>
http://blogs.dirteam.com/blogs/jorge/archive/2006/10/20/Active-Directory-Forest-Recovery.aspx
> --
>
> Cheers,
> (HOPEFULLY THIS INFORMATION HELPS YOU!)
>
> # Jorge de Almeida Pinto # MVP Windows Server - Directory Services
>
> BLOG (WEB-BASED)-->
http://blogs.dirteam.com/blogs/jorge/default.aspx
> BLOG (RSS-FEEDS)-->
http://blogs.dirteam.com/blogs/jorge/rss.aspx
> ------------------------------------------------------------------------------------------
> * How to ask a question -->
http://support.microsoft.com/?id=555375
> ------------------------------------------------------------------------------------------
> * This posting is provided "AS IS" with no warranties and confers no
> rights!
> * Always test before implementing!
> ------------------------------------------------------------------------------------------
> #################################################
> #################################################
> ------------------------------------------------------------------------------------------
> <zerbie45@gmail.com> wrote in message
> news:ec6d9bbd-d5c8-4897-bf67-f5029cc35706@e60g2000hsh.googlegroups.com...
>> Thank you for your answer, but I think you misunderstood what my
>> target is.
>> I need to perform a complete (aka primary) restore of an active
>> directory domain.
>> That of course means all objects, like users, ous, gpos, sysvol, etc.
>> I do believe the 'restore database' command must be used to accomplish
>> this. Am I wrong ?!?
>> What kind of objects would not exist in the restored database ??
>> Assuming I have a valid system state backup (I believe this contains
>> all objects required for a complete AD restore ?!?)
>>
>> I also believe that the above does not suffice the have the sysvol
>> restored too.
>>
>> I have not found a clear procedure to do this. I was able to get the
>> AD restored, but the sysvol restore is still not working the way I
>> expected.
>>
>> Thanks and Regards,
>> zz
>>
>> On 23 Feb, 10:45, "Jorge de Almeida Pinto [MVP - DS]"
>> <SubstituteThisWithMyFullNameSeparatedByD...@gmail.com> wrote:
>>> there is no reason to fully restore the database by using the command
>>> "restore database" in NTDSUTIL. That only authoritatively restores ALL
>>> the
>>> object in the database but does not with other objects on other DCs that
>>> do
>>> not exist in the restored database...
>>>
>>> when you want to go back in time with your AD you need to restore at
>>> least 1
>>> DC and then:
>>> * restore all the others or rebuild them
>>>
>>> for the SYSVOL....
>>> if you do an auth. restore of the SYSVOL (primary set option OR D4) on
>>> one
>>> DC, you MUST do a non-auth (D2) restore of the SYSVOL on all the other
>>> DCs
>>> in the domain
>>>
>>> I sure hope you are thinking first and testing before actually doing
>>> anything like trial and error
>>>
>>> --
>>>
>>> Cheers,
>>> (HOPEFULLY THIS INFORMATION HELPS YOU!)
>>>
>>> # Jorge de Almeida Pinto # MVP Windows Server - Directory Services
>>>
>>> BLOG (WEB-BASED)-->
http://blogs.dirteam.com/blogs/jorge/default.aspx
>>> BLOG (RSS-FEEDS)-->
http://blogs.dirteam.com/blogs/jorge/rss.aspx
>>> ------------------------------------------------------------------------------------------
>>> * How to ask a question -->
http://support.microsoft.com/?id=555375
>>> ------------------------------------------------------------------------------------------
>>> * This posting is provided "AS IS" with no warranties and confers no
>>> rights!
>>> * Always test before implementing!
>>> ------------------------------------------------------------------------------------------
>>> #################################################
>>> #################################################
>>> ------------------------------------------------------------------------------------------<zerbi...@gmail.com>
>>> wrote in message
>>>
>>> news:48dc39cb-3e6f-45ab-9326-b5af69fa5ab8@k2g2000hse.googlegroups.com...
>>>
>>> > Thanks for your answer, much appreciated.
>>>
>>> > I did manage to restore the entire database but I have some problems
>>> > regarding the sysvol.
>>>
>>> > basically the steps I followed are:
>>>
>>> > - restart dc in dsrm
>>> > - perform normal (not authoritative) restore
>>> > - perform authoritative restore (that is: restore to original location
>>> > - mark as primary set,,,,for the sysvol folder,,,don't remember the
>>> > exact wording,,)
>>> > - restart
>>>
>>> > however, reading some kbs I gather that an auth restore of the sysvol
>>> > requires something more than that, like restoring to an alternate
>>> > location.
>>> > so my question is: do I need to run twice the auth restore, or can I
>>> > use the alternate location option during the step above,,,,will that
>>> > be compatible with the system state auth restore of all other
>>> > objects ?
>>>
>>> > thanks!
>>> > regards,
>>> > zz
>>>
>>> > On 22 Feb, 06:13, "Ace Fekay [MVP]" <PleaseAs...@SomeDomain.com>
>>> > wrote:
>>> >> Innews:9cf54c2f-0f5c-4a04-84b2-ecbdc85295c6@72g2000hsu.googlegroups.com,
>>> >> zerbi...@gmail.com <zerbi...@gmail.com> typed:
>>>
>>> >> > hello guys,
>>>
>>> >> > I have an AD domain I need to restore to a previous state, this is
>>> >> > the
>>> >> > infrastructure:
>>>
>>> >> > 1 DC 2K3 Std Ed SP2 all FSMO roles and GC
>>> >> > 1 DC 2K3 Std Ed SP2 GC
>>> >> > Other member servers...
>>>
>>> >> > I have a valid backup taken only a few hours back.
>>> >> > I need to do authoritative restore so that all objects are rolled
>>> >> > back
>>> >> > to the previous state.
>>> >> > I know I need to:
>>>
>>> >> > first, reboot DC 1 into AD restore mode and run a normal (not
>>> >> > authoritative) restore
>>> >> > second, use ntdsutil and execute restore database (authoritative
>>> >> > restore)
>>>
>>> >> > But I've never performed this before, and I know there's something
>>> >> > to
>>> >> > do with regard to the sysvol objects.
>>> >> > I've looked everywhere in the internet but all examples refer to
>>> >> > restoring just an object, not the entire directory.
>>>
>>> >> > Does anyone have a bullet proof, step by step procedure, to perform
>>> >> > a
>>> >> > complete restore of an active directory domain to a previous state
>>> >> > ?
>>> >> > Anybody can help ? It would be much appreciated!
>>>
>>> >> > Thanks and Regards,
>>> >> > ZZ
>>>
>>> >> If you have more than one DC, you will probably want the objects in
>>> >> the
>>> >> restore take precedents over the other DC's objects. To do this, you
>>> >> will
>>> >> need to mark the entire database as authoritative. See 'after
>>> >> restarting
>>> >> the
>>> >> domain controller Step 9 in the first link below.
>>>
>>> >> How can I perform an authoritative restoration of Active Directory
>>> >> (AD)
>>> >> in
>>> >> Windows Server
>>> >> 2003?
http://www.windowsitpro.com/Article/ArticleID/41170/41170.html
>>>
>>> >> Performing an Authoritative Restore of Active Directory
>>> >> Objects:
http://technet2.microsoft.com/windowsserver/en/library/690730c7-83ce-...
>>>
>>> >> How to perform an authoritative restore to a domain controller in
>>> >> Windows
>>> >> 2000
http://support.microsoft.com/kb/241594
>>>
>>> >> --
>>> >> Regards,
>>> >> Ace
>>>
>>> >> This posting is provided "AS-IS" with no warranties or guarantees and
>>> >> confers no rights.
>>>
>>> >> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
>>> >> MVP Microsoft MVP - Directory Services
>>> >> Microsoft Certified Trainer
>>>
>>> >> Infinite Diversities in Infinite Combinations
>>
>