Performing an Authoritative AD Restoration

I have two questions about restoring Windows 2000 Active Directory (AD) from tape. First, can I restore only part of AD (e.g., certain objects)? Second, can you tell me how to make the restored version of AD take precedence in a multiple domain controller (DC) environment—won't the other DCs replicate their updated settings to the restored DC and overwrite the restored version?

You can restore AD in one of two ways. One method, known as a nonauthoritative restoration, will have the result you describe. However, you can work around that behavior by performing an authoritative restoration.

Suppose a DC's hard disk fails. To do a nonauthoritative restoration of the DC, you need to partition and format the new disk to match the original disk's configuration, then reinstall Win2K Server and any applications. After the installation is finished, boot into Win2K Server. When the Win2K boot process starts, you must put AD offline by pressing F8 and choosing Directory Services Restore Mode. Because AD is offline, you must log on as the local Administrator when the system boots. The rest of the restore process is straightforward. Start NTBackup and choose Restore from the Tools menu. Select the backup you want to restore, choose System State, then select Finish. The backup tape's system state data will replace the system state data that developed with the initial installation.

So far so good. Reboot the system and log on to the installation as a user with the Domain Administrator privilege. Assuming that an additional DC is online, that DC will replicate a current version of AD to the recovered DC, updating the restored AD to reflect any changes that occurred to AD between the backup and the restoration.

But what can you do if you want to maintain some aspect of AD that's changed since the backup, perhaps because something in AD became corrupted and you want to replicate the old and uncorrupted AD version across the network? In such a situation, you can use Ntdsutil, after you restore AD and before rebooting the recovered system, to perform an authoritative restoration. If you want the restored AD to act as the master directory for the entire network, enter the following commands at the command prompt:

ntdsutil
restore database verinc
quit

(Verinc stands for version increase.) Reboot the system; the restored DC will replicate the restored version of AD across the network.

To make only a subtree of AD authoritative, replace the above commands with the following commands:

ntdsutil
restore <subtree> verinc
quit

Then, reboot the DC. The restored DC will replicate only the specified subtree to the other DCs. At the next scheduled replication, any updates that occurred outside that subtree will replicate to the restored DC.

End of Article