Restoring Active Directory

If you encounter a failed domain controller that you cannot bring back up (e.g., multiple hard disks fail), you have two options for restoring it. One option is to remove the domain controller completely from Active Directory and then repromote it back in. This is known as the restore from replication method, because you are essentially bringing up a brand new domain controller and will let replication restore all the data on the server. On Windows Server 2003 domain controllers, you can also use the install from media to expedite this process.

The other option, nonauthoritative restore, is to restore the domain controller from a good backup. This method involves booting into Directory Services Restore Mode, restoring the system state and any necessary system drives, and then rebooting. As long as the domain controller comes up clean, it should start participating in Active Directory replication once again and sync any changes that have occurred since the last backup.

In some cases, you may not want to restore an entire domain controller, but only certain objects in Active Directory. If an administrator or user accidentally deletes an important object or entire subtree from Active Directory, you can restore that particular object or set of objects. Fortunately, the process isn’t very painful. The key is having a good backup that contains the objects you want to restore. If you don’t have a backup that has the objects in it, you are out of luck.

Well, that is not completely true with Windows Server 2003 since you can restore deleted objects.

To restore one or more objects, you need to follow the same steps as performing a nonauthoritative restore. The only difference is that after you do the restore, you need to use the ntdsutil command to mark the objects in question as authoritative on the restored domain controller. After you reboot the domain controller, it will replicate any objects that have been added or modified since the last backup, except for the objects or subtrees that were marked as authoritative. For those objects, Active Directory increments the USN in such a way that they will become authoritative and replicate out to the other domain controllers.

You can also use ntdsutil without first doing a restore in situations where an object has been deleted accidentally, but the change has not yet replicated to all domain controllers. The trick here is that you need to find a domain controller that has not had the deletion replicated yet and either stop it from replicating or make the object authoritative before it receives the replication update.

The last restore method I describe is a complete authoritative restore. In a production environment, you should never have to perform this type of restore. It is a drastic measure and you will inevitably lose data as a result. Before you even attempt such a restore, you may want to contact Microsoft Support to make sure all options have been exhausted. That said, you should test the authoritative restore process in a lab environment, and make sure you have the steps properly documented in case you ever need to use it. Microsoft created a really good whitepaper on performing forest recoveries called Best Practices: Active Directory Forest Recovery, which you can download from

To restore a domain controller without restoring any objects (i.e., nonauthoritative restore), do the following:

  1. First, boot the domain controller into Directory Services Restore Mode.
  2. Open the NT Backup utility; go to Start > All Programs (or Programs for Windows 2000) > Accessories > System Tools > Backup.
  3. Click the Advanced Mode link.
  4. Under the Welcome tab, click the Restore Wizard button and click Next.
  5. Check the box beside System State and any other drives you want to restore and click Next.
  6. Click the Advanced button.
  7. Select Original location for Restore files to.
  8. For the How to Restore option, select Replace existing files and click Next.
  9. For the Advanced Restore Options, be sure that the following are checked: Restore Security Settings, Restore junction points, and Preserve existing mount volume points. Then click Next.
  10. Click Finish.
  11. Restart the computer.

When the system starts up, any changes that have occurred in the domain since the backup was taken will be replicated to it.

If you want to restore a single object (i.e., authoritative restore), before you restart (step 11), run the following command:

> ntdsutil "auth restore" "restore object " q

Here is an example:

> ntdsutil "auth restore" "restore object cn=jsmith,ou=Sales,dc=rallencorp,dc=com" q

To restore an entire subtree (again, an authoritative restore) run the following:

> ntdsutil "auth restore" "restore subtree ou=Sales,dc=rallencorp,dc=com" q

Note the only difference is that I specified subtree instead of object and I included the distinquished name (DN) of an organizational unit (OU) instead of a user account. Restart the computer after you are done. This will cause that single object or subtree to replicate out to all domain controllers. Any other changes that have taken place in the domain will replicate to this server.

There are some issues related to restoring user, group, computer, and trust objects that you should be aware of. See MS KB 216243 and MS KB 280079 for more information.

If you want to restore all of the objects in an Active Directory domain (i.e., a complete authoritative restore), do the following before step 11:

Run the following command to restore the entire database:

> ntdsutil "auth restore" "restore database" q

Then restart the computer.