Active Directory: Disaster Recovery

You might also like

Download as ppt, pdf, or txt
Download as ppt, pdf, or txt
You are on page 1of 10

Active Directory

Disaster Recovery
Domain Controllers

 No PDC, BDC
 All DCs are equal
 Some are more equal than others
(operations masters)
 Can demote DC to member server
 Can change its name this way
 Can promote member server to DC
Active Directory Files

 Default location %systemroot%\NTDS


 Ntds.dit — Active Directory database
 Edb*.log — Transaction log files
 Edb.chk — Checkpoint file to check data
not yet written to database
 Res*.log — Reserved transaction log files
(10MB each to reserve space in case disk
fills up)
Garbage Collection

 Runs periodically
 Deletes tombstoned objects
 Defragments database
System State

 Includes everything that AD depends on,


not just database files
 Database and log files
 SYSVOL shared folder
 Registry
 System startup files
 Class registration database
 Certificate Services database
Backing up Active Directory

 Accessories/System Tools/Backup
 Allows backup of system state
 TSM (to HFS)
 Backs up system object
 Includes Active Directory
 Third party
 For complete backup, AD on all domain
controllers must be backed up
Non-Authoritative Restore

 Restores Active Directory to state before


backup was made
 Updates from other DCs are made via
replication as usual
Authoritative Restore

 Possible to mark part of Active Directory as


authoritative on server where you are restoring
it
 Authoritative parts replicated to other DCs
 E.g. to restore deleted objects
 Only part of database can be restored
authoritatively
 Can select subset to be restored authoritatively
 E.g. to restore deleted OU
References
 How to remove orphaned domains from Active
Directory
 http://support.microsoft.com/support/kb/articles/Q2
30/3/06.ASP

 Domain controller server object not removed


after demotion
 http://support.microsoft.com/support/kb/articles/Q2
16/3/64.ASP
 How to perform an authoritative restore to a
domain controller
 http://support.microsoft.com/support/kb/articles/Q2
41/5/94.ASP
References

 Backup of the active directory has 60-


day useful life
 http://support.microsoft.com/support/kb/arti
cles/Q216/9/93.ASP
 Removing active directory data after an
unsuccessful demotion
 http://support.microsoft.com/support/kb/arti
cles/Q216/4/98.ASP

You might also like