Environment:
OS: Windows 2008 R2 Active Directory (single DC environment..oy I know)
Issue: ADUC cannot open, Sysvol/AD not functioning, users cannot login, no existing good DCs and must restore from backups. Thankfully, local backups were configured properly with Windows Server Backup as below.
Backup:
Install all Windows Server Backup features.
Run as administrator, Windows Server Backup.
Create new backup job.
Specify destination location, “backup to a hard disk that is dedicated for backups” deletes all data on the disk selected. Point this to only an external drive that is unused!
Configure backups to use:
backup configuration: custom
backup items: Full Server backup, including Bare Metal Recovery, System State and VSS
Advanced Setting: VSS full backup
Restore:
Restart into DSRM (directory services restore mode)
Verify you have the restore mode password, if not type the following to reset the DSRM password:
ntdsutil
set dsrm password
reset password on server null
Set system to reboot in DSRM mode, or hit F8 at boot time to select DSRM mode
bcdedit /set safeboot dsrepair
Login as a local administrator (AD DB is down, you must use a local account)
If the local administrator is locked or password is unknown, boot from the recover disk at http://pogostick.net/~pnh/ntpasswd/ and unlock/reset password
Launch the Windows Server Backup GUI from Administrator Tools, and select “Recover”. Choose to recover the system state only.
Restart after the recovery completes (in my experience this takes about 45 minutes to complete)
The system will reboot again on it’s own before you will be able to login.
Again, login as a local administrator (AD DB is still down, you must use a local account)
You should now see a command prompt that states the System State recovery was successful.
Set system back to normal boot (only needed if bcdedit command was run earlier)
bcdedit /deletevalue safeboot
(Optional)————————————————————-
Mark OU or container authoritative if just restoring a section of AD (most likely due to an accidental deletion) with the following:
Restores the CN and every containing within:
ntdsutil
authoritative restore
restore subtree “OU=Users,OU=STL,DC=terminalcraft,DC=com”
Restores only the CN:
ntdsutil
authoritative restore
restore object “OU=Users,OU=STL,DC=terminalcraft,DC=com”
(Optional)————————————————————-
Restart into normal mode (AD should now be fully functional again)
Additional info:
http://technet.microsoft.com/en-us/library/cc961934.aspx
Additional notes:
Because the Backup tool restores the database and registry settings, when it restores Active Directory, the Internet Protocol (IP) configuration is also restored. Additionally, the DNS the certificate server database files, and File Replication service (FRS) are also restored. Completing restore has the following results:
The File Replication service is reset so that it is in a state ready for replication from a FRS replication partner.
The Active Directory database is verified for restore.
The server then restarts into normal operational mode and performs the following actions:
Checks Active Directory database files for consistency and re-indexes them.
Replicates FRS data with an FRS replication partner. (For more information about FRS, see“File Replication Service” in this book.)
Restores the Certificate Services database. (For more information about Certificate Services, see“Windows 2000 Certificate Services and Public Key Infrastructure” in this book.)
Recent Comments