Active Directory
E N D
Presentation Transcript
Active Directory Disaster Recovery
Domain Controllers • No PDC, BDC • All DCs are equal • Some are more equal than others (operations masters) • Can demote DC to member server • Can change its name this way • Can promote member server to DC
Active Directory Files • Default location %systemroot%\NTDS • Ntds.dit — Active Directory database • Edb*.log — Transaction log files • Edb.chk — Checkpoint file to check data not yet written to database • Res*.log — Reserved transaction log files (10MB each to reserve space in case disk fills up)
Garbage Collection • Runs periodically • Deletes tombstoned objects • Defragments database
System State • Includes everything that AD depends on, not just database files • Database and log files • SYSVOL shared folder • Registry • System startup files • Class registration database • Certificate Services database
Backing up Active Directory • Accessories/System Tools/Backup • Allows backup of system state • TSM (to HFS) • Backs up system object • Includes Active Directory • Third party • For complete backup, AD on all domain controllers must be backed up
Non-Authoritative Restore • Restores Active Directory to state before backup was made • Updates from other DCs are made via replication as usual
Authoritative Restore • Possible to mark part of Active Directory as authoritative on server where you are restoring it • Authoritative parts replicated to other DCs • E.g. to restore deleted objects • Only part of database can be restored authoritatively • Can select subset to be restored authoritatively • E.g. to restore deleted OU
References • How to remove orphaned domains from Active Directory • http://support.microsoft.com/support/kb/articles/Q230/3/06.ASP • Domain controller server object not removed after demotion • http://support.microsoft.com/support/kb/articles/Q216/3/64.ASP • How to perform an authoritative restore to a domain controller • http://support.microsoft.com/support/kb/articles/Q241/5/94.ASP
References • Backup of the active directory has 60-day useful life • http://support.microsoft.com/support/kb/articles/Q216/9/93.ASP • Removing active directory data after an unsuccessful demotion • http://support.microsoft.com/support/kb/articles/Q216/4/98.ASP