Tombstones are of concern because if AD restores operation to a state before an object's deletion and doesn't replicate that object's tombstone to the restored DC before the tombstone expires, the object remains present only on the restored DC, resulting in an AD database inconsistency. Therefore, you need to be sure to restore the DC and ensure that inbound replication from a DC that contains the tombstone is completed before the tombstone expires.
To protect itself from this situation, Win2K denies restore operations involving AD backups that are older than the configured tombstone lifetime period. Make AD backups at least once during the tombstone lifetime and preferably more often.
However, if your only backup is older than the tombstone-lifetime interval, don't despair. In this situation, you can use the instructions in the Microsoft article "Backup of the Active Directory Has 60-Day Useful Life" (http://support.microsoft.com/default.aspx?scid=kb;en-us;q216993) to perform the restore operation. In some situations, this procedure will include modifying the tombstone-lifetime value on the server.
Second, note that although your other backup procedures might use various backup types, including normal (full), full copy, differential, and incremental backups, the system-state concept means that a normal backup is the only type possible for AD. A normal backup creates a backup of the entire system state while the DC is online (with AD services running) and clears each file's archive attribute to mark the files as backed up.
Third, make sure that your DC backups include at least the system state, the system disk contents, and the sysvol folder (if it isn't located on the system disk). As I explained earlier, the system state includes many key files and settings for restoring a DC. Backing up the system disk and sysvol folder structure ensures that all the required system files and folders are in place to initiate a successful restoration. Furthermore, put AD log and database files on separate disk spindles (physical disks or disk sets if you use RAID volumes). When you configure your DCs in this manner, AD components will be spread out on multiple drives (e.g., your log files might be in C:\winnt\ntds and your ntds.dit database file in D:\winnt\ntds). Because the AD log files and database are automatically backed up whenever system-state information is included in a backup, you need to back up only the system disk and system state to ensure a good backup, even under this distributed installation.
Fourth, consider that you can use a DC backup to restore only that DC; you can't use a backup made from one DC to restore another. So to completely back up your environment, you need a backup of every DC in your enterprise. To begin backing up any AD-based network environment, back up all the Operations Master (OM) role holders, Global Catalog (GC) server DCs, and the first DC in the root domain. Consider additional DCs on a case-by-case basis according to factors such as the impact of server downtime and whether the server contains data that can't be restored from other sources (e.g., AD replication).
Fifth, be aware of a rather nasty bug in the AD backup and restore API in preService Pack 2 (SP2) Win2K versions. For more information, see the sidebar, "The AD Backup Bug."
AD Defragmentation
In addition to proactive monitoring, troubleshooting, and change-analysis and management activities, consider performing occasional offline AD defragmentations to help ensure the availability of your directory services. Defragmentation can occur online or offline. By default, online defragmentation takes place automatically every 12 hours. This activity is part of AD's garbage-collection process, which the Microsoft article "The Active Directory Database Garbage Collection Process" (http://support.microsoft.com/default.aspx?scid=kb;en-us;q198793) describes. If you're familiar with Microsoft Exchange Server, you'll recognize this process.
Although the automatic nature of online defragmentation makes it handy, the process does nothing to reduce the size of the ntds.dit AD database file on a DC. Instead, the process reclaims free space from within the file. To reduce the database file size, you need to perform an offline defragmentation of the directory. Before you start this process, verify that you have enough free disk space to hold a copy of the current ntds.dit file.
To perform the offline defragmentation, follow these steps: Use the F8 alternate boot menu at startup to boot the DC in Directory Services Restore Mode. Make a copy of the old ntds.dit file (its default location is C:\winnt\ntds) as a precautionary measure. At a command prompt, type
ntdsutil
files
and
info
Note the directory path; it indicates the current location of the active version of the ntds.dit database file. You'll use this location in a later step. Type
compact to c:\mydir
Register
