How can I perform an authoritative restoration of Active Directory (AD) in Windows Server 2003?

A. To perform an authoritative restoration, you must first recover AD from a backup by performing the following steps:

Restart the domain controller (DC) of interest.
When you see the menu to select the OS, press F8.
From the Windows Advanced Options Menu, select Directory Services Restore Mode, then press Enter.
Select the Windows 2003 OS, then press Enter.
Use the restore mode password and log on as the administrator.
Click OK to the confirmation that Windows is running in Safe mode.
Start the Windows Backup application (go to Start, Programs, Accessories, System Tools, and click Backup).
Select the Restore option, then select the media where the backup is stored and ensure that the System State is selected.
Click OK to close any warning dialog boxes.
After the AD recovery is complete, click Close to the displayed dialog box and click Yes to restart the computer.

When the machine restarts, you need to specify which parts of the restoration will be authoritative by performing the following steps:

When you see the menu to select the OS, press F8.
From the Windows Advanced Options Menu, select Directory Services Restore Mode, then press Enter.
Select the Windows 2003 OS, then press Enter.
Use the restore mode password to log on as the administrator.
Click OK to the confirmation that Windows is running in Safe mode.
Open a command prompt--go to Start, Run and type
```
cmd
```
Start the Ntdsutil utility.
To access the authoritative restore mode, type
```
ntdsutil: authoritative restore
```
If you want to mark the entire database as authoritative, type
```
authoritative restore: restore database
```
If you want to mark only a certain object as authoritative (e.g., an organizational unit--OU), type
```
authoritative restore: restore subtree <distinguished 
name--DN--of subtree, e.g. OU=sales,DC=savilltech,DC=com>
```
To exit Ntdsutil, type
```
quit
```
Restart the DC as usual.

If you perform an authoritative restoration of a backup that's more than 14 days old, some trust relationships might be broken because the passwords used by the trust would have been changed twice (the directory stores both the current and previous password, which changes every 7 days). So, for example, when restoring NT LAN Manager (NTLM) trusts, you would have to break the trust, then recreate it.

End of Article

I would like to see more examples of restore subtree, especially with OU's that contain spaces in their names, and nested OU's. Finding this on the web has proven difficult.

DS January 16, 2004

If any OU or CN has a space you place quotes around the entire DN. "CN=me,CN=Users,DC=phoenix,DC=com". To use nesting you would just OU=1,OU=2 etc, and the program is intelligent enough to traverse the LDAP directory.

Christopher McGill June 02, 2004

I would like to see som examples of restoring an object containing none US characters, for example åäö.

Rickard Dehlin July 09, 2004

Has anyone ever encountered any problems when restoring A/D to a disaster recovery server? any chance of corruption?

ninat November 08, 2004

You must be a registered user or online subscriber to comment on this article. Please log on before posting a comment. Are you a new visitor? Register now