How can I perform an authoritative restoration of Active Directory (AD) in Windows Server 2003?

A. To perform an authoritative restoration, you must first recover AD from a backup by performing the following steps:

1. Restart the domain controller (DC) of interest.
2. When you see the menu to select the OS, press F8.
3. From the Windows Advanced Options Menu, select Directory Services Restore Mode, then press Enter.
4. Select the Windows 2003 OS, then press Enter.
5. Use the restore mode password and log on as the administrator.
6. Click OK to the confirmation that Windows is running in Safe mode.
7. Start the Windows Backup application (go to Start, Programs, Accessories, System Tools, and click Backup).
8. Select the Restore option, then select the media where the backup is stored and ensure that the System State is selected.
9. Click OK to close any warning dialog boxes.
10. After the AD recovery is complete, click Close to the displayed dialog box and click Yes to restart the computer.

When the machine restarts, you need to specify which parts of the restoration will be authoritative by performing the following steps:

1. When you see the menu to select the OS, press F8.
2. From the Windows Advanced Options Menu, select Directory Services Restore Mode, then press Enter.
3. Select the Windows 2003 OS, then press Enter.
4. Use the restore mode password to log on as the administrator.
5. Click OK to the confirmation that Windows is running in Safe mode.
6. Open a command prompt--go to Start, Run and type

   cmd

7. Start the Ntdsutil utility.
8. To access the authoritative restore mode, type

   ntdsutil: authoritative restore

9. If you want to mark the entire database as authoritative, type

   authoritative restore: restore database

   If you want to mark only a certain object as authoritative (e.g., an organizational unit--OU), type

   authoritative restore: restore subtree <distinguished 
   name--DN--of subtree, e.g. OU=sales,DC=savilltech,DC=com>

10. To exit Ntdsutil, type

    quit

11. Restart the DC as usual.

If you perform an authoritative restoration of a backup that's more than 14 days old, some trust relationships might be broken because the passwords used by the trust would have been changed twice (the directory stores both the current and previous password, which changes every 7 days). So, for example, when restoring NT LAN Manager (NTLM) trusts, you would have to break the trust, then recreate it.