Deleted objects are generally stored in the respective Deleted Objects container of their naming context. You can view deleted objects by using the Active Directory Administrative Center and browsing to the Deleted Objects container. Table 16-1 contains some of the attributes that are stored with deleted objects.

To aid in Active Directory backup and recovery, Windows Server 2012 includes a snapshot feature that allows you to take point-in-time snapshots of the Active Directory database and then mount those snapshots to view the contents and compare them to the current contents of the AD database. Using scripts or third-party tools, you can even copy information from an Active Directory snapshot directly into the live AD database without needing to reboot the domain controller to perform a traditional restore operation.

You want to back up the Active Directory database.

The wbadmin command can be used to create a System State backup of the Active Directory database. In addition, there is a Windows Server Backup GUI tool that can be used to perform the backup. Alternately, Windows PowerShell cmdlets are available to configure one-time and scheduled backup jobs. The steps in this recipe assume that you have installed the Windows Server Backup feature. To install the Windows Server Backup feature using PowerShell, run the following command.

Add-WindowsFeature Windows-Server-Backup -IncludeAllSubFeature

Creating an Active Directory Snapshot for information on creating Active Directory snapshots; Mounting an Active Directory Snapshot for more on mounting and using snapshots

You want to create a snapshot of the Active Directory database.

The Active Directory Domain Services snapshot feature leverages the Volume Shadow Copy Service (VSS) to allow administrators to create “shadow copies” of the Active Directory database. Once a snapshot has been created, you can use the ntdsutil and dsamain command-line utilities to mount the snapshot as a read-only copy of the Active Directory database. Once the snapshot is mounted, you can view it using customary tools such as ADSI Edit and LDP, as well as using third-party tools to copy information from a snapshot into a live Active Directory database.

Mounting an Active Directory Snapshot for more on mounting and using snapshots

You want to mount a snapshot of the Active Directory database that you created previously using either ntdsutil or a System State backup.

The dsamain utility can be used to expose an Active Directory snapshot that has been created using ntdsutil, or it can use the contents of a System State backup that has been restored to an alternate location on the local hard drive. Network or UNC paths are not supported. Once a snapshot or restored backup is exposed using dsamain, it can be accessed in a read-only manner using Active Directory tools such as LDP or ADSI Edit, as well as scripts and PowerShell.

Creating an Active Directory Snapshot for more on creating snapshots; Accessing Active Directory Snapshot Data for more on accessing and manipulating information contained in a snapshot

You want to access data contained within a snapshot of the Active Directory database that you created previously using either ntdsutil or a System State backup.

An Active Directory snapshot provides a read-only view of the Active Directory database as it existed at a particular point in time, whether the snapshot was created using ntdsutil or whether you are using dsamain to mount the ntds.dit contained in a System State backup. While Windows does not provide a method to perform a simple GUI “cut-and-paste” to insert values from a snapshot into a live Active Directory database, you can do so using scripting, PowerShell, or a third-party tool. You can also view the contents of a snapshot using tools such as ADSI Edit by simply indicating the alternate LDAP port number that you specified when you mounted the snapshot.

Mounting an Active Directory Snapshot for more on mounting and using snapshots; “Active Directory Explorer v1.14” (another tool for working with snapshots)

You want to restart a domain controller in DS Repair Mode.

To enter DS Repair Mode, press F8 after the power-on self-test (POST), which will bring up a menu, as shown in Figure 16-1. From the menu, select Directory Services Repair Mode.

Figure 16-1. Boot options

> bcdedit /set safeboot dsrepair

> bcdedit /deletevalue safeboot

The Active Directory database is live and locked by the system whenever a domain controller is booted into normal mode. In DS Repair Mode, Active Directory does not start up and the database files (e.g., ntds.dit) are not locked. The restartable AD DS service allows you to perform certain maintenance tasks, such as performing an offline defrag, without needing to reboot the domain controller into DSRM. However, certain critical operations, such as an authoritative restore, still need to be performed in Directory Services Repair Mode.

It is not always practical to be logged in to the console of the server when you need to reboot it into DS Repair Mode. You can use Remote Desktop Connection to log on to the machine remotely while it is in DSRM mode.

“Restart the Domain Controller in Directory Services Restore Mode Remotely”

You want to reset the DS Repair Mode administrator password. This password is set individually (i.e., not replicated) on each domain controller and is initially configured when you promote a server to a domain controller.

You may be thinking that having a separate DS Repair Mode administrator password can be quite a pain. Yet another thing you have to maintain and update on a regular basis, right? But if you think about it, you’ll see that it is quite necessary.

Generally, you boot a domain controller into DS Repair Mode when you need to perform some type of maintenance on the Active Directory database. To do this, the database needs to be offline. But if the database is offline, then there is no way to authenticate against it. Because of this, the system has to use another authentication repository, so it reverts back to the legacy SAM database. The DS Repair Mode administrator account and password are stored in the SAM database, just as with standalone Windows servers.

The one disadvantage to the solutions presented in this recipe is that you have to reset the DSRM password on one machine at a time. To automate this process on all domain controllers, the following PowerShell command will synchronize the DSRM password with the current password of the domain Administrator account:

Get-ADDomainController -Filter * | ForEach-Object {Invoke-Command -ComputerName $_.Name -ScriptBlock {ntdsutil "set dsrm password" "sync from domain account Administrator" "Q" "Q"}}

TechNet Article cc754363, “set DSRM password” for resetting the DSRM password on a domain controller

You want to perform a nonauthoritative restore of a domain controller. This can be useful if you want to quickly restore a domain controller that failed due to a hardware problem.

If you encounter a failed domain controller that you cannot bring back up (e.g., multiple hard disks fail), you have two options for restoring it. One option is to remove the domain controller completely from Active Directory (as outlined in Removing an Unsuccessfully Demoted Domain Controller) and then promote it back in. This is known as the restore from replication method, because you are essentially bringing up a brand-new domain controller and letting replication restore all the data on the server. After performing the steps described in Removing an Unsuccessfully Demoted Domain Controller, you can also use the Install From Media option described in Promoting a Server to a Windows Server 2012 Domain Controller from Media to expedite this process.

The other option is described in this recipe’s solution. You can restore the domain controller from a good backup. This method involves restoring the System State and any necessary system drive(s) and then rebooting. As long as the domain controller comes up clean, it should start participating in Active Directory replication once again and replicate any changes that have occurred since the backup was taken. This method is generally the fastest for restoring a domain controller, particularly if the server is the only DC located in a remote site.

For a detailed discussion of the advantages and disadvantages of each option, see Active Directory, Fifth Edition, by Brian Desmond et al. (O’Reilly).

Restarting a Domain Controller in Directory Services Repair Mode for getting into Directory Services Repair Mode

You want to perform an authoritative restore of one or more objects, but not the entire Active Directory database. For the GUI solution, this recipe assumes that the Active Directory Recycle Bin was enabled prior to the deletion. If you have not enabled the AD Recycle Bin, you can do so from the Tasks pane in the Active Directory Administrative Center.

If an administrator or user accidentally deletes an important object or entire subtree from Active Directory, you can restore it. Fortunately, the process isn’t very painful. The key is to have a good backup that contains the objects you want to restore.

Restarting a Domain Controller in Directory Services Repair Mode for booting into Directory Services Repair Mode; Undeleting a Single Object for restoring a deleted object; MS KB 216243 (Authoritative Restore of Active Directory and Impact on Trusts and Computer Accounts); MS KB 280079 (Authoritative Restore of Groups Can Result in Inconsistent Membership Information Across Domain Controllers)

You want to perform a complete authoritative restore of the Active Directory database because a significant failure has occurred.

First, reboot into Directory Services Repair Mode (DSRM)—see Restarting a Domain Controller in Directory Services Repair Mode for more information. Then, once in DSRM, run the following command to restore the entire database:

> wbadmin start systemstaterecovery -version:<BackupDate>-<BackupTime> -authsysvol

For example, to restore a backup from 02/14/2013 at 08:56pm, run the following command:

> wbadmin start systemstaterecovery -version:02/14/2013-20:56 -authsysvol > activate instance ntds

Restart the computer.

In a production environment, you should never have to perform an authoritative restore of the entire Active Directory database unless you have encountered a drastic situation such as a forest recovery scenario. It is a drastic measure, and you will almost inevitably lose data as a result. Before you even attempt such a restore, you may want to contact Microsoft Support to make sure that all options have been exhausted. However, you should still test the authoritative restore process in a lab environment and make sure that you have the steps properly documented in case you ever do need to use it.

Restarting a Domain Controller in Directory Services Repair Mode for getting into Directory Services Repair Mode; MB KB 216243 (Authoritative Restore of Active Directory and Impact on Trusts and Computer Accounts); MS KB 280079 (Authoritative Restore of Groups Can Result in Inconsistent Membership Information Across Domain Controllers)

You want to check the integrity and semantics of the DIT file to verify that there is no corruption or bad entries.

The Active Directory DIT file (ntds.dit) is implemented as a transactional database. Microsoft uses the ESE database (also called JET Blue) for Active Directory, which has been used for years in other products such as Microsoft Exchange.

Since the Active Directory DIT is ultimately a database, it can suffer from many of the same issues as traditional databases. The ntdsutil integrity command checks for any low-level database corruption and ensures that the database headers are correct and the tables are in a consistent state. It reads every byte of the database and can take quite a while to complete, depending on how large the DIT file is.

Whereas the ntdsutil integrity command verifies the overall structure and health of the database files, the ntdsutil semantics command looks at the contents of the database. It will verify, among other things, reference counts, replication metadata, and security descriptors. If any errors are reported back, you can run go fixup to attempt to correct them. You should have a recent backup handy before doing this and perform this step only as a troubleshooting option, preferably under the direction of a Microsoft PSS engineer, since in the worst case the corruption cannot be fixed or the state of your AD database may even become worse after the go fixup command completes.

Restarting a Domain Controller in Directory Services Repair Mode for booting into Directory Services Repair Mode; MS KB 315136 (How to Complete a Semantic Database Analysis for the Active Directory Database by Using Ntdsutil.exe)

You want to move the Active Directory DIT files to a new drive to improve performance or capacity.

You can move the Active Directory database file (ntds.dit) independently of the logfiles. The first command in the solution moves the database, and the second moves the logs. You may also want to consider running an integrity check against the database after you’ve moved it to ensure that nothing went wrong during the move. See Checking the DIT File’s Integrity for more details.

Restarting a Domain Controller in Directory Services Repair Mode for booting into Directory Services Repair Mode; Checking the DIT File’s Integrity for checking DIT file integrity

You need to repair or perform a soft recovery of the Active Directory DIT because a power failure or some other failure caused the domain controller to enter an unstable state.

Hopefully, you will never need to recover or repair your Active Directory database. However, a recovery may be needed after a domain controller unexpectedly shuts down, perhaps due to a power loss, and certain changes were never committed to the database. When it boots back up, a soft recovery is automatically done in an attempt to reapply any changes that were contained in the transaction logfiles. Since Active Directory does this automatically, it is unlikely that running the ntdsutil recover command will be of much help.

We recommend that you use extreme caution when performing a repair and you may wish to engage Microsoft Support first in case something goes wrong. If you try the repair, and it makes things worse, you should consider rebuilding the domain controller from scratch. See Removing an Unsuccessfully Demoted Domain Controller for forcibly removing a failed domain controller from your domain.

Checking the DIT File’s Integrity for checking the integrity of the DIT file

You want to initiate an online defragmentation to optimize the disk space that’s being used by the ntds.dit file.

By default, the online defrag process runs every 12 hours on each domain controller after the garbage collection process completes. This process defrags the Active Directory database (ntds.dit) by combining whitespace generated from deleted objects but does not reduce the size of the database file.

To start an online defrag, simply write the DoOnlineDefrag attribute to the RootDSE with a value equal to the maximum time the defrag process should run (in seconds). You must be a member of the Domain Admins group in the domain controller’s domain in order to write to this attribute.

Performing an Offline Defrag to Reclaim Space for performing an offline defrag; MS KB 198793 (The Active Directory Database Garbage Collection Process)

You want to perform a recovery of the Active Directory database when other methods have failed.

When attempting to recover the ntds.dit database, you may occasionally encounter a situation where ntdsutil is unable to repair whatever damage has occurred. You may run into error messages similar to the following:

Operation failed because the database was inconsistent.

Initialize jet database failed; cannot access file.

Error while performing soft recovery.

Because the AD database is based on the ESE, you also have access to the esentutl database utility, which can perform a number of operations against the ntds.dit file, including defragmentation, database recovery or repair, and integrity checks. (For a complete description of each operation, type esentutl /? at the command line.)

If the ntdsutil recovery options listed elsewhere in this chapter fail, you can attempt to repair AD using this ESE utility. Many of the operations that you can perform with esentutl have the potential to exacerbate data loss, so be certain that you have a viable backup in place before attempting any of them. In fact, in some cases it may actually be easier and quicker to simply restore from a known good backup to get your domain or forest back online again.

MS KB 305500 (Cannot Repair the Active Directory Database by Using the Ntdsutil Tool); MS KB 280364 (How to Recover from Event ID 1168 and Event ID 1003 Error Messages)

You want to create another reserve file on the disk containing the ntds.dit file to guard against AD failures caused by running out of disk space.

By default, Active Directory creates two files called ebdres00001.jrs and edbres00002.jrs in the same directory as the ntds.dit database. Each of these files is 10 MB in size and is used to hold in reserve the last 20 MB of space on the drive hosting the AD database files. If a domain controller runs out of space on that drive, Active Directory will use the space being held by ebdres00001.jrs and edbres00002.jrs to commit any uncommitted transactions before shutting down so that no information is lost. If you wish to set aside more space than this, you can create a reserve file to set aside additional space; this reserve file can then be manually deleted to free up disk space. This can provide an additional safeguard against a user or administrator inadvertently filling up the drive that’s hosting the ntds.dit file, or guard against a virus or a malicious user performing a denial-of-service attack by intentionally filling up the drive.

Creating a Quota for more on creating Active Directory quotas; Changing How Tombstone Objects Count Against Quota Usage for configuring how tombstoned objects affect quotas

You want to find the amount of whitespace in your DIT. A lot of whitespace in the DIT may mean that you could regain enough space on the disk to warrant performing an offline defrag.

By setting the 6 Garbage Collection diagnostics logging option, event 1646 will get generated after the garbage collection process runs. Here is a sample 1646 event:

Event Type:         Information
Event Source:       NTDS Database
Event Category:     Garbage Collection
Event ID:           1646
Date:               11/25/2012
Time:               9:52:46 AM
User:               NT AUTHORITYANONYMOUS LOGON
Computer:           DC1
Description:
Internal event:     The Active Directory database has the following amount of↵
free hard disk space remaining.

Free hard disk space (megabytes): 100
Total allocated hard disk space (megabytes): 1024

This shows that domain controller Dc1 has a 1 GB DIT file with 100 MB that is free (i.e., whitespace).

Performing an Offline Defrag to Reclaim Space for performing an offline defrag

You want to perform an offline defrag of the Active Directory DIT to reclaim whitespace in the DIT file.

Performing an offline defragmentation of your domain controllers can reclaim disk space if you’ve deleted a large number of objects from Active Directory. You should perform an offline defrag when (and if) this occurs only if you actively require the disk space back—for example, when following a spin-off in which you’ve migrated a large number of objects into a separate domain. The database will reuse whitespace and grow organically as required. Typically, the database grows year over year as more objects are added, so an offline defrag should seldom be required. An offline defrag always carries a small element of risk, so it should not be done unnecessarily.

The key thing to plan ahead of time is your disk space requirements. If you plan to create the compacted copy of the DIT on the same drive as the current DIT, you need to make sure that drive has 115 percent of the size of the DIT available. If you plan to store the original DIT on the same drive, you’ll need to make sure you have at least that much space available.

Checking the DIT File’s Integrity for checking the integrity of the DIT; MS KB 198793 (The Active Directory Database Garbage Collection Process); MS KB 229602 (Defragmentation of the Active Directory Database); MS KB 232122 (Performing Offline Defragmentation of the Active Directory Database)

You want to change the default garbage collection interval.

In an environment where the Active Directory Recycle Bin is not enabled, when an object is deleted from the Configuration naming context, a Domain naming context, or an application partition, the object is tombstoned by renaming the object, moving it to the Deleted Object container, and clearing the value of most of its attributes to save space in the ntds.dit file. This tombstone object remains in Active Directory for the duration of the tombstone lifetime (180 days for Windows Server 2012) before it gets completely removed. See Modifying the Tombstone Lifetime for a Domain for more information on the tombstone lifetime.

A garbage collection process runs on each domain controller that automatically removes expired tombstone objects. This process runs every 12 hours by default, but you can change it to run more or less frequently by setting the garbageCollPeriod attribute on the following object to the frequency in hours:

"cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration,<RootDomainDN>"

Logging the Number of Expired Tombstone Objects for logging the number of tombstones that get garbage-collected; Modifying the Tombstone Lifetime for a Domain for modifying the tombstone lifetime; MS KB 198793 (The Active Directory Database Garbage Collection Process)

You want to log the number of expired tombstone objects that are removed from Active Directory during each garbage collection cycle.

Here is a sample event that is logged when the 6 Garbage Collection diagnostics logging level is set to 3 or higher:

Event Type:          Information
Event Source:        NTDS General
Event Category:      Garbage Collection
Event ID:            1006
Date:                11/24/2012
Time:                11:29:31 AM
User:                NT AUTHORITYANONYMOUS LOGON
Computer:            DC1
Description:
Internal event: Finished removing deleted objects that have expired (garbage
collection). Number of expired deleted objects that have been removed: 229.

Enabling Diagnostics Logging for more on diagnostics logging; Changing the Garbage Collection Interval for more on the garbage collection process

You want to determine the size of the Active Directory database.

The size of the Active Directory database on a domain controller is the size of the ntds.dit file. This file can vary slightly in size between domain controllers, even within the same domain, due to unreplicated changes, differences with nonreplicated data, and whitespace from purged objects.

You should monitor the size of this file on one or more domain controllers in each of your domains to ensure that you have adequate disk space. Also, by knowing the average size of your DIT, you can quickly recognize if it spikes dramatically, perhaps due to a new application that is writing data to the directory.

If you find that you are running out of disk space, you have a couple of options. You could move the Active Directory files to a new drive with more capacity. Alternatively, you can perform an offline defragmentation if the DIT file contains a lot of whitespace.

Moving the DIT Files for moving the DIT files; Determining How Much Whitespace Is in the DIT for determining how much whitespace is in the DIT; Performing an Offline Defrag to Reclaim Space for performing an offline defragmentation of the Active Directory database

You want to search for deleted objects.

When an object is deleted in Active Directory, it is not really deleted, at least not immediately. The object is renamed, most of its attributes are cleared, and it is moved to the Deleted Objects container within the naming context that it was deleted from. See this chapter’s Introduction for more on tombstone objects.

Both the Deleted Objects container and tombstone objects themselves are hidden by default in tools such as ADUC and ADSI Edit. Only members of the administrator groups can perform searches for tombstone objects.

MSDN: Retrieving Deleted Objects

You want to undelete an object that has been deleted from your Active Directory domain. This recipe assumes that the Active Directory Recycle Bin has been enabled. If you have not enabled the AD Recycle Bin, you can do so from the Tasks pane in the Active Directory Administrative Center.

Another option when restoring a single object is to perform a System State restore on a domain controller, and then to use ntdsutil to mark the individual object as authoritative. This has the downside of causing downtime on a domain controller, since you’ll need to reboot it into Directory Services Repair Mode to perform the restore.

Microsoft also offers the adrestore command-line utility that will enumerate the deleted objects in a domain and give you the option to undelete them.

“Step 2: Restore a Deleted Active Directory Object”; the other recipes in this chapter for more on AD backups, restores, snapshots, and disaster recovery

You want to undelete a container object such as an OU that contained other objects when it was deleted.

When you delete an Active Directory container object, it also deletes any child objects that are housed within that container. Restoring an OU and all of the child objects, for example, therefore requires you to restore both the container itself as well as all of the child objects contained within it. This is relatively simple to perform using Windows PowerShell since you can restrict your query to those objects that have the appropriate value listed in the lastKnownParent attribute.

MSDN: Restoring Deleted Object [Active Directory]

You want to change the default tombstone lifetime for a domain.

The default tombstone lifetime for Windows 2008 and later is set to 180 days. It is not recommended that you decrease the tombstone lifetime unless you have a very good reason for doing so, since decreasing this value below the 180-day default also decreases the length of time a backup of Active Directory is good for. See this chapter’s Introduction and Searching for Deleted Objects for more information on tombstone (deleted) objects and the tombstone lifetime.

Changing the Garbage Collection Interval for more on the garbage collection process; MS KB 198793 (The Active Directory Database Garbage Collection Process); MS KB 314282 (Lingering Objects May Remain After You Bring an Out-of-Date Global Catalog Server Back Online)