Skip to main content

How to Restore Windows Server 2003 Active Directory

There is an option to restore Active Directory objects that have been deleted and are now in a phase called "tombstone".
You can use one of the three methods to restore Active Directory from backup media: Primary Restore, Normal Restore (i.e. Non Authoritative), and Authoritative Restore.

  • Primary Restore: This method rebuilds the first domain controller in a domain when there is no other way to rebuild the domain. Perform a primary restore only when all the domain controllers in the domain are lost, and you want to rebuild the domain from the backup. Members of the Administrators group can perform the primary restore on local computer. On a domain controller, only members of the Domain Admins group can perform this restore.

  • Normal Restore: This method reinstates the Active Directory data to the state before the backup, and then updates the data through the normal replication process. Perform a normal restore for a single domain controller to a previously known good state.

  • Authoritative Restore: You perform this method in tandem with a normal restore. An authoritative restore marks specific data as current and prevents the replication from overwriting that data. The authoritative data is then replicated through the domain. Perform an authoritative restore for individual object in a domain that has multiple domain controllers. When you perform an authoritative restore, you lose all changes to the restore object that occurred after the backup. You need to use the NTDSUTIL command line utility to perform an authoritative restore. You need to use it in order to mark Active Directory objects as authoritative, so that they receive a higher version recently changed data on other domain controllers does not overwrite System State data during replication.

    • For example, if you inadvertently delete or modify objects in Active Directory, and those objects were thereafter replicated to other DCs, you will need to authoritatively restore those objects so they are replicated or distributed to the other servers. If you do not authoritatively restore the objects, they will never get replicated or distributed to your other servers because they will appear to be older than the objects currently on your other DCs. Using the NTDSUTIL utility to mark objects for authoritative restore ensures that the data you want to restore gets replicated or distributed throughout your organization.
    Labels:

    Popular posts from this blog

    Fixing Tanzu Kubernetes Pod to External Services Connectivity Issues with NSX-T

    Fixing Tanzu Kubernetes Pod to External Services Connectivity Issues with NSX-T Last month I got a call from a customer who was pulling their hair out over a networking issue. They had just deployed VMware Tanzu Kubernetes Grid on their vSphere with Tanzu environment, everything looked good in the dashboards, all pods were running, but their applications inside the pods could not reach external databases running on traditional VMs in the same datacenter. The frustrating part was that some pods could reach external services perfectly fine, while others would just timeout. There was no clear pattern. Let me tell you how we figured this out and fixed it. The Initial Problem Here is what the customer setup looked like: vSphere 8.0 with Tanzu enabled NSX-T 4.1.2 for networking Three Tanzu Kubernetes clusters running different microservices applications External PostgreSQL database running on traditional VMs (non-Kubernetes) External API services running on another se...
    Read more

    Troubleshooting vSAN Storage Policy Migration Failures in VMware Cloud Foundation 9.0

    Recently I had a customer who migrated their VMware infrastructure from vSphere 7.0 to VMware Cloud Foundation 9.0. After the migration, they wanted to update their vSAN storage policies to take advantage of the new vSAN ESA (Express Storage Architecture) features. However, when they tried to change the storage policy for their production VMs, the operation kept failing with a cryptic error message. The error they were getting was: "Cannot complete operation due to insufficient resources to satisfy current storage policy." This was strange because they had plenty of disk space available. The vSAN cluster was only at 45% capacity, and all the hosts were healthy. Let me walk through how we troubleshooted and fixed this issue. Understanding the Problem First, let's understand what was happening in their environment: They had a 6-node vSAN cluster running VCF 9.0 vSAN was configured with the new ESA architecture They were trying to migrate VMs fro...
    Read more

    Unlocking VMware Cloud Foundation 9.0: A Strategic Blueprint for Enterprise Transformation

    The evolution of VMware under Broadcom represents not disruption, but clarification—a focused vision toward unified private cloud excellence. As organizations navigate this transformation, the opportunity has never been greater to build truly modern, efficient, and powerful infrastructure with VMware Cloud Foundation. After architecting VMware solutions across diverse enterprise environments, I've observed a pattern: organizations that embrace VMware Cloud Foundation (VCF) strategically—rather than viewing the transition as a burden—emerge with significantly more capable, cost-effective, and future-ready infrastructure. This post shares a practical framework for successfully modernizing your VMware environment, maximizing your investment, and positioning your organization for the AI-driven, cloud-native future. Understanding the VMware Cloud Foundation Vision Let's start with clarity about what Broadcom and VMware are building: VMware Cloud Foundati...
    Read more