How can I perform an authoritative restoration of Active Directory (AD) in Windows Server 2003?

How can I perform an authoritative restoration of Active Directory (AD) in Windows Server 2003?

John Savill

December 17, 2003

2 Min Read
ITPro Today logo in a gray background | ITPro Today

A. To perform an authoritative restoration, you must first recover AD from a backup by performing the following steps:

  1. Restart the domain controller (DC) of interest.

  2. When you see the menu to select the OS, press F8.

  3. From the Windows Advanced Options Menu, select Directory Services Restore Mode, then press Enter.

  4. Select the Windows 2003 OS, then press Enter.

  5. Use the restore mode password and log on as the administrator.

  6. Click OK to the confirmation that Windows is running in Safe mode.

  7. Start the Windows Backup application (go to Start, Programs, Accessories, System Tools, and click Backup).

  8. Select the Restore option, then select the media where the backup is stored and ensure that the System State is selected.

  9. Click OK to close any warning dialog boxes.

  10. After the AD recovery is complete, click Close to the displayed dialog box and click Yes to restart the computer.

When the machine restarts, you need to specify which parts of the restoration will be authoritative by performing the following steps:

  1. When you see the menu to select the OS, press F8.

  2. From the Windows Advanced Options Menu, select Directory Services Restore Mode, then press Enter.

  3. Select the Windows 2003 OS, then press Enter.

  4. Use the restore mode password to log on as the administrator.

  5. Click OK to the confirmation that Windows is running in Safe mode.

  6. Open a command prompt--go to Start, Run and type

    cmd
  7. Start the Ntdsutil utility.

  8. To access the authoritative restore mode, type

    ntdsutil: authoritative restore
  9. If you want to mark the entire database as authoritative, type

    authoritative restore: restore database

    If you want to mark only a certain object as authoritative (e.g., an organizational unit--OU), type

    authoritative restore: restore subtree 
  10. To exit Ntdsutil, type

    quit
  11. Restart the DC as usual.

If you perform an authoritative restoration of a backup that's more than 14 days old, some trust relationships might be broken because the passwords used by the trust would have been changed twice (the directory stores both the current and previous password, which changes every 7 days). So, for example, when restoring NT LAN Manager (NTLM) trusts, you would have to break the trust, then recreate it.

About the Author

Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like