Windows – Recovering deleted Windows AD objects from longer than the tombstone lifetime.

Windows – Recovering deleted Windows AD objects from longer than the tombstone lifetime.

https://technet.microsoft.com/en-gb/library/cc961934.aspx

“You cannot restore into a replicated enterprise a backup image that is older than the tombstone lifetime setting for the enterprise. “

http://blog.pluralsight.com/backup-and-restore-active-directory-on-windows-server-2008

9. But if you want to restore a specific Active Directory object then you can use the ever familiar ntdsutil.

For this example we are going to restore a user account with a distinguished name of CN=Test User,CN=Users,DC=home,DC=local. So the commands would be:

ntdsutil
activate instance ntds
authoritative restore
restore object “cn=Test User,cn=Users,dc=home,dc=local”

This implies and autoritative restore is needed to pull back a single object.

http://windowsitpro.com/active-directory/recovering-active-directory-disasters

“In AD forests operating at the Server 2008 R2 forest functional level (FFL), you can enable a new feature known as the Active Directory Recycle Bin.”

“An object in the deleted object phase can be recovered to the exact state it was in at the time of deletion using the same process that’s used to reanimate a tombstone. By default, an object stays in the deleted object phase for the same amount of time as the forest’s tombstone lifetime,”

“After the deleted object lifetime expires, the garbage collector moves the object into the recycled object phase. A recycled object is the functional equivalent of a tombstone, with one important difference: You can’t reanimate a recycled object or restore it from a backup.”

Note the last part “You can’t reanimate a recycled object or restore it from a backup.”!!

Windows Server Manuals https://technet.microsoft.com/en-us/library/cc816627%28v=ws.10%29.aspx

Windows Server 2008 Performing Nonauthoritative Restore of Active Directory Domain Services

https://technet.microsoft.com/en-us/library/cc816627%28v=ws.10%29.aspx

“If your objective is to recover objects that were deleted since the last backup, first perform a nonauthoritative restore from backup to reinstate the deleted objects and then perform an authoritative restore to mark the deleted objects as authoritative so that they are not overwritten during replication. When you are performing both a nonauthoritative restore and an authoritative restore, do not allow the domain controller to restart after the nonauthoritative restore. ”

Performing Authoritative Restore of Active Directory Objects

https://technet.microsoft.com/en-us/library/cc816878%28v=ws.10%29.aspx

Also

https://social.technet.microsoft.com/Forums/en-US/cf56124b-efdd-42f2-ad7e-eb41f584c0b1/active-directory-authoritative-restore-tombstone-lifetime?forum=winserverDS

http://support2.microsoft.com/kb/216993/en-gb

“Windows Server 2003 and Windows 2000 do not allow the restoring of old backup images into a replicated enterprise. Specifically, the useful life of a backup is the same as the “tombstone lifetime” setting for the enterprise.”

http://support.microsoft.com/kb/840001

Windows Server 2003 SP1

ntdsutil “authoritative restore” “restore object <object DN path>” q q

http://support2.microsoft.com/kb/216993/en-gb

“Windows Server 2003 and Windows 2000 do not allow the restoring of old backup images into a replicated enterprise. Specifically, the useful life of a backup is the same as the “tombstone lifetime” setting for the enterprise.”

http://support.microsoft.com/kb/555636/en-us

LDIFDE – Export / Import data from Active Directory – LDIFDE commands

http://www.techrepublic.com/blog/data-center/simplify-admin-tasks-by-exporting-active-directory-data-with-csvde/

“CSVDE – Comma Separated Value Data Exchange”

“CSVDE has two core functions: importing data from a CSV formatted file into Active Directory and exporting data from Active Directory into a CSV formatted file.”

“The first way of excluding unwanted results is to filter down to a specific part of the directory using the -d flag.  Using this we can focus the export on a particular OU within the directory structure:

csvde -d “OU=MyOU,DC=domain,dc=local” -f test.csv”

”

“To further reduce the number of unwanted records exported, we can use the -r flag.  The -r flag is used to filter out rows of data based on the specific properties of that record. In this example I want to find users and computers only:

csvde -f test.scv -r objectClass=user

Or to use multiple filters:

csvde -f test.csv -r “(&(objectClass=user)(objectCategory=person)”

“