Active Directory Cookbook

16.5. Performing an Authoritative Restore of an Object or Subtree

Problem

You want to perform an authoritative restore of one or more objects, but not the entire Active Directory database.

Solution

Follow the same steps as Recipe 16.4, except after the restore has completed, do not restart the computer.

To restore a single object, run the following:

> ntdsutil "auth restore" "restore object cn=jsmith,ou=Sales,dc=rallencorp,dc=com" q

To restore an entire subtree, run the following:

> ntdsutil "auth restore" "restore subtree ou=Sales,dc=rallencorp,dc=com" q

Restart the computer.

There are some issues related to restoring user, group, computer, and trust objects that you should be aware of. See MS KB 216243 and MS KB 280079 for more information.

Discussion

If an administrator or user accidentally deletes an important object or entire subtree from Active Directory, you can restore it. Fortunately, the process isn’t very painful. The key is having a good backup that contains the objects you want to restore. If you don’t have a backup with the objects in it, you are out of luck. Well, that is not completely true with Windows Server 2003. See Recipe 16.17 for another option to restore deleted objects.

To restore one or more objects, you need to follow the same steps as performing a nonauthoritative restore. The only difference is that after you do the restore, you need to use the ntdsutil command to mark the objects in question as authoritative on the restored domain controller. After you reboot ...