Active Directory Backup & Restore: Key Techniques & Tools

1. 4.1 Managing the Active Directory Database TestOut Server Pro 2016: Identity Active Directory Backup and Restore

2. Section Skill Overview • Back up Active Directory and the SYSVOL. Create and mount an Active Directory snapshot. Use the Active Directory Administrative Center to enable the Active Directory Recycle Bin. Use the Active Directory Recycle Bin to recover deleted objects. Perform an authoritative Active Directory restore using wbadmin and ntdsutil. TestOut Server Pro 2016: Identity

3. Key Terms • Volume Shadow Copy Service Active Directory snapshots System State backup Active Directory Recycle Bin Non-authoritative Active Directory Restore Authoritative Active Directory Restore TestOut Server Pro 2016: Identity

4. Key Definitions • Volume Shadow Copy Service: The Windows service that allows the creation of Active Directory Snapshots. Active Directory snapshots: An instantaneous picture of the Active Directory database that allows you to see how Active Directory looked at the time that the snapshot was taken. System State backup: A backup created using the System State option in the Windows Server Backup tool that is used to backup Active Directory in case of catastrophic failure. Active Directory Recycle Bin: An Active Directory container that stores recently delete Active Directory objects. TestOut Server Pro 2016: Identity

5. Key Definitions • Non-authoritative Active Directory Restore: A restore that rebuilds an Active Directory database from a system state backup, restoring it to the state at the time of the backup. If the domain has multiple domain controllers, Active Directory replication will overwrite the restored domain controller with objects that were added or deleted on other domain controllers after the backup. Authoritative Active Directory Restore: A restore that rebuilds an Active Directory database from a system state backup, restoring it to the state at the time of the backup. If the domain has multiple domain controllers, the items marked for authoritative restore will overwrite the other domain controllers so as to match the restored domain controller during Active Directory replication. TestOut Server Pro 2016: Identity

6. Active Directory Backups TestOut Server Pro 2016: Identity

7. Active Directory Backups TestOut Server Pro 2016: Identity

8. Active Directory Backups TestOut Server Pro 2016: Identity

9. Active Directory Backups TestOut Server Pro 2016: Identity

10. Summary • Back up with a snapshot. Back up the system state. TestOut Server Pro 2016: Identity

11. In-Class Practice Do the following labs: • 4.1.4 Back Up Active Directory TestOut Server Pro 2016: Identity

12. Class Discussion • What are the two methodologies that you can use to backup Active Directory? Which of the two backup methodologies would you use to protect Active Directory? Which of the two backup methodologies would you use to inspect Active Directory elements at the point in time when they were backed up? When using the dsamain command with the -dbpath option to expose a snapshot as an LDAP source, why can't you use port 389? Which port should you use? How do you enable the Active Directory Recycle Bin? What are Active Directory tombstones? What is the difference between an authoritative and a non-authoritative Active Directory restore? What type of bootup should you use when performing either an authoritative or non-authoritative Active Directory restore? TestOut Server Pro 2016: Identity