Академический Документы
Профессиональный Документы
Культура Документы
Recovery
100.1.0.253
100.1.0.253 100.1.0.254
100.1.0.254
Instructor Setup
Student Setup
Resources
Active Directory Product Operation Guide
http://www.microsoft.com/downloads/details.aspx?FamilyId=84DFE61E-FB7B-
4673-89B8-55BCC801B431&displaylang=en
Changes written to
logs
Transaction
logs Dit file
Checkpoint tracks log
position of latest write to
Memory database file
Edb.chk Disk
Active Directory Backup
System State Backup
System Startup Files – System files to boot
System registry
Sysvol
Halt Replication
Lingering Objects- Strict replication consistency
Event 1864, 2042, 1988
DCPROMO /ADV
Store to media:
DVD
CDROM
Tape
File System
Restore to an
alternative location
Create Replica From Media in
Windows Server 2003
Source initial replication while promoting DC
from backed up files instead of the network
Backup DS using regular backup s/w
Restore/copy files to candidate DC
DCPROMO: source replication from restored files
Also works for GCs
Network connectivity still required
Not a general replication mechanism
INSTALL FROM MEDIA
NTDSUTIL
Metadata cleanup
Remove orphaned dc’s or child domains
Integrity Check + Repair
Wrapper around ESENTUTL
Tells you if database is good or bad – Jet
Error 1018. Power failure, Faulty Hardware
Authoritative Restore
Mark selected objects on DC as
authoritative
More NTDSUTIL
Move the Database, Log files to another
Disk.
Offline Defragmentation.
To release space back to the file system.
Must be done on Per DC.
Remote Administration
Q256588 - Administrating remote servers in
DS restore mode
Create a new entry in the Boot.ini file with
/SAFEBOOT:DSREPAIR /SOS
Set the appropriate boot option in the arch path and
reboot the system
Resolution:
Check with HW vendors for known issues
required)
Revovering AD objects
No Good System state Backup – Q237677
LDIFDE - Export and Import Directory Objects
Export OUs, users, and groups from an entire
forest
Run LDIFDE export commands against each
domain in the forest, or alternatively, run the
query once against the global catalog (GC).
No SID history
Recovering deleted DNS zone
Deleted a DNS Zone called: Test.sample.com
and want to restore it back:
Restore Sytem state from backup in “DS
restore mode”
Start NTDSUTIL
Restore Subtree
DC=test.sample.com,cn=MicrosoftDNS,cn=sy
stem,DC=MS,DC=COM
Reboot DC in normal mode
Deleted Printer objects
Printer Pruning on DC’s (for it’s own site)
A process which keeps printer information in
Active Directory current.
Controlled by GPO’s. Q234270
”Allow pruning of published printers”
”Directory pruning interval” - Default 8hours
Stop the Spooler service on the offline DC
If a DC does not see the printers for a period
of time, it may consider the printers orphaned
when the DC come back online
Deleted Objects in Active Directory
Protection
Set replication schedule once every >four days
on “backup domain controller”
Mark objects as authoritative when deletion
detected
FSMO
Rules
Transfer if role needed before current owner goes offline
Seizure Rules
Install of OS that held seized role can never come back online
Reinstall with same names is ok. Do Not use old Backup’s.
RID Master
Considerations for performing a Seizure
on a RID Master.
Risk of Duplicate RIDs.
Original Master should NEVER come back
online again if a Seizure is performed.
Instead, the original role holder must be
reinstalled before introduced in the Domain
again.
Duplicate SIDS after restore
Problem after Backup and Restore of a DC.
RID pool is set to a range that has already
been used to allocate SIDs
Duplicate SIDS are created as the customer
repadmin /options
+DISABLE_OUTBOUND_REPL
X:\I386\>adprep /forestprep
%systemroot%\System32\Debug\Adprep\Logs\
<Latest_log> folder
Enable replication again on the Schema Master
Recommendations for Returning
to service after Seizure
Schema Master
Not recommended. Can lead to a corrupt Forest and require
a Forest Recovery
Domain Naming Master
Not recommended. Can require rebuilding Domains.
PDC Emulator
Allowed. No Permanent damage occurs.
Infrastructure Master
Allowed. No damage occurs to the Directory
RID Master
Not recommended. Duplicate RID pools can be allocated to
DC’s, leading to data corruption in the Directory.
Backup / Restore FSMO Rules
Backup
Document the machine names of FSMO role holders when
you do the backup
Include %windir%?
Restore
DC's that have not replicated for TSL # of days should not
get fixed. They should get removed and rebuilt.
Do not reduce TSL unless verifying end to end replication of
forest.
As a general rule, do not reduce TSL to low # of days to
accelerate deletion of a tombstone
Never restore FSMO's except as last restort - implies
awareness of where FSMO was when backup made.
Rules: Don't transfer or seize FSMO role of current owner
offline unless you are performing dependent operation
Procedures for seizing fsmo’s
1. First replicate all AD changes to all
DC’s in your forest.
2. Verify successfull replication for your
DC which seize the role.
3. Seize the FSMO role.
4. View the current FSMO role holders.
”Netdom query fsmo”. Replmon
Critical Objects
Machine Accounts for DC’s
Machine account password and Trust relationship password is
reset every 30 days
Q257288:Recover from a Deleted DC Machine Account
Dcdiag /s:localhost /repairmachineaccount
Demote and then re-promote the server. (Services)
Or, Dcpromo /forceremoval + clean up metadata + re-promote
NTLM Trust Relationships
Password is reset every 7 days
Authoritative Restore - NOT older than 14 days
To reset NTLM trust relationships to Windows 2000 or downlevel
domains, the trust must be removed and re-created.
DC Computer Accounts
Problem:
AD replication uses locally held password for
Kerberos authentication
Defaults
Password default change interval = 30 days (N)
Backup useful life = 60 days
Password history = N + N-1
Symptoms of mismatch?
AD Replication fails with “access denied”
Recovering File System Policy
Scenario:
File system portion of policy has been deleted
Cause
Administrators deleted policy to rebuild from scratch
Deleting a File/Directory from Sysvol on one DC, results
in FRS replicated deletion to all members of set.
If C:\Winnt\sysvol is copied to alternate location
D:\sysvol = The junction points in sysvol are also
transfered to the alternate location. Junction points still
points to to original location C:\Winnt\sysvol
Recovering File System Policy
Recovery:
Locate policy files
Restore backup image of SYSVOL to alternate
location
Turn off “Mark restored data as primary for all replicas”
Locate files on member with delayed schedule
Locate files in pre-existing directory
Copy files to member and let replication take
place
Authoritative Restore of Sysvol
Rebuild Sysvol with Burflags
BURFLAGS = (backup / restore flags)
NET STOP NTFRS
HKLM\System\CCS\Services\NtFrs\Parameters\Bac
kup/Restore\Process at Startup\D2
D2: Will perform a full synch of the replica set
from it’s Upstream partner
BURFLAGS registry key to D4 (authoritative mode)
Also used as last resort to fix FRS replication
related problems.
Authoritative FRS Restore
When to use: (rare) Q315457
SYSVOL replica set meltdown, requiring a
DCGPOFix.exe
Restores the Default Domain Controller and Default Domain
GPOs exists
White Paper: Administering Group Policy with the GPMC
http://www.microsoft.com/windowsserver2003/gpmc/gpmcwp.
mspx
Unable to open Group Policy
Snap-In
Sysvol and NetLogon are not shared out
Are all directories and files in Sysvol
Netlogon and frs services running
ACLs are correct for c:\winnt\sysvol
Are AD replication working ok?
Create a test.txt file in sysvol. Does it replicate?
Initialization of the system volume:
Value of SysvolReady to 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\N
etlogon\Parameters
W2K3 article: Q327781 - How to Troubleshoot Missing
SYSVOL and NETLOGON Shares
Recommendation for GPO’s
Accept the defaults that are set within the Default Domain
Policy and the Default Domain Controllers Policy.
Create new policies instead.
Default Domain Policy – Account Policies
Password Policy
Account Lockout Policy
Kerberos Policy
Default Domain Controllers Policy
User Rights Assignment
Ensure all DCs receive consistent Group Policy settings
Do not filter policy settings on individual DCs
All DCs should remain in the Domain Controllers OU
Forcefully demote a DC W2K
If DCPROMO fails, how to demote….
HKEY_LOCAL_MACHINE\SYSTEM\CurrentC
ontrolSet\Control\ProductOptions
Edit menu, click String, type ServerNT
Promote the computer to a different forest
demote the computer as standalone server
Q216498 Removing Active Directory Data
After an Unsuccessful Demotion
Forcefully demote a DC
If re-installation is NOT an option and…
Parent domain DC is NOT accessible when
attempting to demote last DC in a child.
Replica DC in same domain is NOT
accessible when trying to demote.
Replication failure due to failed
authentication or replication error.
DC hasn’t replicated in Tombstone life
number of days.
W2K3 and W2K-SP4 Forcefully
Force demotion
W2K3 ÆDCPROMO /FORCEREMOVAL
W2K Æ DCPROMO /FORCEREMOVAL
Need Windows 2000 SP4
Does not cleanup metadata from other DC’s in AD
Use NTDSUTIL to cleanup the metadata
Q315148 - Remove Old Metadata from the Active Directory
Database
http://support.microsoft.com/?id=332199
Currently the DCPROMO /FORCEREMOVAL
command doesn't work in DSREPAIR mode
Force Demotion Wizard
1 2
3 4
Remove a DC from a Domain
Standard/recommended method of removing a DC
from a domain – demotion using DCPROMO.
If a DC decommissioned incorrectly – need to clean
up Stale metadata for that DC.
Cleanup stale Metadata from Active Directory –
NTDSUTIL
Cleanup stale metadata from DNS
Delete the A and CNAME Records.