Last Updated: July 18, 2009

Issue

You want to perform an authoritative restore of your Active Directory database on Microsoft Windows Server 2003.

Solution

To perform an authoritative restoration, you must first recover AD from a backup by performing the following steps:

1. Restart the domain controller (DC).
2. When you see the menu to select the OS, press F8.
3. From the Windows Advanced Options Menu, select Directory Services Restore Mode, then press Enter.
4. Select the Windows 2003 OS, then press Enter.
5. Use the restore mode password and log on as the administrator.
6. Click OK to the confirmation that Windows is running in Safe mode.
7. Start the Windows Backup application (go to Start > Programs > Accessories > System Tools, then click Backup).
8. Select the Restore option, then select the media where the backup is stored and ensure that the System State is selected.
9. Click OK to close any warning dialog boxes.
10. After the AD recovery is complete, click Close to the displayed dialog box and click Yes to restart the computer.

When the machine restarts, you need to specify which parts of the restoration will be authoritative by performing the following steps:

1. When you see the menu to select the OS, press F8.
2. From the Windows Advanced Options Menu, select Directory Services Restore Mode, then press Enter.
3. Select the Windows 2003 OS, then press Enter.
4. Use the restore mode password to log on as the administrator.
5. Click OK to the confirmation that Windows is running in Safe mode.
6. Open a command prompt (go to Start > Run) and type:
   
   cmd
   
   
7. Start the Ntdsutil utility.
8. To access the authoritative restore mode, type:
   
   ntdsutil: authoritative restore
   
   
9. If you want to mark the entire database as authoritative, type:
   
   authoritative restore: restore database
   
   If you want to mark only a certain object as authoritative (e.g., an organizational unit--OU), type:
   
   authoritative restore: restore subtree name--DN--of subtree, e.g. OU=sales,DC=savilltech,DC=com>
   
   
10. To exit Ntdsutil, type:
    
    quit
    
    
11. Restart your domain controller as usual.

If you performed an authoritative restoration of a backup that's more than 14 days old, some trust relationships might be broken because the passwords used by the trust would have been changed twice (the directory stores both the current and previous password, which changes every 7 days). So, for example, when restoring NT LAN Manager (NTLM) trusts, you would have to break the trust, then recreate it.