restore active directory

Just FYI: I had an ugly scene yesterday. I rebooted an SBS2K3 server, and
when it came up, neither Exchange Info Store nore Exchange System Attendant
would start. Various Exchange, DNS, Security, and LSA errors indicated that
nothing could authenticate, even though I was logged in. Also there were no,
as in zero, records in DNS, and I could recreate any. After many Googles, it
seemed that the problem was that Active Directory had somehow gotten munged
up. That got me to looking up how to restore AD and or System State from a
backup, which thankfully I had. Googling "restore AD" and "restore System
State" led me to confusing articles full of dire and incomprehsible warnings
about the difference between authoritative restores and non-authoritative
restores and more warnings about the dangers of NTDSUTIL, although there
were no clear instructions about how to use NTDSUTIL to restore AD and/or
SS.

I could find no articles about restoring AD or System State that pertained
just to SBS, and most of what there was about restoring AD/SS on Server 2003
was vague and scary and generally unhelpful, not to say discouraging.

I did have a System State only on-disk backup in Backup Exec, but even their
Knowledge Base article implied that I shouldn't do it and cited some MS KBs
about authoritative and non-authoritative restores.

(There was one article about restoring AD/SS from NTBackup, and that's
clearly a good way to go.)

We have a BE support contract, so I called their Tech Support. Vishnu was
happy to find out that I had a bootable system and wanted me to restore the
whole C: drive, including the SS, because, he said, if you didn't have an
up-to-date SS backup, you could end up with a blue-screen and an
unrecoverable mess.

I didn't want to restore the whole C: drive because it was already 11 at
night and would take hours. I couldn't do it anyway because BE has a
tendency to fail on the SS portion of a whole-disk backup, so I have a
separate and fast SS backup-to-disk that runs once a week. Since one backup
was on tape and another on disk, there was no way to do an all-at-once
backup of both, and he said doing them sequentially wouldn't work.

The SS backup was current, so he had me boot into Directory Restore mode,
change all the BE services to Local System Account so they could start,
change a coupe of settings, then run a restore-System-State. The following
reboot was a normal, beautiful thing. No worries about authoritative or
non-authoritative restores when there's just on DC.

The NTBackup System State restore is just as straightforward.

Gary,

Thanks for sharing this. It is a scary experience to have a production
server go down. I agree that the info out there is confusing and
overwhelming - especially if you haven't done a restore for a longer period
of time.

[smultani2]

Hey Gery

Can you please tel us which are the couple of settings wich should be changed "change a coupe of settings"?

Thanks in advance.

Satbir

[Rawko]

You can use the script in the environment ConfigureAdam.ps1 command-line Exchange Management Shell to modify the default configuration of Active Directory Lightweight Directory Services (AD LDS) on the Edge Transport server. After installing the Edge Transport server role, you can use the script provided with Exchange 2010 ConfigureAdam.ps1 to change ports and directories used by AD LDS.

[erickprime]

Easy dude..

Reboot your server and press F8 until you get the safe mode options. Select Directory Restore mode (or something like that). Once you are in, you can then run the restore. Once restored you need to reboot. It's very easily using backup exec (a little too easy).

I know this cuz I just had to do it. Now, I got AD working but due to some updates my Info Store stopped working.