OS: Windows 2008 R2 Active Directory (single DC environment..oy I know)
Issue: ADUC cannot open, Sysvol/AD not functioning, users cannot login, no existing good DCs and must restore from backups. Thankfully, local backups were configured properly with Windows Server Backup as below.
Install all Windows Server Backup features.
Run as administrator, Windows Server Backup.
Create new backup job.
Specify destination location, “backup to a hard disk that is dedicated for backups” deletes all data on the disk selected. Point this to only an external drive that is unused!
Configure backups to use:
backup configuration: custom
backup items: Full Server backup, including Bare Metal Recovery, System State and VSS
Advanced Setting: VSS full backup
Restart into DSRM (directory services restore mode)
Verify you have the restore mode password, if not type the following to reset the DSRM password:
set dsrm password
reset password on server null
<enter new password>
Set system to reboot in DSRM mode, or hit F8 at boot time to select DSRM mode
bcdedit /set safeboot dsrepair
Login as a local administrator (AD DB is down, you must use a local account)
If the local administrator is locked or password is unknown, boot from the recover disk at http://pogostick.net/~pnh/ntpasswd/ and unlock/reset password
Launch the Windows Server Backup GUI from Administrator Tools, and select “Recover”. Choose to recover the system state only.
Restart after the recovery completes (in my experience this takes about 45 minutes to complete)
The system will reboot again on it’s own before you will be able to login.
Again, login as a local administrator (AD DB is still down, you must use a local account)
You should now see a command prompt that states the System State recovery was successful.
Set system back to normal boot (only needed if bcdedit command was run earlier)
bcdedit /deletevalue safeboot
Mark OU or container authoritative if just restoring a section of AD (most likely due to an accidental deletion) with the following:
Restores the CN and every containing within:
restore subtree “OU=Users,OU=STL,DC=terminalcraft,DC=com”
Restores only the CN:
restore object “OU=Users,OU=STL,DC=terminalcraft,DC=com”
Restart into normal mode (AD should now be fully functional again)
Because the Backup tool restores the database and registry settings, when it restores Active Directory, the Internet Protocol (IP) configuration is also restored. Additionally, the DNS the certificate server database files, and File Replication service (FRS) are also restored. Completing restore has the following results:
- The File Replication service is reset so that it is in a state ready for replication from a FRS replication partner.
- The Active Directory database is verified for restore.
The server then restarts into normal operational mode and performs the following actions: