Granular Recovery of Active Directory Objects Andrew Zhelezko Veeam Technical Marketing Engineer Granular Recovery of Active Directory Objects Contents Introduction .......................................................................... 3 Reanimating Active Directory tombstone objects ..................................................................... 4 Active Directory recycle bin............................................................. 5 Windows Server Backup ...............................................................7 Active Directory application restore from a system state . 10 Active Directory snapshots ............................................................ 14 Veeam Explorer for Microsoft Active Directory ........................................... 16 Virtual Domain Controller . 16 Physical Domain Controller . 18 Active Directory object restore . 19 Conclusion ........................................................................... 24 Appendix A: Resources used ........................................................... 24 About the Author ..................................................................... 25 About Veeam Software ...............................................................25 © 2016 Veeam Software 2 Granular Recovery of Active Directory Objects Introduction Microsoft Active Directory is a standard in corporate environments where policy-based management and easy scalability are required . It’s almost impossible to imagine how system administrators would be able to do their jobs effectively if LDAP protocol didn’t exist . Not only is Active Directory a great power, but it's also a great responsibility — and it requires spending lots of time with it in order to maximize its capabilities . For example, creating and removing Active Directory objects is one of the most frequent requests for system administrators . Beyond that, there are many situations when something goes wrong and an admin is required to recover an Active Directory object, a bunch of objects or its attributes after an accidental change or even an intentional deletion . In this white paper, you will learn more about recovering Active Directory objects . I’ll show you a few different options for performing those tasks, including native Windows tools and external tools like Veeam® Explorer™ for Microsoft Active Directory . I’ll also compare these tools by performing the same operations with each of them . In addition, since it’s not possible to talk about recovery operations without mentioning backup, I’ll also discuss Domain Controller backup processes . Because Active Directory has existed for several years, there are more tools for managing it than I’m going to cover . This is not the ultimate guide to cover all possible scenarios or a universal solution to solve any Active Directory-related problem . Moreover, because there might be multiple domain controllers (DCs), complicated architectures and different security policies in your environment, I won’t be taking into consideration every single case . Feel free to reach out to me after you’ve read the white paper and I’d be happy to discuss your personal Active Directory experience or other interesting cases . © 2016 Veeam Software 3 Granular Recovery of Active Directory Objects Reanimating Active Directory tombstone objects Prior to Windows Server 2008 R2, a deleted Active Directory object was made immediately invisible to the administrator . Active Directory simply marked it as tombstoned, dropped most of its attributes and preserved it physically for a lifetime period (60 days for Windows Server 2000/2003 and 180 days for Windows 2003 SP1/2008), just to ensure that the information was successfully replicated across the system . Once a lifetime period was over, a special process called garbage collector physically removed the object from the database . The Tombstone mechanism was never intended to be a temporary recycle bin, and objects weren’t ever supposed to be reanimated, even if was technically possible to do so by using a program like ldp . Below, is my attempt to find all tombstoned objects in my lab . Figure 1. Searching deleted objects with LDP utility. If you’re interested in the reanimation of Active Directory tombstone objects, I recommend the following guide: https://technet.microsoft.com/en-us/magazine/2007.09.tombstones.aspx Pros: • Universal method for Windows 2003+ domains • DC doesn’t need to be down © 2016 Veeam Software 4 Granular Recovery of Active Directory Objects Cons: • Clunky user interface of LDP tool • Object attributes are not preserved • Works only for deleted, not changed, objects • Recovery is limited by a lifetime period value • No automation for hierarchy recovery Active Directory recycle bin Things started to change after Windows 2008 R2 when Microsoft implemented a long-awaited Active Directory recycle bin . The standard life cycle of an Active Directory object was extended and the logic of object deletion changed . With this feature enabled, the object started going to the deleted objects container right after deletion, where it’s kept for the lifetime of the deleted object . Most important, all of the object’s link-valued and non-link-valued attributes were able to be preserved by the system for the same lifetime period . This means you can now easily recover an object with those attributes during this period . Once the lifetime is over, the system changes the object status to recycled, drops most of its attributes and the objects becomes logically equal to what used to be tombstoned in Windows Server 2003 and Windows Server 2008 . The only difference is the recycled object can’t be restored or reanimated, so it should be automatically removed by a garbage collector . Figure 2. Active Directory Object life cycle with Active Directory recycle bin enabled So far, the Active Directory recycle bin is not enabled by default on any Windows Server OS . To utilize this tool, you should prepare your environment, make sure that every DC in your forest is running Windows Server 2008 R2 and above, and set your forest functional level to Windows 2008 R2 or above . NOTE: Enabling the Active Directory recycle bin requires you to upgrade the forest schema configuration and it can’t be undone later. © 2016 Veeam Software 5 Granular Recovery of Active Directory Objects Before using Active Directory recycle bin, keep in mind that: 1 . Enabling the Active Directory recycle bin changes all current tombstoned objects into recycled objects, so you won’t be able to restore them once enabling is done . 2 . The process of restoring multiple dependent objects can be difficult, since it requires a strict order of restore, starting from the higher-placed objects . 3 . In Windows Server 2008 R2, every operation related to the Active Directory recycled bin should be done via PowerShell cmdlets, no GUI provided . Windows Server 2012 and above introduce Active Directory Administration Center (ADAC), where all recycle bin operations can be performed via GUI . 4 . The recycle bin doesn’t have anything in common with Active Directory backup, and it won’t help to restore a whole DC if it is damaged . Figure 3. Enabling Active Directory recycle bin in Windows Server 2012 via ADAC Additional information about Active Directory recycle bin architecture in Windows Server 2008 R2 and above can be found here: • https://technet.microsoft.com/en-us/library/dd379542(v=ws.10).aspx • http://blogs.technet.com/b/askds/archive/2009/08/27/the-ad-recycle-bin-understanding- implementing-best-practices-and-troubleshooting.aspx Pros: • A universal method for Windows 2008 (or newer) domains • Object attributes are preserved for a lifetime period • Doesn’t require reboot of DC • GUI for Windows Server 2012+ © 2016 Veeam Software 6 Granular Recovery of Active Directory Objects Cons: • Works for Windows Server 2008 R2+ domains • Works only for deleted, not changed objects • Recovery is limited by a lifetime period value • No automation for hierarchy recovery Windows Server Backup The easiest way to protect the whole DC is to use native Windows Server Backup — a successor of the formerly used NTBackup utility . This feature comes with Windows Server 2008 and newer versions, and has the basic capabilities for backup and recovery of volumes, files and even system state . You can install it on your Domain Controller (DC) using the add roles and features wizard . Figure 4: Windows Server Backup feature installation Run wbadmin from the command line, or launch Windows Server Backup from the administrative tools to start the utility . You can make an individual backup, schedule a backup task or restore data from an existing backup point . © 2016 Veeam Software 7 Granular Recovery of Active Directory Objects Figure 5: wbadmin GUI Let’s make an Active Directory backup using this command line tool . First, run command line (cmd) in the elevated mode . Then, type wbadmin ? and get the list of supported commands . There is a special command for this case: wbadmin start systemstatebackup -backupTarget:<VolumeName>, which is where you should change <VolumeName> to any local volume or a path to a network share . NOTE: Once running, it grabs not only Active Directory-related items, which are needed for the Active Directory restore, but a system state, including the SYSVOL and NTDS folders, and puts them into a specified location. © 2016 Veeam Software 8 Granular Recovery of Active Directory Objects I’ll run the following script just to demonstrate how it works: wbadmin start systemstatebackup –backupTarget:d: