Active Directory Database Restore (4037701)

Let's say you need to perform a restore of just the AD because of data corruption and the AD services refuse to start. This type of restore depends on whether the DC is able to start in normal mode. If it is, then you would be able to utilize the "dcpromo /forceremoval" command. This will remove the AD services from the server.

If there are no other DC's available then the data would need to be restored from the recovery point. One way to perform the restore is to completely restore the server (https://support.quest.com/appassure/kb/118156).  Another way would be to restore the AD databases. The DB's I am speaking of are:

• NTDS.dit  (database file)
• Edb.chk  (checkpoint file)
• Edb*.log  (transaction logs)
• Res1.log and Res2.log  (reserve transaction logs)

* By default, these files are located in the %systemroot%\NTDS folder – however, the location is configurable, so be sure to check this. Also, if any changes have been made to the GPO, the SYSVOL system volume (%systemroot%\SYSVOL) needs to be restored as well.

The entire process will look like this:

1. If no other DCs are available, make sure the newest available recovery point is used for restore.
   1. This is especially important, since all the information created since the last backup will be lost.

1. Reboot the domain controller into Directory Services Restore mode.
2. Create a copy of your AD database files.
3. Restore the files from the  recovery point  (use file level restore from an image-level backup to accomplish that).
4. Reboot the computer.
   1. Make sure the Active Directory service has started successfully.