-
Title
Restoring the user and computer account password -
Description
Recovery Manager for Active Directory backs up and restores the Active Directory system state data using the Microsoft published APIs, however, there are situations where the need to restore user Passwords as well as SID history appear, and Microsoft’s published API’s (added in Windows 2003) do not allow you to restore these attributes.In many situations, the inability to restore the Password attribute from a backup is not a big problem as an object’s password can be reset after restoring the object. As for the SID History attribute, its restoration may be business-critical. An example is a situation where the domain from which the object was migrated is unavailable or decommissioned, and therefore SID History cannot be re-added. -
Cause
This article was created in response to Microsoft’s KB article 296257 regarding their position concerning products from independent software vendors (ISVs) such as Dell’s Recovery Manager for Active Directory that directly access the Active Directory database to restore AD objects rather than use the Microsoft published APIs. -
Resolution
In order to allow restoration of Password or SID History attributes, you must make a choice:1. Modify your AD Schema so that password and SID History attributes are kept in the object’s tombstone. This means that the Password and SID History attributes will already be on the object should you need to restore it later. Things to note:
a. Only objects deleted after the schema modification will keep these attributes on the tombstone.
b. To make this choice simple, we have provided the “Password and SIDHistory Recoverability Tool”, which will easily modify your Schema without making a mistake. You can also reverse this change with the same tool, should you change your mind in the future.
2. Restore objects using Recovery Manager’s Restore Agent (the “Agent Method”). The RMAD Restore Agent will write these attributes from your backup file directly to the AD Database. This allows you to restore these critical attributes when needed without the need to modify your schema, however this direct write to the AD database is what Microsoft’s KB article references
a. We feel it is important to note that this feature has been widely used in RMAD since Windows 2000 and there has never been an AD corruption issue reported from using the Restore Agent.
3. If you are on Forest Functional level 2008 R2, then enable the AD Recycle Bin. This causes RMAD to re-animate objects from the recycle bin, which will automatically contain all object attributes, including Password and SIDHistory. Things to note:
a. Only objects deleted after you enable the recycle bin will contain all attributes. For more information: https://support.quest.com/SolutionDetail.aspx?id=SOL89040
b. Also; enabling the recycle bin can significantly increase the size of your AD database over time, depending on how many objects you delete/recycle.
Agent and Agentless comparison
Agent Method
Agentless Method
Overview
Installs agent on DC prior to action
Directly writes to AD Database
Uninstalls agent after completion
Tombstone Reanimation interface to undelete object
LDAP API and ADSI to restore attributes not stored in tombstone.
Schema Modifications
(depending on the schema version)
None required
To preserve and restore SID History in tombstones, modify the searchFlags attribute value for the SID-History
(sIDHistory) schema object.
To preserve and restore passwords in tombstones, modify the searchFlags attribute value for the following
password-related schema objects:
• Unicode-Pwd (unicodePwd)
• DBCS-Pwd (dBCSPwd)
• Supplemental-Credentials (supplementalCredentials)
• Lm-Pwd-History (lmPwdHistory)
• Nt-Pwd-History (nTPwdHistory)
Required Permissions
The account must
• Have Write permission for the following folder on the Recovery Manager computer:
%AllUsersProfile%\Application Data\Quest Software\RMAD
• Be a member of the Domain Admins group.
To restore object attributes, you must only have write access to the attributes being restored.