This section provides important information that you should consider when using the Online Restore Wizard.
The wizard allows you to selectively restore a portion of the Active Directory® domain naming context. At that, the wizard causes Active Directory® to replicate this restored state of objects, overwriting the copies currently held on all domain controllers within the domain. The restored objects and object attributes receive a version greater than the current set of directory objects. As a result, the restored objects appear to be more recent and therefore they are replicated out to the other domain controllers within the domain.
Restore the wizard performs is authoritative. With an authoritative restore, Active Directory® object data reverts to the state it had when the backup was created and any updates that were made after that point are lost. For example, obsolete passwords could be restored, which may have impact on user and computer accounts.
One more issue related to authoritative restore is the impact on linked attributes, such as group memberships. For example, when you authoritatively restore a user that is currently marked as deleted (undelete a user account), in some recovery scenarios you risk possible loss of group membership information.
To ensure the correct restoration of group memberships, along with the other linked attributes, the Online Restore Wizard can force incremental replication of Active Directory®. Incremental replication transfers only the changes that occurred since the last replication.
Once the wizard has undeleted some objects for which linked attributes need to be restored, it reminds you that the un-deletion must be replicated to all domain controllers for the linked attributes to be correctly represented on each domain controller. The wizard prompts you to choose whether to force the replication, skip the replication, or stop the operation.
Before making a choice, consider the following:
When you choose to force the replication, the wizard ensures that all linked attributes, such as group memberships, of the undeleted objects are correctly restored on all domain controllers.
This choice may result in considerable replication traffic, depending on the number of domain controllers in your domain. However, it is required because of the way links and deletions are dealt with in Active Directory®. Before the restoration of linked attributes, the undeleted objects must be replicated to all domain controllers for the restored linked attributes to be correctly represented on each domain controller.
This requirement stems not from the wizard’s implementation, but from the way in which the data is replicated in Active Directory®.
When you choose not to force the replication, you may risk a loss of linked attributes, such as group memberships, on replication partners after the normal Active Directory® replication transfers the undeletion to all domain controllers.
For example, when you select a user to be undeleted, with the user being a member of a certain group, and choose not to have the wizard force the replication, the results of the restore on the representation of the user’s group memberships may vary. These variations are based on which objects replicate first after the wizard completes the restore.
If the undeletion of the user replicates first, then the group membership information of both the group (the members it contains) and the user (the groups he or she belongs to) will be represented correctly.
If the restore of the group replicates first, the replication partners will drop the addition of the (locally) deleted user from the group membership. The only exception to this is the user’s primary group, which is always represented correctly from both the user and group reference.
The wizard marks the undeleted objects so that they are replicated in a proper sequence. However, making changes to them before the replication is completed may break the proper sequence. Skip the replication enforcement if you are sure that no changes will be made to the restored objects until those objects are replicated to all domain controllers within the domain. Optionally, you may have the wizard force the incremental replication on the final step. You might also force the replication with a different tool, or wait for replication to occur on normal schedule.
In addition, you might skip the replication enforcement if you undelete objects whose deletions are not yet replicated within your domain. In that scenario, the objects in question are not marked as deleted on other domain controllers, which ensures the correct representation of linked attributes.
When you choose to stop the online restore operation, the wizard neither forces the replication nor restores linked attributes.
This choice implies that you wait until the undeleted objects are replicated to all domain controllers, and then restore those objects once more using the wizard. In that scenario, the second path of the wizard is used to restore the linked attributes on the undeleted objects. Stop the operation if the enforcement of replication in your domain is inadmissible for some reasons, but you want to be sure that linked attributes be represented correctly on all domain controllers.
© 2024 Quest Software Inc. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center
