Recovery Manager for AD Forest Edition 10.3 - User Guide

Frequently asked questions

• Why do I need to restore deleted users or groups, rather than re-create them?

• How can I restore a user or group in Active Directory?

• How does online restore work?

• When an object is undeleted, what is restored from the tombstone and what is restored from the backup?

• What’s the difference between an online restore and an authoritative restore?

• What’s the difference between the agentless restore method and the agent-based restore method?

• Can I undelete a mailbox-enabled user?

• In the Group Policy Restore Wizard, a GPO link is shown as deleted, but the link actually exists in Active Directory. What’s wrong?

• What is a primary restore of the SYSVOL?

• How do I change the Backup Agent port number?

• How does Recovery Manager for Active Directory select a DC for an authoritative (primary) restore of SYSVOL during forest recovery?

• How does Recovery Manager for Active Directory isolate domain controllers during forest recovery?

• How does Recovery Manager for Active Directory select a DC to add the global catalog during forest recovery?

Why do I need to restore deleted users or groups, rather than re-create them?

Each user account or security group is uniquely identified with a SID (Security ID) and a GUID (Global Unique ID). If a user or group has been deleted, and is then re-created with the same name, the SID and GUID of the newly created user or group will differ from those of the deleted object. As a result, the new user or group loses all permissions, profile settings, and all other settings associated with the old SID and GUID.

When you restore a deleted user or group from a backup, the restored user or group will have the same SID and GUID as the deleted object, and will have all the settings associated with that SID and GUID.

How can I restore a user or group in Active Directory?

You can restore individual objects using the Online Restore feature of RMAD. Alternatively, you can restore the entire Active Directory® database, and then select individual objects for authoritative restore.

While RMAD supports both methods, online restore is the recommended option as it is faster and simpler. The online restore method allows you to easily restore individual directory objects and object attributes without restarting domain controllers and putting Active Directory® offline, thus achieving near-zero downtime.

How does online restore work?

The RMAD online restore method facilitates the restoration of objects and objects attribute values, without putting Active Directory® offline. The product can:

• Recover deleted objects with all their attributes and links by using the functionality provided by Microsoft’s Active Directory® Recycle Bin feature.

• Convert the tombstones into regular objects before applying the attribute values held in the backup.

In the latter scenario, Active Directory retains the object’s tombstone for a specified configurable period of time (tombstone lifetime) in order to enable Active Directory® replication to propagate the deletion. An object can only be undeleted if its tombstone exists. After applying the backed-up attribute values, the online restore process adjusts replication-related properties of the restored objects, so that Active Directory® replication propagates the restored data to all domain controllers. Optionally, online restore can force replication of the restored data to decrease propagation delay.