Windows Server - Authoritative and NonAuthoritative Restore

What is a nonauthoritative restore?

When a domain controller or its directory is corrupted, damaged, or has failed, you have several options with which to restore the system. We will cover two options, the first option is a normal restore, called a nonauthoritative restore.

Nonauthoritative restore steps

1. In a nonauthoritative restore you simply restore a System State backup from a known good date. For example, suppose the domain controller crashed on Thursday, and you were making System State backups of each domain controller every night. You would then restore the system state from Wednesday night. Effectively, you roll the domain controller back in time.
2. When AD DS restarts on the domain controller, the domain controller contacts its replication partners and requests all subsequent updates. Effectively, the domain controller catches up with the rest of the domain by using standard replication mechanisms.

Many administrators prefer to just demote/promote instead of performing restores. But there are a couple of cases where nonauthoritative restores can come in handy.

• When you have a large AD DS database and you are restoring a domain controller at a remote site (so you don’t want to transfer a large AD DS database over the WAN due to congestion or lack of bandwidth).
• When you have other software and configurations on the server (so you can save time by not having to restore those items).

What is an authoritative restore?

A nonauthoritative restore is useful when the directory on a domain controller has been damaged or corrupted, but the problem has not spread to other domain controllers. What about a situation in which damage has been done, and the damage has been replicated? For example, what if you delete one or more objects, and that deletion has replicated? In such situations, a non-authoritative restore is not sufficient. If you restore a known good version of AD DS and restart the domain controller, the deletion that happened subsequent to the backup will simply replicate back to the domain controller.

When a known good copy of AD DS has been restored that contains objects that must override the existing state of objects in the AD DS database, anauthoritative restore is necessary.

Authoritative restore steps

1. In an authoritative restore, you restore the known good version of AD DS, just as you would in a nonauthoritative restore.
2. However, before restarting the domain controller, you mark the objects that you wish to retain as authoritative so that they will replicate from the restored domain controller to its replication partners. When you mark objects as authoritative, Windows increments the version number of all object attributes to be so high that the version is virtually guaranteed to be higher than the version number on all other domain controllers.
3. When the restored domain controller is restarted, it receives updates from its replication partners on all changes that have been made to the directory. It also notifies its partners that it has changes. The version numbers of the authoritatively restored objects ensure that partners take these changes and replicate them throughout the directory service.

Be sure to implement the Active Directory Recycle Bin. This will provide a simple alternative to restoring your server.