Your network contains an Active Directory Domain Services (AD DS) domain that has the Active Directory Recycle Bin enabled. The domain contains two domain controllers named DC1 and DC2. The system sta

This question tests knowledge of Active Directory authoritative restore procedures when user object attributes - not the objects themselves - are corrupted by an administrative error, and the AD Recycle Bin cannot help.

Implement disaster recovery

Question

Your network contains an Active Directory Domain Services (AD DS) domain that has the Active Directory Recycle Bin enabled. The domain contains two domain controllers named DC1 and DC2. The system state of the domain controllers is backed up daily at 23:00 by using Windows Server Backup. You have an organizational unit (OU) named ParisUsers that contains 1,000 users. At 08:00, DC1 shuts down for hardware maintenance. The maintenance completes, but DC1 remains shut down. At 09:00, an administrative error causes the manager attribute of each user in ParisUsers to be deleted. You need to recover the user account details as quickly as possible. The solution must minimize data loss. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Explanation

Approach. The AD Recycle Bin only recovers fully deleted objects; since the users still exist (only their manager attribute was cleared), the Recycle Bin cannot help here. The correct three-step sequence is: (1) Boot DC1 into Directory Services Restore Mode (DSRM) - it is already offline, making this the least disruptive target; (2) Restore the 23:00 system state backup on DC1 using Windows Server Backup, which rolls back to a point before the 09:00 error; (3) Use ntdsutil to perform an authoritative restore scoped specifically to the ParisUsers OU, then restart DC1 normally so it replicates the authoritatively marked (higher USN) objects to DC2, overwriting the corrupted attribute data. This approach minimizes data loss because only the affected OU is authoritatively restored, and DC1 being already shut down means no service interruption is needed to enter DSRM.

Concept tested. Active Directory authoritative restore using ntdsutil and Windows Server Backup system state, and understanding the distinction between when AD Recycle Bin applies (deleted objects) versus when a system state + authoritative restore is required (attribute-level corruption on live objects).

Reference. MS Docs: Perform an Authoritative Restore of Active Directory Domain Services - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/ad-forest-recovery-perform-authoritative-restore

Topics

#Active Directory Restore#Authoritative Restore#System State Backup#Directory Services Restore Mode (DSRM)

Community Discussion

No community discussion yet for this question.

Full AZ-801 Practice