Your network contains an Active Directory Domain Services (AD DS) domain that has the Active Directory Recycle Bin enabled. All domain controllers are backed up daily. You accidentally remove all…

This question tests knowledge of how to recover historical Active Directory group membership data using a mounted backup database (dsamain), given that the AD Recycle Bin preserves deleted objects but not attribute-level changes like group membership modifications.

Implement disaster recovery

Question

Your network contains an Active Directory Domain Services (AD DS) domain that has the Active Directory Recycle Bin enabled. All domain controllers are backed up daily. You accidentally remove all the users from a domain group. You need to get a list of the users that were previously in the group. Which four actions should you perform in sequence from a domain controller? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Explanation

Approach. Because the users were removed from a group (not deleted), the Active Directory Recycle Bin is not useful here - it only recovers deleted objects, not attribute modifications. The correct approach leverages the daily backup: (1) Restore the system state backup to an alternate location on the domain controller, (2) Mount the backed-up NTDS.dit database using 'dsamain /dbpath <path> /ldapport <port>' to expose it as a read-only LDAP server on a non-standard port, (3) Open Active Directory Users and Computers (ADUC) and connect it to the alternate LDAP port (the mounted snapshot), then (4) Navigate to and inspect the group's membership list in that snapshot to retrieve the historical list of members - without performing a full authoritative or non-authoritative restore.

Concept tested. Using the Active Directory Database Mounting Tool (dsamain.exe) to non-destructively mount a backup copy of the AD database and query historical object attributes - specifically group membership - without performing a full domain restore. This distinguishes between Recycle Bin (for deleted objects) and backup-based inspection (for attribute history like group members).

Reference. MS Docs: Active Directory Database Mounting Tool (dsamain.exe) - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd364988(v=ws.10)

Topics

#Active Directory Recycle Bin#AD DS Object Recovery#Group Management#Attribute Restoration

Community Discussion

No community discussion yet for this question.

Full AZ-801 Practice