Ok, so let's say, you accidentally deleted a group. Or, thought it wasn't needed and turns out that it was. People can no longer access files, and you can't remember exactly which files the group was assigned access to. The good news is that you can recover from this.
Option 1 - Restore AD objects from backup
If you have a system state backup of a DC (and you should!!), you can restore the deleted object from backup. Then you mark it as authoritative. However, to have group memberships restored correctly, you need to perform an ugly process where objects are restored twice to make sure the links are correct. Also the DC needs to be down during this mess. Doable, but not the preferred option.
Detailed info: http://support.microsoft.com/kb/840001
Option 2 - Reanimiate the deleted object
Yes, just like a zombie, you can bring back an object from the dead. And also like a zombie, it is a shadow of its former self. Only some properties are kept in the deleted object. When you reanimate it, many properties are lost. However, it does keep the SID. So, a reanimated objects retains file permissions that were assigned to it.
In the case of a reanimated user, the group membership is lost. I expect that you would also need to recreate the membership of a reanimated group, but I haven't tried it out recently.
Detailed info: http://www.microsoft.com/technet/technetmag/issues/2007/09/Tombstones/default.aspx
Simplified reanimation with ADRestore: http://www.microsoft.com/technet/sysinternals/utilities/AdRestore.mspx
No comments:
Post a Comment