Active Directory backup and recovery: Recycle Bin, system state and authoritative restore

Skills you'll practise

• Plan system state backups of domain controllers and explain why their useful life is tied to the tombstone lifetime
• Enable the AD Recycle Bin, knowing the prerequisites and that it can't be turned off
• Restore deleted objects and a deleted OU tree from the Recycle Bin in the correct order
• Distinguish non-authoritative from authoritative restore and choose the right one
• Prepare for recovery: DSRM password, protection from accidental deletion, and test restores

Course outline

1. 1.Backing up domain controllersLesson · 15 min
2. 2.The AD Recycle BinLesson · 20 min
3. 3.Authoritative restore, DSRM and being readyLesson · 18 min
4. 4.Active Directory backup and recovery: Recycle Bin, system state and authoritative restore: knowledge checkKnowledge check · 14 questions
5. 5.The Sales OU disappearedScenario
6. 6.Final exam7 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• Microsoft Learn: AD forest recovery: backing up the system state data
• Microsoft Learn: Enable Active Directory Recycle Bin and restore deleted objects
• Microsoft Learn: Advanced AD DS management using Active Directory Administrative Center (Recycle Bin restore order)
• Microsoft Learn: Restore deleted user accounts and groups in AD (authoritative restore, DSRM, accidental-deletion protection)
• Microsoft Learn: Lingering objects in an AD DS forest
• Microsoft Learn: How to detect and recover from a USN rollback
• Microsoft Learn: Safely virtualizing Active Directory Domain Services (USN rollback and VM-GenerationID)