Recovering a domain controller (other DCs are available)

When one of the several domain controllers (DCs) is lost, the Active Directory service is still available. Therefore, other domain controllers will contain data that is newer than the data in the backup.

In these cases, a type of recovery known as nonauthoritative restore is usually performed. Nonauthoritative restore means that the recovery will not affect the current state of Active Directory.

Steps to perform

If the domain has other domain controllers, you can perform nonauthoritative restore of a lost domain controller in either of these ways:

• Recover a domain controller from a backup by using a bootable media. Ensure that there is no USN rollback problem.
• Recreate a domain controller by installing the operating system and making the machine a new domain controller (by using the dcpromo.exe tool).

Both operations are followed by automatic replication. Replication makes the domain controller database up-to-date. Just make sure the Active Directory service has started successfully. Once replication completes, the domain controller will be up and running again.

Recovery vs. re-creation

Recreation does not require having a backup. Recovery is normally faster than re-creation. However, recovery is not possible in the following cases:

• All available backups are older than the tombstone lifetime. Tombstones are used during replication to ensure that an object deleted on one domain controller becomes deleted on other domain controllers. Thus, proper replication is not possible after the tombstones have been deleted.
• The domain controller held a Flexible Single Master Operations (FSMO) role, and you have assigned that role to a different domain controller (seized the role). In this case, restoring the domain controller would lead to two domain controllers holding the same FSMO role within the domain and cause a conflict.

Recovering a domain controller that holds a FSMO role

Some domain controllers hold unique roles known as Flexible Single Master Operations (FSMO) roles or operations manager roles. For the description of FSMO roles and their scopes (domain-wide or forest-wide), see Microsoft Help and Support article http://support.microsoft.com/kb/324801.

Before recreating a domain controller that held the PDC Emulator role, you must seize that role. Otherwise, you will not be able to add the recreated domain controller to the domain. After recreating the domain controller, you can transfer this role back. For information about how to seize and transfer FSMO roles, see Microsoft Help and Support article http://support.microsoft.com/kb/255504.

To view which FSMO roles are assigned to which domain controller, you can connect to any live domain controller by using the Ntdsutil tool as described in Microsoft Help and Support article http://support.microsoft.com/kb/234790. Follow the steps in the “Using the NTDSUTIL Tool” section of that article:

• For the Windows 2000 Server and Windows Server 2003 operating systems, follow all steps as they are given.
• For the Windows Server 2008 operating systems, in the step asking you to type domain management, type roles instead. Follow other steps as they are given.