It's not possible to do an authoritative restore without first doing a non-authoritative restore.
The process of an authoritative restore is simply marking a portion of the restored directory so that it's not overwritten by the backfill process. It does this by increasing the version of the objects that will be authoritatively restored. If you don't first run a non-authoritative restore, there is nothing to mark authoritative. And, from your description, it sounds like you are planning to authoritatively restore the entire directory, thus catching the one user that was deleted. Since you have to do an authoritative restore only after a non-authoritative restore, what you're suggesting will roll back the directory to the point of the last backup. If you want to backup your directory on a DC, and then bring it offline prior to deleting a single user account, that's fine. But if that user account is to be restored, you'll have to run a non-authoritative restore first. And if you select the entire directory of the offline DC to be authoritative, you'll not only be grabbing the account you want to restore, but you'll be rolling back the entire directory (and every change made in the directory) to the state of the last backup. This is why AD allows you to specify the OU or CN that you want to restore...so you don't un-do all of the other changes in the directory since the last backup. Only the ones that you genuinely want to un-do. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of [EMAIL PROTECTED] Sent: Monday, July 05, 2004 12:29 PM To: [EMAIL PROTECTED] Subject: [ActiveDir] Authoritative Restores I'd appreciate some comments on this technique as a cheap and cheerful disaster recovery plan for making minor changes to AD, e.g. deleting user accounts. Make sure one DC is fully synchronised and then shut it down. Delete a user account on another DC, deletion replicates everywhere. Oh no! That user account was used as the service account for 300 SQL servers worldwide. Bring the powered-down DC up in DS Restore mode. Do an authoritative restore of the AD database (*without* first doing a non-authoritative restore). Server reboots to normal mode, deleted user account that still exists here is now marked as authoratative and replicates back to the other DC's (Yes?) I've never before considered doing an authoritative restore without doing a non-authoritative one beforehand so just want to check my logic on this. Cheers, Simon ..jjryãv .+-Šwè†Ûiÿü0Á-Š÷+ƒùšŠYb²Øm˜¸¬´P†Ûiÿü0Á-Š÷+ƒùb²×Úf.+-j·!Š÷¡¶Úÿ 0™¨¥j·!Š÷œ¢oÚrØyØãIšŠVœ¶+Þv*è®
