Active Directory backup and recovery

You’ll work on DC01 and DC02 as SAATLAB\adm.rahul in PowerShell as administrator, and on your laptop for VirtualBox commands.

1Add a backup disk to DC01

Shut down DC01. On your laptop:

VBoxManage storagectl DC01 --name SATA --portcount 4
VBoxManage createmedium disk --filename C:\Lab\VMs\DC01\DC01-backup.vdi --size 20480
VBoxManage storageattach DC01 --storagectl SATA --port 2 --device 0 --type hdd --medium C:\Lab\VMs\DC01\DC01-backup.vdi
VBoxManage startvm DC01

On DC01, bring it online as E: and install Windows Server Backup:

Get-Disk | Where-Object PartitionStyle -eq 'RAW' | Initialize-Disk -PartitionStyle GPT -PassThru |
    New-Partition -DriveLetter E -UseMaximumSize | Format-Volume -FileSystem NTFS -NewFileSystemLabel Backup -Confirm:$false | Out-Null
Install-WindowsFeature Windows-Server-Backup | Select-Object Success, ExitCode

You should see something like this:

Success ExitCode
------- --------
True    Success

✅ Checkpoint: DC01 has an E: drive labelled Backup and Windows Server Backup installed.

2Create test data and back up the system state

On DC01, create an OU with users, then back up:

New-ADOrganizationalUnit -Name Projects -Path 'OU=SAATLAB,DC=saatlab,DC=internal' -ProtectedFromAccidentalDeletion $false
1..3 | ForEach-Object { New-ADUser -Name "Project User $_" -SamAccountName "proj.user$_" -Path 'OU=Projects,OU=SAATLAB,DC=saatlab,DC=internal' }
repadmin /syncall DC01 /AdeP | Select-Object -Last 1
wbadmin start systemstatebackup -backupTarget:E: -quiet

You should see something like this (it takes 10 to 20 minutes):

SyncAll terminated with no errors.
wbadmin 1.0 - Backup command-line tool
(C) Copyright Microsoft Corporation. All rights reserved.

Starting System State Backup [19/10/2026 23:05]
Retrieving volume information...
This will back up the system state from volume(s) Local Disk(C:) to E:.
Starting System State Backup [19/10/2026 23:05]
...
The backup operation successfully completed.

List the backup and note its version identifier:

wbadmin get versions

You should see something like this:

Backup time: 19/10/2026 23:18
Backup target: Fixed Disk labeled Backup(E:)
Version identifier: 10/19/2026-17:48
Can recover: Volume(s), File(s), Application(s), System State
Snapshot ID: {6b0d...}

The version identifier uses UTC time in month/day/year format. Copy it exactly; you’ll need it in step 4.

✅ Checkpoint: wbadmin get versions lists a system state backup on E: with its version identifier.

3Delete the OU, as if by mistake

On DC01:

Remove-ADOrganizationalUnit 'OU=Projects,OU=SAATLAB,DC=saatlab,DC=internal' -Recursive -Confirm:$false
repadmin /syncall DC01 /AdeP | Select-Object -Last 1
Get-ADOrganizationalUnit -Filter "Name -eq 'Projects'" -Server DC02

The last command returns nothing: the deletion has reached DC02. In this lab the Recycle Bin from Lesson 12 could bring it back, and in real life you’d try that first. Here you’ll practise the authoritative restore you’d need if the Recycle Bin were off or the objects too old.

✅ Checkpoint: The Projects OU is gone from both DCs.

4Restore authoritatively in DSRM

On DC01, set the next boot to DSRM and restart:

bcdedit /set safeboot dsrepair
Restart-Computer

At the sign-in screen choose Other user and sign in as .\Administrator with the DSRM password, not your domain password. AD isn’t running, so domain accounts can’t sign in.

In DSRM, restore the system state (use your version identifier):

wbadmin start systemstaterecovery -version:10/19/2026-17:48 -quiet

When it finishes, don’t restart yet. Mark the OU as authoritative first:

Still in DSRM:

ntdsutil "activate instance ntds" "authoritative restore" "restore subtree \"OU=Projects,OU=SAATLAB,DC=saatlab,DC=internal\"" q q

Answer Yes to the confirmation box. You should see something like this:

Opening DIT database... Done.
The current time is 10-19-26 23:41.21.
Most recent database update occurred at 10-19-26 23:18.04.
Increasing attribute version numbers by 100000.
Counting records that need updating...
Records found: 0000000004
Done.
Found 4 records to update.
Updating records...
Records remaining: 0000000000
Done.
Successfully updated 4 records.
The following text file with a list of authoritatively restored objects has been created in the current working directory:
        ar_20261019-234121_objects.txt
One or more specified objects have back-links in this domain. The following LDIF files with link restore operations have been created in the current working directory:
        ar_20261019-234121_links_saatlab.internal.ldf
Authoritative Restore completed successfully.

Leave DSRM and restart normally:

bcdedit /deletevalue safeboot
Restart-Computer

Back in normal mode, on DC01:

repadmin /syncall DC01 /AdeP | Select-Object -Last 1
Get-ADUser -Filter * -SearchBase 'OU=Projects,OU=SAATLAB,DC=saatlab,DC=internal' -Server DC02 | Select-Object -ExpandProperty Name

You should see something like this:

SyncAll terminated with no errors.
Project User 1
Project User 2
Project User 3

Four records: the OU and three users. Because their version numbers jumped by 100,000, DC02 accepted them as newer than its deletion. If the users had been in groups, you’d import the LDF file with ldifde -i -f ar_..._links_saatlab.internal.ldf to restore the memberships.

✅ Checkpoint: The Projects OU and its three users are back on DC01 and DC02.

5Simulate a dead DC: seize FSMO roles and clean up

Shut down both DCs and take a safety snapshot on your laptop:

'DC01','DC02' | ForEach-Object { VBoxManage snapshot $_ take "Before seize" }
VBoxManage startvm DC02

Leave DC01 off (it has “died”). On DC02, as SAATLAB\adm.rahul:

netdom query fsmo
Move-ADDirectoryServerOperationMasterRole -Identity DC02 -OperationMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster -Force
netdom query fsmo

You should see something like this (the first query may take a while, because DC01 is unreachable):

Schema master               DC02.saatlab.internal
Domain naming master        DC02.saatlab.internal
PDC                         DC02.saatlab.internal
RID pool manager            DC02.saatlab.internal
Infrastructure master       DC02.saatlab.internal
The command completed successfully.

With DC01 unreachable, PowerShell tried a transfer, failed, and seized each role because of -Force. Now remove DC01 from AD: in Active Directory Users and Computers on DC02, open Domain Controllers, delete DC01, tick This Domain Controller is permanently offline, and confirm. That runs metadata cleanup for you.

Finally, delete DC01’s leftover records in DNS Manager.

Then roll both DCs back so the rest of the course has two healthy DCs:

VBoxManage controlvm DC02 poweroff
'DC01','DC02' | ForEach-Object { VBoxManage snapshot $_ restore "Before seize" }

Restoring both DCs to the same snapshot is safe. Restoring only one DC from an old snapshot causes USN rollback, a serious replication problem, so never do that with a real DC.

✅ Checkpoint: DC02 held all five roles after the seize, DC01 was removed as a DC, and both VMs are back at “Before seize”.