Backup and Disaster Recovery for AD

Active Directory is a multi-master replicated database, so a single domain controller failure rarely causes data loss, but logical corruption — an accidental bulk deletion, a bad schema extension, or a compromised admin account — replicates to every other DC within the normal replication interval. Because of this, AD disaster recovery planning focuses less on hardware redundancy and more on point-in-time system state backups that can restore the directory to a state before the corruption occurred.

A valid AD backup must capture the system state, which includes the NTDS.dit database, the SYSVOL folder, the registry, and boot files, and can be taken with Windows Server Backup (wbadmin) or third-party tools that support VSS writers for AD. Microsoft's guidance is that system state backups must be no older than the tombstone lifetime (60 days by default in modern forests, historically 180 days) because a DC that has not replicated or been backed up within that window risks lingering objects and cannot be safely restored.

A non-authoritative restore returns a single DC to a previous state and then lets normal replication bring it back up to date with its replication partners, which is the correct approach when only that DC is broken. An authoritative restore, performed with ntdsutil's 'authoritative restore' command after a non-authoritative restore, marks specific objects or the whole database with a higher version number so that restored data overwrites the (bad) data on every other DC instead of being overwritten by it — this is what you use to undo an accidental mass deletion that has already replicated.

For everyday accidental deletions, the AD Recycle Bin (enabled once forest functional level is 2008 R2 or higher, via Enable-ADOptionalFeature) is far faster than a full authoritative restore because deleted objects retain most of their attributes and can be recovered with Restore-ADObject in seconds rather than requiring DSRM downtime. However, the Recycle Bin does not replace backups: it cannot recover from database corruption, a compromised forest, or objects deleted before the feature was enabled, so a documented, periodically-tested forest recovery plan following Microsoft's tiered DC restoration order remains mandatory.