Recover deleted Active Directory objects

Blackbird recovery offers three ways to restore deleted AD objects: the Recycle Bin in the Blackbird Management Suite console, the Recycle Bin in the Active Directory Users and Computers interface (ADUC), and through the Deleted Objects tab of the object properties in ADUC or right clicking on the object in ADUC.

Note that this Recycle Bin shouldn’t be confused with the new Recycle Bin feature in Windows Server 2008 R2. As you will see, Blackbird recovery’s functionality goes far beyond this new Windows feature.

If you want to recover deleted objects in a certain container, you can do this via the OU’s properties in ADUC. As mentioned in one of my earlier posts, the Blackbird Management Suite adds part of its functionality to Microsoft’s Active Directory tools.

If you accidentally deleted an OU, you can recover the container with all its child objects through the Recycle Bin. It is also possible to recover single or selected objects this way.

After you decide which objects to recover, you have to choose if you want to use the audit data or the backup of one of the scheduled backups (collectors). The audit data contains the exact state of the object it had right before it was deleted (CDP).

If you restore a single object from a scheduled backup, you can view the object’s attribute values first, before you rebuild the object. This is a useful feature if you are uncertain which of the backups you need.

Roll back Active Directory objects

You can also roll back an Active Directory object—that is, restore attribute values of a previous state. For this the object still has to exist in Active Directory. You can roll back AD objects in the Blackbird Management Suite console, either with Blackbird recovery or Blackbird auditor.

It is also possible to roll back objects in ADUC. The context menu of each object in ADUC offers a new Rollback function after you installed Blackbird RSAT extensions. Objects with child objects also have the “Rollback child objects” menu point.

Rollbacks through ADUC or the Blackbird recovery console only allow you to restore attribute values from scheduled backups. Very useful is here that you can compare the attribute values with the current state of the objects before you initiate the rollback.

If you want to roll back an object using audit data—that is, leverage Blackbird’s CDP feature—you have to use Blackbird auditor in the Blackbird Management Suite console. The main purpose of Blackbird auditor is to monitor changes of AD objects. (For more information please read the article about auditor express.)

However, Blackbird auditor has this really cool feature that allows you to not only view in detail how a certain object was changed (for example, by whom) but also roll back the object to the state before it was modified if you don’t like the modifications. And, best of all, you don’t have to restore the whole object but only the attributes you need.

Rollback and recovery of Group Policy Objects (GPOs)

Restoring Group Policy Objects (GPOs) works similar to restoring common Active Directory objects. The main difference is that no CDP is supported for GPO backups at an individual setting level. Instead GPOs can be restored from scheduled backups or automatic versions created by Blackbird. Blackbird recovery senses changes made to GPOs and will automatically create a version for a GPO that has been opened for editing if there have been no changes for 10 minutes. These automatic versions and version created during a scheduled backup are available when performing a restore or rollback.

Deleted GPOs can be restored from the Recycle Bin in the Blackbird Management Suite console. It can be difficult to find the correct GPO because the names don’t appear in the Recycle Bin. However, you can view the GPO settings from the backup if you are unsure which GPO to restore.

Rollbacks of GPOs can be launched from Microsoft’s Group Policy Management console. Before you roll back a GPO you can compare it with the current state in Active Directory (see screenshot). This feature is not only helpful for restores, but it can also be very useful if you just want to find out how a GPO was configured in the past.

Conclusion

I did not describe all features of Blackbird recovery in this series. For example, I didn’t cover Active Directory Schema and DNS data backups. However, the configuration of these features work similarly.

The tight integration of Blackbird recovery with Microsoft’s management tools is not only very convenient but also helps you to learn how to use Blackbird recovery quickly. After a while it feels as if Blackbird recovery is just a new Windows feature.

I think it became clear in my review that Blackbird recovery offers many features that common Windows backup solutions lack. Blackbird recovery is a highly specialized Active Directory backup solution that ensures that no precious directory data is lost and can be restored easily and quickly. The integration with the other tools of the Blackbird Management Suite completes the powerful Active Directory backup software.

To participate in the competition for a chance to win a Blackbird recovery license, worth $1,800 USD, please send an email to:

with the subject line:

Blackbird recovery.

You can also use this contact form.

The deadline of this contest is August 31, 2010.

• Raffle: Blackbird Auditor for Active Directory – Real-time Active Directory auditing (0)
• FREE: ManageEngine Free Active Directory Tools (0)
• Microsoft Exam 70-640 – Operations Masters – Sample question (3)
• Microsoft Exam 70-640 – The Global Catalog – Sample question (0)
• Microsoft Exam 70-640 – The Global Catalog (3)

I don’t know, if you were always able to follow me in my review about Backup Exec 11d and CPS. The interaction between these two tools is quite confusing, sometimes. It took me quite a while to figure out how everything works. The fact that one has to configure continuous backups of files in CPS and continuous backups of Exchange in Backup Exec is quite strange in my view.

Symantec tried to unite two different backup paradigms in one product using two separate tools. From my point of view, this unification is a complete failure. Continuous data protection and conventional backups don’t fit together.

I mentioned it already in a former post. It makes much more sense to use a CDP tool which also supports backups to tapes. Microsoft’s DPM v2, for example, is much easier to configure and to handle than Backup Exec 11d and CPS, because it doesn’t have all these functions needed for conventional backups.

Symantec obviously wants save its investments in Backup Exec. If you just need continuous data protection, you have to buy the whole product even though you don’t intend to run conventional backups, anymore. This makes Backup Exec more expensive than it has to be. In the long run this might be a big handicap.

We’ve been using Backup Exec since the time it was still owned by Seagate. As things stand now, it is quite probable that we’ll move to DPM v2 as soon as the final is out. It is really a pity!

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

Backup Exec is only able to backup up Exchange continuously if the CPS agent is installed on the Exchange server. However, you have to configure the corresponding backup job in Backup Exec, not in CPS, like with CDP backups of files.

You create a normal Backup Exec job to secure the Exchange server. The settings for Exchange backups have a new option which allows you to specify the intervals between recovery points. The minimum interval is 15 minutes. Therefore, Backup Exec 11d only supports near continuous data protection for Exchange backups while it can secure files continuously, i.e. whenever a file changes.

As backup destination, you have to use a backup-to-disk folder. This folder is managed by Backup Exec, not by the CPS. This is another difference when compared to file backups with CPS. This means that you have to setup a second backup job that secures the data of the backup-to-disk folder to the tape library.

Restores of Exchange data also have to be configured in Backup Exec. You can restore the complete Information Store or each mailbox individually. Backup Exec supports brick-level backups, i.e. you can restore single items like individual e-mails.

So, CDP backups of Exchange are managed with the user interface of Backup Exec. You create the backup jobs there, monitor them there and use it for restores. This is quite different to CDP backups of file servers with CPS.

In the next post of this series, you’ll read the conclusion of my review about Backup Exec 11d and CPS .

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• Exchange 2010 Administrative Audit Logging (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)

To copy the back-up data on the CPS to tape for long term archiving, you have to configure a back-up job with Backup Exec. If there is a CPS agent and a Backup Exec agent installed on the server, then Backup Exec will allow you to select all Protected Sources on this CPS system with just a mouse click.

You can setup a so-called SmartLink connection between a CPS job and the Backup Exec job by copying the data to tape. SmartLink is just a simple command that will run before a Backup Exec job starts. This allows Backup Exec to check the status of the CPS job.

The CPS manual talks about monitoring CPS jobs, but all it really does is, add some information of the CPS job to the log file of the Backup Exec job. This way, the Backup Exec administrator gets informed whenever problems occur during the CPS backup.

Backup operators can restore data from tape that was originally secured by CPS, directly to the original backup source. In Backup Exec, you can’t even see that these files were secured by CPS, i.e. it seems as if Backup Exec secured this data from the original server.

In the next post of this series, I will explain, how you can continuously secure an Exchange Server with Backup Exec 11d and CPS.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

You can only buy CPS together with Backup Exec 11d, but CPS is an independent CDP tool that also works without Backup Exec. This means, you have to install both tools separately and deploy two different agents.

The Push Install CPS Components Wizard allows you deploy the CPS agent together with the Backup Exec agent for Windows servers. You can also use it to install the CPS Administration Console. This way you can manage CPS from every server where you installed its agent.

CPS uses Windows folders as backup destinations. So you don’t have to reserve a complete volume like in Microsoft’s DPM. However, you can only create one backup destination on a logical drive. It is interesting to note, however, that CPS doesn’t reserve space for a backup destination. Thus, you always have to keep an eye on the space available. Backup destinations can be accessed on all CPS systems in your network, i.e. you can configure a backup job on one server and use the backup destination of another CPS.

It is possible to use the same backup destination for multiple backup jobs. Backup jobs run according to a schedule, like in conventional backup tools, or continuously. The latter option is its default setting. The filter driver of the CPS agent captures the changed bytes whenever an application saves a file to disk. Only these changes will be copied to the backup destination after the first full backup.

Sysops restore data using the CPS Administration console. Users can restore their files with the so-called Backup Exec Retrieve web interface. Backup Exec Retrieve is optimized for Internet Explorer 6, but the manual says that other Web browsers work, too. I wonder if you get support if you use another browser.

Since CPS secures files continuously, you can always restore the latest version of a file. It is possible to restore older versions, however, you can’t restore a file to a state on an arbitrary point in time. More sophisticated CDP tools have this feature. CPS creates snapshots of the back-up data according to its configured schedule. The shortest interval between snapshots is an hour. Hence, you have the latest version of a certain file plus the versions of the hourly snapshots.

In the next post of this series I will explain how Symantec Backup 11d interacts with CPS.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

With “conventional backup tool”, I mean, software that scans disks searching for files with a changed archive bit. Depending on the backup method, i.e. normal, differential or incremental, it will reset the archive bit after the files have been secured.

In a CDP system, you can forget about the archive bit, you don’t have to worry about different backup methods and backup strategies like the famous grandfather-father-son strategy being replaced by new concepts.

When I first read about CDP systems, I was already convinced that this technology will sooner or later replace conventional backup systems. The fact that you always have an up-to-date copy of your data is already a killer feature. Moreover, you don’t have to worry anymore about backup windows or overloaded servers during the backup process. Another advantage is that setting up a backup system is much easier.

There is no alternative to tape-based backups when it comes to long term archiving. This is where the good old Backup Exec comes in. The question is, whether you need such a complex tool like Backup Exec to copy the data of your CDP system to tapes. Maybe it makes more sense to integrate tape support in a CDP tool like Microsoft’s DPM v2 .

I’ll test the Continuous Protection Sever of Backup Exec 11d these days and report about it here. I am seriously considering giving up Backup Exec and moving to Microsoft’s Backup solution. So I am quite curious to know if Symantec’s CDP solution is still better than Microsoft’s DPM.

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)
• DPM 2012 – Part 3: Other improvements (2)

• Kiwi CatTools – Back up and manage network configs (0)
• Raffle: Altaro Hyper-V Backup – Easily back up Hyper-V virtual machines (0)
• Exchange 2010 Administrative Audit Logging (0)
• FREE: Altaro Hyper-V Backup (0)
• DPM 2012 – Part 4: Certificate based authentication (0)

The answer is yes, it works exactly the same. Backup and restore run through without any error messages. The restored virtual Windows server booted up without any complaints. However, when I logged on, I got the same message as under Virtual Server 2005 R2, i.e. that the system was shutdown unexpectedly.

This was no surprise. The question now is, if this is a recommendable way to back up virtual machines. In general, I would say no. However, there might be situations where this makes sense.

I discussed it already some days ago; the problem with this kind of backup is that you don’t get a consistent copy of the virtual machine. More or less, it is the same as if you just pulled the power plug on your server without shutting it down properly before.

In former times, this was the worst cardinal sin a Windows system administrator could ever commit. But Windows Server 2003 is much more robust than Windows NT. So, in most cases your Windows server will grant absolution if you repent sincerely. This is also true for many Windows server applications nowadays.

Therefore, backing up virtual machine files on a host system using the open file feature of your backup software might be an option. I used Backup Exec, but it probably works with any other professional backup solution as well. All you have to do is to check if all applications on the Windows server are robust enough to survive a hard reset of your server.

To be sure, I highly recommend making a second backup of your virtual servers using the conventional method, i.e. with a backup agent running on the guest system. This way, disaster recovery of all your virtual machines will be very fast using the backup you made of the virtual machine files. Then, if necessary, you can use the conventional backup of the guest system to restore the problematic virtual servers properly.

• FREE: Veeam ONE Free Edition – Real-time Hyper-V and VMware monitoring (0)
• FREE: vWorkspace Desktop Optimizer – Optimize VDI performance (0)
• SCVMM 2012 review – Part 5: Integrating with VMware and Citrix XenServer, Cluster patching (0)
• VMware Backups – Troubleshoot the Consolidate Helper-0 backup error (2)
• Installing a driver in an existing VMware vSphere 4.1 ESX/ESXi host (3)