Home > Articles > Microsoft > MCTS

  • Print
  • + Share This
This chapter is from the book

Performing an Authoritative Restore

When you do a normal nonauthoritative restore in a domain with more than one DC, the restored DC will replicate with other DCs in the domain to update itself. The restored DC will quickly have all the changes that occurred since the last backup. However, there are times when you want to restore objects authoritatively. In other words, when the restored DC comes back up, you want objects restored on the DC to be replicated to other DCs. You want this DC to communicate to all the other DCs that its change is the authoritative change.

For example, if an administrator accidentally deletes a user object and you perform a nonauthoritative restore, the user object will be deleted again as soon as the DC replicates with other DCs. However, you can restore the user object authoritatively, and you can even restore entire OUs authoritatively.

You can use the commands in the following table to authoritatively restore AD objects from the authoritative restore prompt in ntdsutil.

Restore Command


Restore OU.

restore subtree dn

authoritative restore:

restore subtree

You can use this to restore an OU (including child OUs).

The example command restores the Sales OU.

Restore Object.

restore object dn

authoritative restore:

restore object "cn=Sally,

This enables you to restore an individual object.

The example command restores the Sally user object in the sales OU.

The following table shows the overall steps to perform an authoritative restore.




Reboot the DC and press F8 to access Advanced Boot Options.


Select Directory Services Restore Mode. When prompted, log on with the user name of .\administrator and the DSRM password.


Restore AD nonauthoritatively from a backup. You can use the command-line backup tool, wbadmin, or any other method your organization has available. Do not reboot after the restore is complete.


Launch a command prompt, type ntdsutil, and then press Enter.


Type activate instance ntds and press Enter.


Type authoritative restore and press Enter.


At this point, determine whether you're restoring an OU or an object. The previous table showed the syntax to restore either an OU or an object. Type the restore command and press Enter.

For example, to restore a user object, use the following format:

  • restore object dn
  • restore object "cn=Sally,ou=sales,dc=pearson,dc=pub"

Or, to restore an OU, use the following format:

  • restore subtree dn
  • restore subtree "ou=sales,dc=pearson,dc=pub"


Type quit and press Enter twice to exit ntdsutil.


Restart the DC normally.

  • + Share This
  • 🔖 Save To Your Account