SYStem State win2003

[Darren D]

P.S - I perform daily sytem state backups

On one of my DC's I have a copy of CA running. Then let assume my CA
databse become corrupted and I need to restore the database . I read that I
should perform a non-auth restore on this DC.. but I am a bit confuse I
thought that my corruped CA database will be replicated to other domain
controllers assuming replication has taken place.. ...So if I perform a
non-auth restore then my restore will be overwitten by a corruped CA copy
from the other DC .. Is this correct?
The only reason I can think why I would perform a non-auth restore is that
the CA database is not being replicated ONLY the A/D database.. Is this
corect.. ??

The system state contains , boot file systems file etc and a copy of A/D
database, is it correct to say that ONLY component that gets replicated
among DC controllers is the A/D database..

Thanks
Darren

 

[Laura A. Robinson [MVP]]

circa Sat, 4 Sep 2004 15:23:25 -0400, in
microsoft.public.win2000.active_directory, Darren D
([email protected]) said,

P.S - I perform daily sytem state backups

On one of my DC's I have a copy of CA running.

CA what? (Sorry, I'm slow today)

Laura

 

[Darren D]

Certificate authority server..

circa Sat, 4 Sep 2004 15:23:25 -0400, in
microsoft.public.win2000.active_directory, Darren D
([email protected]) said,

CA what? (Sorry, I'm slow today)

Laura

 

[Enkidu]

P.S - I perform daily sytem state backups

On one of my DC's I have a copy of CA running. Then let assume my CA
databse become corrupted and I need to restore the database . I read that I
should perform a non-auth restore on this DC.. but I am a bit confuse I
thought that my corruped CA database will be replicated to other domain
controllers assuming replication has taken place.. ...So if I perform a
non-auth restore then my restore will be overwitten by a corruped CA copy
from the other DC .. Is this correct?
The only reason I can think why I would perform a non-auth restore is that
the CA database is not being replicated ONLY the A/D database.. Is this
corect.. ??

The system state contains , boot file systems file etc and a copy of A/D
database, is it correct to say that ONLY component that gets replicated
among DC controllers is the A/D database..

Assuming that you really did want to roll the AD back to the last
backup, you need to:
a) Take the server offline
b) go into AD Restore Mode.
c) Perform a *NON* authoratitve restore. Don't reboot.
d) Mark those bits of AD that you want to keep authoratative (in your
case all),
e) Reboot and connect to the network.

Then the restored AD stuff will replicate to the other DCs.

BUT.... you don't want to do that. You want to do this:

http://support.microsoft.com/default.aspx?scid=kb;en-us;313272&sd=tech

From memory, CA services are backed up with system state. That
includes all the AD stuff, so if you restore System state, you do NOT
want to do an authoratative restore, I think.

Cheers,

Cliff