Active Directory Backup Components:
├── System State
│   ├── Registry
│   ├── COM+ Registration
│   ├── Boot Files
│   └── Certificate Services (if installed)
├── Active Directory Database
│   ├── NTDS.dit
│   ├── EDB.log (current transaction log)
│   ├── EDB*.log (transaction logs)
│   └── EDB.chk (checkpoint file)
└── SYSVOL
    ├── Policies (GPOs)
    ├── Scripts (Logon/Startup scripts)
    └── Staging Areas

# Basic System State backup
ntbackup backup systemstate /j "AD Backup %date%" /f "D:\Backups\SystemState.bkf"

# Scheduled backup with verification
ntbackup backup systemstate /j "AD Daily Backup" /f "\\BackupServer\AD\%computername%_%date:~-4,4%%date:~-10,2%%date:~-7,2%.bkf" /v:yes

@echo off
:: AD_Backup.bat - Automated Active Directory Backup
set BackupPath=\\BackupServer\DomainControllers\%COMPUTERNAME%
set LogPath=C:\ADBackupLogs
set Date=%date:~-4,4%%date:~-10,2%%date:~-7,2%

:: Create directories if they don't exist
if not exist "%BackupPath%" mkdir "%BackupPath%"
if not exist "%LogPath%" mkdir "%LogPath%"

:: Perform System State backup
echo Starting AD backup at %time% > "%LogPath%\backup_%Date%.log"
ntbackup backup systemstate /j "AD_Backup_%Date%" /f "%BackupPath%\SystemState_%Date%.bkf" /l:f /v:yes >> "%LogPath%\backup_%Date%.log" 2>&1

:: Verify backup
if %errorlevel% equ 0 (
    echo Backup completed successfully at %time% >> "%LogPath%\backup_%Date%.log"
) else (
    echo ERROR: Backup failed with error code %errorlevel% >> "%LogPath%\backup_%Date%.log"
    :: Send alert email
    blat -to admin@company.com -subject "AD Backup Failed on %COMPUTERNAME%" -body "Check log: %LogPath%\backup_%Date%.log"
)

:: Cleanup old backups (keep 30 days)
forfiles /p "%BackupPath%" /m *.bkf /d -30 /c "cmd /c del @path"

:: Stop AD services for consistent backup
net stop ntds /y

:: Copy AD database files
xcopy C:\Windows\NTDS\*.* D:\ManualBackup\NTDS\ /E /C /H /Y

:: Copy SYSVOL
xcopy C:\Windows\SYSVOL\*.* D:\ManualBackup\SYSVOL\ /E /C /H /Y

:: Restart AD services
net start ntds

:: Configure shadow copies
vssadmin add shadowstorage /for=C: /on=D: /maxsize=10GB

:: Create manual shadow copy
vssadmin create shadow /for=C:

:: List shadow copies
vssadmin list shadows

# VSS_AD_Backup.ps1
$Date = Get-Date -Format "yyyy-MM-dd"
$BackupPath = "\\BackupServer\VSS\$env:COMPUTERNAME\$Date"

# Create VSS snapshot
$shadow = (vssadmin create shadow /for=C:) | Select-String -Pattern "Shadow Copy ID: ({.*})" | ForEach-Object { $_.Matches[0].Groups[1].Value }

# Get shadow copy path
$shadowPath = (vssadmin list shadows /shadow=$shadow) | Select-String -Pattern "Shadow Copy Volume: (.*)" | ForEach-Object { $_.Matches[0].Groups[1].Value }

# Copy AD files from shadow copy
New-Item -ItemType Directory -Path $BackupPath -Force
robocopy "$shadowPath\Windows\NTDS" "$BackupPath\NTDS" /E /COPYALL
robocopy "$shadowPath\Windows\SYSVOL" "$BackupPath\SYSVOL" /E /COPYALL

# Delete shadow copy
vssadmin delete shadows /shadow=$shadow /quiet

:: 1. Boot into Directory Services Restore Mode (DSRM)
:: Press F8 during startup, select "Directory Services Restore Mode"

:: 2. Log in with DSRM password

:: 3. Restore System State
ntbackup restore /f "D:\Backups\SystemState.bkf" /j "AD Restore" /l:f

:: 4. Mark restoration as non-authoritative (default)
:: Simply reboot normally after restore

:: 1. Perform non-authoritative restore first (steps above)

:: 2. Before rebooting, run NTDSUTIL
ntdsutil
activate instance ntds
authoritative restore

:: 3. Restore entire domain
restore database

:: 4. Or restore specific OU
restore subtree "OU=Sales,DC=company,DC=local"

:: 5. Or restore specific object
restore object "CN=John Doe,OU=Users,DC=company,DC=local"

quit
quit

:: 6. Reboot normally

@echo off
:: AuthRestore.bat - Automated Authoritative Restore
echo Authoritative Restore Script
echo ==========================
echo.
echo WARNING: This will make this DC authoritative for the restored objects!
echo.
set /p continue="Continue? (Y/N): "
if /i not "%continue%"=="Y" exit

:: Create NTDSUTIL script
echo activate instance ntds > authrestore.txt
echo authoritative restore >> authrestore.txt
echo restore subtree "%1" >> authrestore.txt
echo quit >> authrestore.txt
echo quit >> authrestore.txt

:: Execute restore
ntdsutil < authrestore.txt

:: Cleanup
del authrestore.txt

echo.
echo Authoritative restore complete. Reboot now.
pause

:: 1. Boot first DC into DSRM

:: 2. Restore System State
ntbackup restore /f "D:\Backups\SystemState.bkf" /j "Primary Restore" /l:f

:: 3. Configure as primary
ntdsutil
activate instance ntds
authoritative restore
restore database (primary)
quit
quit

:: 4. Verify SYSVOL is shared
net share

:: 5. Force SYSVOL replication
net stop ntfrs
net start ntfrs

:: 1. Connect to DC with LDP
ldp.exe

:: 2. Connection → Connect → Enter DC name
:: 3. Connection → Bind → Enter credentials

:: 4. View → Tree → Enter: CN=Deleted Objects,DC=company,DC=local

:: 5. To reanimate:
:: - Right-click deleted object
:: - Modify
:: - Add isDeleted attribute, set to FALSE
:: - Add distinguishedName with original location

# Requires AD PowerShell module (not native to 2003)
# Connect to deleted objects container
$deletedObjectsDN = "CN=Deleted Objects,DC=company,DC=local"

# Search for deleted objects
$searcher = New-Object System.DirectoryServices.DirectorySearcher
$searcher.SearchRoot = "LDAP://$deletedObjectsDN"
$searcher.Filter = "(isDeleted=TRUE)"
$searcher.Tombstone = $true

$results = $searcher.FindAll()
foreach ($result in $results) {
    Write-Host "Deleted object: $($result.Properties['cn'])"
}

:: Verify backup file
ntbackup /? > nul 2>&1
ntbackup backup /?

:: Check backup catalog
ntbackup restore /f "D:\Backups\SystemState.bkf" /j "Verify Only" /l:f /preview

# TestRestore.ps1 - Automated restore testing
$TestVM = "DC-TEST-01"
$BackupFile = "\\BackupServer\DomainControllers\DC01\SystemState_20240115.bkf"

# Create test VM
New-VM -Name $TestVM -MemoryStartupBytes 2GB -VHDPath "C:\VMs\$TestVM.vhdx"

# Restore to test VM
Write-Host "Restoring to test environment..."
# Copy backup to test VM
# Perform test restore
# Verify AD functionality

Recovery Metrics Log:
├── Backup Duration: 45 minutes
├── Restore Duration: 60 minutes
├── Verification Time: 30 minutes
├── Total RTO: 2.25 hours
└── Last Tested: [Date]

Recommended Schedule:
├── System State: Daily at 2 AM
├── Full Server: Weekly on Sunday
├── SYSVOL Only: Every 4 hours
└── Transaction Logs: Continuous (if possible)

# AD Backup Documentation

## Environment Details
- Forest Name: company.local
- Domain Controllers:
  - DC01: 192.168.1.10 (Physical, Primary)
  - DC02: 192.168.1.11 (Virtual, Secondary)
- FSMO Roles:
  - Schema Master: DC01
  - Domain Naming: DC01
  - PDC Emulator: DC01
  - RID Master: DC01
  - Infrastructure: DC02

## Backup Locations
- Primary: \\BackupServer\AD\
- Secondary: D:\LocalBackups\
- Offsite: Cloud storage (encrypted)

## Recovery Passwords
- DSRM Password: [Stored in password manager]
- Backup Encryption: [Stored in password manager]

:: CheckADBackup.bat - Monitor backup status
@echo off
set LastBackup=\\BackupServer\AD\DC01\SystemState_*.bkf
set MaxAge=2

:: Check if backup exists and is recent
forfiles /p "\\BackupServer\AD\DC01" /m SystemState_*.bkf /d -%MaxAge% >nul 2>&1
if errorlevel 1 (
    echo CRITICAL: No recent AD backup found!
    blat -to admin@company.com -subject "AD Backup Missing" -body "No backup found in %MaxAge% days"
)

:: Check AD database integrity
ntdsutil
activate instance ntds
files
integrity
quit
quit

:: If corruption found
esentutl /g "C:\Windows\NTDS\ntds.dit" /!10240 /8 /v