Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to have several applications using AD LDS for centralized configuration information. I would like to know if there is a way to back up indepdendant sections of directory entries, such as "per Organizational Unit"?

My use case is this: a directory entry is modified in OU "Sales". An hour later another entry is modiifed in OU "Marketing". Then an IT resource now notices that a bug has been introduced because of the OU "Sales" change. He wants to revert the directory config for OU "Sales" to the way it was two hours ago (before the two changes went in). The change in OU "Marketing" should remain.

What tool or technique would enable this selective revert story?

share|improve this question
Shane's got a good solution for you below, but, IMO you've got a process problem not a technical problem. – Brian Desmond Jul 23 '11 at 17:28
up vote 2 down vote accepted

Well, I can't say that the restore/revert process is as easy as you're looking for, but for this same basic use case I ended up wrapping some scripting around the ntdsutil snapshot command, compressing (make sure you compress, they compress very well) and archiving the snapshots on one of the domain controllers (I'd suggest version control, but with the binary databases, there's not a lot of benefit).

When something blows up, just pull the ntds.dit out of the compressed file, fire up a listener with dsamain, and you can get at the old version of things.

Now, this is as far as I took it as far as automation - the issues I've used it for are more like, "oops, we told you we fired this person, it was really that other person", not, "oops, someone ran a script that deleted all the group memberships from everyone in that OU" - but, for mass changes you could definitely put something together that would read from the dsamain listener and spit out what was different from the 389 listener, and for small changes I'm a huge fan of just being able to compare old to current and fix what needs to be fixed directly.

share|improve this answer
I suppose you could export the relevant parts of the snapshot to an LDIF file and check those in to version control. – Brian Desmond Jul 23 '11 at 17:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.