We've been using Win2008R2's AD Snapshot feature to perform a nightly backup of our AD domain. I'm trying to figure out the steps that I need to run through to use one of these nightly backups to restore our AD domain on a 2nd server.

These are the commands we used to backup the AD DOM:

1. create a new snapshot

echo **** create a new snapshot **** >> %LOG% 2>>&1
ntdsutil snapshot "activate instance ntds" create quit quit >> %LOG% 2>>&1

2. mount the snapshot

echo **** mount the new snapshot **** >> %LOG% 2>>&1
ntdsutil snapshot "list all" "mount 1" quit quit >> %LOG% 2>>&1

3. copy NTDS snapshot to backup dir

echo **** backup the snapshot files **** >> %LOG% 2>>&1
robocopy . "%BUDIR%" /E /Z /NFL /NDL /R:3 /LOG+:"%LOG%"

What I'm trying to figure out is how do I use ntdsutil to mount/restore this AD snapshot on a 2nd computer so that it's now our Master AD server.


After more digging it doesn't look like @Greg Askew's method of Installing from Media (IFM) will work for us. I should've mentioned this in the original question, but didn't realize it mattered. We're attempting to create a backup of our existing primary AD DS and would like to be able to restore this to a 2nd server as part of our Disaster Recovery (DR) process. According to this blog:

... is a fast and efficient way to re-install a domain controller and get it up to sync, (that’s the proper way to handle a faulting replicas/domain controllers in most cases). There is some common misunderstandings of the concept “Install from media” I terms of if the operation could be performed entirely offline or online, the short answer is: No. It can’t be performed offline; you have to be online with at least one writable domain controller in the same domain as the IFM source is taken from and even then you may not be able to be fully efficient and cause replication to happen ...

It doesn't look like you can use the IFM method to restore the first server in the domain. One already has to be in the domain. So IFM is only an option for doing "online" restores, not "offline" such is our case.

  • You know, there is no such Thing as a Primary AD DOM. – TomTom Jan 6 '13 at 9:27
  • Not sure on the terminology then, the master? – slm Jan 6 '13 at 9:30
  • Yeah, but that makes no sense beause you can change the master(s) (IIRC there are 5 master designations for different functionality) at will. You are better of to just set up a new DC and let AD handle it normally. Why going with a snapshot to start with? – TomTom Jan 6 '13 at 9:51
  • I'm not really following you. This is part of our disaster recovery (DR). We're testing out to see if it's possible to setup a new W2008R2 server and restore from backups (snapshots) our master AD setup. – slm Jan 6 '13 at 15:47
  • Probably be simpler to use the Bare Metal Recovery features of Windows Server Backup. If you do a full backup, you could do a full DC recovery (which would include your AD setup) from scratch with the image and a bootable copy of Windows Server R2. – MikeAWood Jan 13 '13 at 23:07

You need to use the Install From Media (IFM) option:

ntdsutil.exe "act inst NTDS" ifm "Create Sysvol Full C:\IFM” q q

We use this exclusively due to our DIT is 7 GB and it takes a week to perform the initial replication without it.

Installing AD DS from Media



| improve this answer | |
  • No. Snapshots are for partial recovery, such as using ldp, adsiedit, dsa, or ldifde to extract data dumps of objects that were deleted or modified. – Greg Askew Jan 6 '13 at 20:05
  • I don't think IFM is going to allow me to setup a 2nd server as the master AD given it needs to have at least one DC online. blogs.chrisse.se/2011/07/08/… – slm Jan 7 '13 at 0:13
  • Why not use a standard backup/restore, or setup a permanent or semi-permanent recovery dc? – Greg Askew Jan 7 '13 at 0:33
  • Our idea for DR would be all the existing servers have died, and we're setting up a replacement offsite server using a backup of the AD setup from our offsite storage facility. – slm Jan 7 '13 at 0:37
  • Then you should use the standard backup/restore. Snapshots are irrelevant in that scenario. – Greg Askew Jan 7 '13 at 1:04

You could try a single line script to run dcpromo using IFM from PowerShell ISE. I modified some random bits I found on the web and did this by way of a challenge from a coworker ;)

When the future DC has been joined to the domain, log into it and run this code from a new PowerShell ISE session. Remember to change the source DC FQDN and adjust backup and restore paths as needed. Also remove or modify sitename as needed.

Here is a breakdown of the flow:

  1. locates a source DC as specified
  2. looks for an IFM backup of the age you specify and replaces it if it's too old. 3. checks the target (future) DC for a recent IFM backup and uses an existing or creates a new one, depending on the target age threshold (4 hours in the current example).
  3. It creates an IFM backup, copies it over.
  4. runs dcpromo
  5. prompts for credentials for dcpromo and safemode password
  6. completes the promotion and reboots the server.

I recommend testing in a VM environment before deploying to production.

$sourcedc="sourcedc.fqdn" ; $sourceIFMage=(Get-Date).AddHours(-4) ; $targetIFMage=(Get-Date).AddHours(-4) ; $targetdc="$env:computername.$env:userdnsdomain" ; $session = New-PSsession -ComputerName $sourcedc -Credential $env:USERNAME ; If((Test-Path \$sourcedc\c$\ifm) -eq $false){Invoke-Command -Session $session -ScriptBlock {cmd /c "ntdsutil "Activate Instance NTDS" "IFM" "Create Full NoDefrag c:\IFM" "QUIT" "QUIT""}} ; If(Test-Path \$sourcedc\c$\ifm -OlderThan $sourceIFMage){Remove-Item \$sourcedc\c$\ifm -recurse -confirm:$false ;Invoke-Command -Session $session -ScriptBlock {cmd /c "ntdsutil "Activate Instance NTDS" "IFM" "Create Full NoDefrag c:\IFM" "QUIT" "QUIT""}} ; If((Test-Path \$targetdc\c$\ifm) -eq $false){cmd /c "xcopy \$sourcedc\c$\ifm \$targetdc\c$\ifm /s /i /y"} ; If(Test-Path \$targetdc\c$\ifm -OlderThan $targetIFMage){cmd /c "xcopy \$sourcedc\c$\ifm \$targetdc\c$\ifm /s /i /y"} ;Remove-PSsession * ; Install-WindowsFeature -Name AD-Domain-Services –IncludeManagementTools ; Install-ADDSDomainController -domainname $env:userdnsdomain -SiteName "Site1" –InstallationMediaPath "c:\IFM" –DatabasePath "c:\NTDS" –SYSVOLPath "c:\SYSVOL" –LogPath "c:\NTDS" -replicationsourcedc $sourcedc -force

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.