Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Hey I'm using Active directory on a network with around 150 users, all members of different groups with different policies etc. it would be a huge problem for our network if e.g. by mistake an admin one day deleted all users or all groups...

do any of you know of any way you can get the AD to create logs of its current users and groups? I don't suppose it can create a backup, but just a text form would at least be some form of comfort, so we could see how it 'was'.

share|improve this question

4 Answers 4

Running AD without reliable backups is a guaranteed Career Limiting Move.

You could use a tool like ldifde(doc) or csvde(doc) to dump AD objects, but that really won't be adequate to recover from a major failure or deletion. In those cases, you need to have a reliable backup of your Active Directory environment and you may need to perform an operation called an Authoritative Restore.

Microsoft has lots of documentation about backing up and recovering Active Directory, which you should read and understand if you are responsible for maintaining AD in your organization. Starting with Server 2008, Microsoft includes Windows Server Backup, which you should use if you don't have another backup product that supports Windows System State recovery. (In fact, I use it in addition to my enterprise backup product.)

Lastly, if you are using the latest and greatest Windows Server 2008 R2 AND you are running a Server 2008 R2 Forest functional level, then you may want to look into the new Active Directory Recycle Bin feature. But again, this doesn't obviate the need to have a reliable, tested backup process for your AD infrastructure.

share|improve this answer

Active Directory is backed up whenever you do a system state backup of the domain controller. You do backup your domain controller, correct? Make sure it includes the system state.

More here: http://www.youtube.com/watch?v=4ZgupfaJOG0

share|improve this answer

You're not alone wondering if there's a better way to protect critical objects in AD. Native protections only get you so far - there's always the possibility of that "oops" moment when you make a mistake (delete a critical OU, remove the CEO's user account, or something simple like add the wrong guy to the domain admins group) and think maybe there's a better way to protect yourself.

Backups are a must-have, but in many cases a restore of your entire directory isn't an answer. It's something you can do if desperate, but the mistake is stil out there and you're still spending a lot of time and resources restoring and then re-implementing all of the changes since your last good backup.

There are some tools out there that solve this problem without having to resort to a full restore of your AD from some point in the past. Tools that pro-actively prevent critical changes from happening at all, locking down critical objects so that mistakes never happened. The company I work for has such a tool - StealthINTERCEPT for AD and GPOs - and a quick google search can probably turn up others. The approach with StealthINTERCEPT is to identify key objects within AD and lock them down. Locking htem down means preventing your admins (and yourself, if desired) from making certain critical mistakes by controlling when and if you can delete, move, rename, or otherwise modify objects within AD. The security that StealthINTERCEPT provides exists outside of AD native permissions, meaning that even the users with the highest level of priviledge within your organization can still rely on our tool to prevent them from doing truly destructive things.

If you'd like to see the tool in action, come by one of our demonstrations or contact us at http://www.stealthbits.com/contact-us-company.

share|improve this answer

To my understanding, Server 2008 level AD forests provides a Recycle Bin to recover from accidental delete operations.

Microsoft provides a Step-by-step guide about using the Recycle Bin in AD:

Besides that, you should never give administrative access to your whole domain/forest to people who are in the habit of doing anything by accident. You want people who do things "by the book".

AD provides Organizational Units to segment your authorities and permissions. Use them! Don't let a single user control your whole directory.

Sure, you can have a single authority on top of your hierarchy, but make sure it's someone who takes the job seriously and is aware of the importance of the data he is managing.

Bottom line, people who accidentally delete things and who don't keep backups of said data aren't the kind of people you should entrust your directory to.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.