{"id":5823,"date":"2016-10-17T10:33:05","date_gmt":"2016-10-17T15:33:05","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=5823"},"modified":"2019-12-17T11:13:02","modified_gmt":"2019-12-17T16:13:02","slug":"usn-rollback","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=5823","title":{"rendered":"USN Rollback"},"content":{"rendered":"

I had to recover my domain controller from the Hyper-V image backup. There’s some protection build into AD which prevents just randomly reverting a server. When you’ve got a larger domain, the built-in protection after unsupported restoration procedures serves a purpose. Pausing netlogon avoids having users log on against bad data. Disabling replication avoids propagating bad information out to the remainder of the network. The solution is simple – demote the DC, promote it again, and the DC returns to service. But <\/strong><\/em>when you have a single domain controller in a single domain in a single forest … well, there’s no other data around. What the recovered DC has is as good as it’s going to get (i.e. a change from 2AM is lost when I revert to my 10PM backup). And taking the entire domain down and building it overkill. You can, instead, basically tell AD to go with it. From the MS documentation:<\/p>\n

To restore a previous version of a virtual domain controller VHD without system state data backup<\/h2>\n
    \n
  1. Using the previous VHD, start the virtual domain controller in DSRM, as described in the previous section. Do not allow the domain controller to start in normal mode. If you miss the Windows Boot Manager screen and the domain controller begins to start in normal mode, turn off the virtual machine to prevent it from completing startup. See the previous section for detailed instructions for entering DSRM.<\/li>\n
  2. Open Registry Editor. To open Registry Editor, click Start<\/strong>, click Run<\/strong>, type regedit<\/strong>, and then click OK. If the User Account Control<\/strong> dialog box appears, confirm that the action it displays is what you want, and then click Yes<\/strong>. In Registry Editor, expand the following path: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters<\/strong>. Look for a value named DSA Previous Restore Count<\/strong>. If the value is there, make a note of the setting. If the value is not there, the setting is equal to the default, which is zero. Do not add a value if you do not see one there.<\/li>\n
  3. Right-click the Parameters<\/strong> key, click New<\/strong>, and then click DWORD (32-bit) Value<\/strong>.<\/li>\n
  4. Type the new name Database restored from backup<\/strong>, and then press ENTER.<\/li>\n
  5. Double-click the value that you just created to open the Edit DWORD (32-bit) Value<\/strong> dialog box, and then type 1<\/strong> in the Value data<\/strong> box. The Database restored from backup entry<\/strong> option is available on domain controllers that are running Windows\u00a02000\u00a0Server with Service Pack\u00a04 (SP4), Windows\u00a0Server\u00a02003 with the updates that are included in article 875495<\/a> (http:\/\/go.microsoft.com\/fwlink\/?LinkId=137182<\/a>) in the Microsoft Knowledge Base installed, and Windows\u00a0Server\u00a02008.<\/li>\n
  6. Restart the domain controller in normal mode.<\/li>\n
  7. When the domain controller restarts, open Event Viewer. To open Event Viewer, click Start<\/strong>, click Control Panel<\/strong>, double-click Administrative Tools<\/strong>, and then double-click Event Viewer<\/strong>.<\/li>\n
  8. Expand Application and Services Logs<\/strong>, and then click the Directory Services<\/strong> log. Ensure that events appear in the details pane.<\/li>\n
  9. Right-click the Directory Services<\/strong> log, and then click Find<\/strong>. In Find what<\/strong>, type 1109<\/strong>, and then click Find Next<\/strong>.<\/li>\n
  10. You should see at least an Event\u00a0ID\u00a01109 entry. If you do not see this entry, proceed to the next step. Otherwise, double-click the entry, and then review the text confirming that the update was made to the InvocationID:\n
    <\/div>\n<\/li>\n<\/ol>\n

     <\/p>\n

      \n
    • \n
      Active Directory has been restored from backup media, or has been configured to host an application partition. \r\nThe invocationID attribute for this directory server has been changed. \r\nThe highest update sequence number at the time the backup was created is <time>\r\n\r\nInvocationID attribute (old value):<Previous InvocationID value>\r\nInvocationID attribute (new value):<New InvocationID value>\r\nUpdate sequence number:<USN>\r\n\r\nThe InvocationID is changed when a directory server is restored from backup media or is configured to host a writeable application directory partition.\r\n<\/code><\/pre>\n<\/li>\n
    • Close Event Viewer.<\/li>\n
    • Use Registry Editor to verify that the value in DSA Previous Restore Count<\/strong> is equal to the previous value plus one. If this is not the correct value and you cannot find an entry for Event\u00a0ID\u00a01109 in Event Viewer, verify that the domain controller\u2019s service packs are current. You cannot try this procedure again on the same VHD. You can try again on a copy of the VHD or a different VHD that has not been started in normal mode by starting over at step\u00a01.<\/li>\n
    • Close Registry Editor.<\/li>\n<\/ul>\n
       <\/p>\n
      After following the instructions from Microsoft, I still had a problem — my DC has replication turned off & netlogon comes up paused. In regedit, locate HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters and delete the “Dsa Not Writable” key (value: dword:00000004). In a command prompt, run the following:<\/p>\n
       <\/p>\n
      repadmin \/options dchostname.example.com -DISABLE_OUTBOUND_REPL\r\nrepadmin \/options dchostname.example.com -DISABLE_INBOUND_REPL<\/pre>\n
      Reboot the DC. When it starts, netlogon should be running and replication.<\/p>\n","protected":false},"excerpt":{"rendered":"
      I had to recover my domain controller from the Hyper-V image backup. There’s some protection build into AD which prevents just randomly reverting a server. When you’ve got a larger domain, the built-in protection after unsupported restoration procedures serves a purpose. Pausing netlogon avoids having users log on against bad data. Disabling replication avoids propagating …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[68,869,673],"class_list":["post-5823","post","type-post","status-publish","format-standard","hentry","category-system-administration","tag-active-directory","tag-netlogon","tag-system-recovery"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/5823","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5823"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/5823\/revisions"}],"predecessor-version":[{"id":5824,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/5823\/revisions\/5824"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5823"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5823"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5823"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}