Authoritative Restore in Windows 2000 Active Directory

An authoritative restore in Microsoft Windows 2000 allows administrators to recover deleted or corrupted Active Directory objects and ensure those recovered objects replicate across all domain controllers. This article explains the underlying mechanism and exact execution process Windows 2000 uses to mark restored directory data as authoritative, focusing on Directory Services Restore Mode, the ntdsutil utility, and attribute version numbering.

The Problem with Non-Authoritative Restores

By default, restoring the System State using the built-in Windows 2000 Backup utility (NTBACKUP) is non-authoritative. When the restored domain controller rejoins the network, normal Active Directory replication occurs. The partner domain controllers view the restored objects as outdated because existing objects have higher Update Sequence Numbers (USNs). Consequently, the restored data is overwritten, and deleted objects remain deleted.

How the Authoritative Restore Process Works

To override default replication behavior, Windows 2000 uses the command-line tool ntdsutil.exe to artificially inflate the version numbers of restored objects before the directory service restarts.

  1. Booting into Directory Services Restore Mode (DSRM): The domain controller must be restarted into DSRM by pressing F8 during startup. This stops the Active Directory engine (NTDSA.DLL) and takes the directory database (NTDS.DIT) offline, allowing it to be modified directly.

  2. Performing the Base Restore: Using NTBACKUP, the administrator restores the System State from a backup created before the object was deleted or corrupted. The system is not rebooted immediately after the restore completes.

  3. Running the ntdsutil Utility: From a command prompt, the administrator launches ntdsutil and enters the authoritative restore context:

    • Run ntdsutil
    • Type authoritative restore
    • Target the specific Distinguished Name (DN) by running either:
      • restore object "cn=Username,ou=Department,dc=domain,dc=com" for a single object.
      • restore subtree "ou=Department,dc=domain,dc=com" for an entire container or organizational unit.
      • restore database for the entire Active Directory database.

The Underlying Execution Mechanism

When an authoritative restore command runs, ntdsutil performs the following actions directly on the offline NTDS.DIT database:

  • Version Number Increment: Active Directory tracks changes to object attributes using a version number. ntdsutil increases the version number of every attribute on the targeted object by 100,000 for each authoritative restore operation (or adds 100,000 to the highest version number present).
  • USN Update: The local Update Sequence Number (USN) for the object is updated to mark the change as a new local write.
  • Tombstone Override: If the object was deleted, partner domain controllers hold a "tombstone" entry with a specific version number. Because the restored object's attributes now carry an inflated version number far exceeding the tombstone's version, the restored object wins the conflict resolution check during replication.

Finalizing Replication

Once ntdsutil finishes modifying the targeted entries, the domain controller is rebooted into normal mode. During the subsequent replication cycle, the domain controller advertises the restored objects with their artificially elevated version numbers. Partner domain controllers interpret these objects as the newest updates across the entire forest and write them back into their local directory databases.