Step-By-Step: Enabling Active Directory Recycle Bin in Windows Server 2012 R2

Active Directory Recycle Bin was created to adhere to that very problem and this Step-By-Step will showcase how easy it is to enable.  This procedure does not negate the need to have a proper system state backup which is always recommended and one must be aware that enabling this feature is one time and cannot be reversed under any circumstances.

Enabling Active Directory Recycle Bin

1. In the management console, go to Tools > Active Directory Administrative Center
   
2. Select Local Domain and in the Tasks Pane
   
3. Select Enable Recycle Bin.
   
4. Click OK
   NOTE: Be aware this feature cannot be disabled.
   
5. Click OK.  Once enabled, wait for AD replication to complete as this is a change made on the configuration partition. This process may take a while should your organization have a large active directory infrastructure.

A very simple enablement of a process that could save you hours of restore time.  Again this process cannot be reversed once invoked.

Be sure to test Active Directory Recycle Bin in your lab by downloading Windows Server 2012 R2. Also, be sure to take advantage of Microsoft Virtual Academy to learn about additional features made available in Windows Server 2012 R2 to further your IT career.

Importing media to Backup Exec

Importing media to Backup Exec

You can import media to a robotic library to add tapes to Backup Exec, or to import media that is required for a restore job. When you insert media into a robotic library, you must create an import storage operation job. The import storage operation updates the Backup Exec database with the information about the media. Backup Exec associates the media that you import with a system media set.

See Default media sets.

Note:

You should not associate scratch media with a media set that you create. Backup Exec automatically moves the media to the required media set as needed.

Before you import media, note the following:

• If the media does not have a barcode, you must run the Inventory after import operation so that the current media's label appears in the properties. You can only select this operation after you select Import media now.
• If the robotic library uses a media magazine, ensure that no jobs are currently running. Before you swap the magazine, ensure that all media are ejected from the drive and are back in the magazine slots.

You can select any number of slots to import media to.

The import storage operation supports robotic libraries with portals. When this storage operation job runs, Backup Exec checks the selected slots for media. If media is found, it is exported to the portals. After all of the media is exported, you are prompted to insert new media into the portal so it can be imported. This process continues until all of the requested media have been imported into the robotic library.

You can also run a scan operation to update the slot information when you insert new media in a robotic library. The scan job log reports the barcoded media that are in the drives and portals.

See Scanning a storage device.

To import media now

1. On the Storage tab, do one of the following
   • Expand the robotic library, right-click Slots, and then click Import media now.
   • Right-click the robotic library, and then click Import media now.
2. (Optional) View the job history or click the Job Monitor tab for details about the job.

To schedule an import media job

1. On the Storage tab, do one of the following:
   • Expand the robotic library, right-click Slots, and then click Import media now.
   • Right-click the robotic library, and then click Import media now, and then click Schedule.
2. In the left pane, click Storage operations.
3. Click the drop-down menu, and select storage operation that you want to schedule:

   Import	Updates the Backup Exec database with information about the media.
   Inventory after import	Mounts the media in the drive, reads the media label, and updates the Backup Exec database. This operation is necessary for media that do not have barcodes.

4. To send a notification when the job completes, in the left pane, click Notification and select the appropriate options:

   Recipient name	Show the names of the individual and group recipients.
   Recipient type	Indicate Recipient for an individual recipient or Group for a group recipient.
   Manage Recipients	Add, edit, or delete recipients.
   Properties	View or change the properties of a selected recipient.

5. To schedule the job, in the left pane, click Schedule and select the appropriate options.

   Recurrence	Specify a recurrence schedule for the job.
   Hours	Create a recurrence pattern that is measured in hours or minutes. When you select Hours, you can configure the following options: Every X hour/minute Indicates the number of hours or minutes between the start time of a job and the start time of the next job instance. From Designates the starting time for a job to run. Between Restricts the job to certain hours and days. For example, if you only want the job to run during business hours, you can select 9:00 AM to 5:00 PM on Monday, Tuesday, Wednesday, Thursday, and Friday. The start time and end time can span a maximum of 24 hours, however they can cross over midnight into the following day.
   Days	Create a recurrence pattern that is measured in days. When you select Days, you must choose between the following options: Every X day Indicates the number of days between the start time of a job and the start time of the next job instance. Every weekday Specifies that the job should run on Mondays, Tuesdays, Wednesdays, Thursdays, and Fridays.
   Weeks	Create a recurrence pattern that is measured in weeks. When you create a recurrence pattern that is measured in weeks, you must configure the Every X week on field. The Every X week on specifies the number of weeks between the start time of a job and the start time of the next job instance. It also specifies the days of the week on which the job should run.
   Months	Create a recurrence pattern that is measured in months. When you select Months, you must choose between the following options: Day X of every X month Specifies the day on which the job should run. It also indicates the number of months between the start time of a job and the start time of the next job instance. Every X X of every X month Specifies the day on which the job should run. It also indicates the number of months between the start time of a job and the start time of the next job instance. Selected days of the month Specifies the weeks and days of the month on which Backup Exec runs the job. You select the days and weeks on a grid. The recurrence pattern that you select repeats itself every month. The default setting is for the job to run every month on the current week and day of the month. For example, if you create the job on the third Monday of the month, the default setting is for the job to run once a month on the third Monday. You can change the default or select additional days on which the job should run. Any additional days that you select are added to the monthly recurrence pattern. Selected dates of the month Specifies the dates of the month on which Backup Exec runs the job. The recurrence pattern that you select repeats itself every month. The default setting is for the job to run every month on the current date of the month. For example, if you create the job on the 15th, the default setting is for the job to run once a month on the 15th. You can change the default or select additional days on which the job should run. Any additional days that you select are added to the monthly recurrence pattern. If you select the 31st, the job runs on the last day of the month in months that do not have 31 days. For example, if you configure the job to run on the 31st, in September the job runs on the 30th instead.
   Years	Create a recurrence pattern that is measured in years. When you select Years, you can configure the following options: Every X year Specifies the number of years between the start time of a job and the start time of the next job instance. On X Specifies the date on which Backup Exec runs the job. The date that you select in this field corresponds to the number of years that you selected in the Every X year field. So if you selected to run the job every 2 years and you selected June 28th in this field, the job runs every 2 years on June 28th. On the X of X Specifies the day and month on which Backup Exec runs the job. The date that you select in this field corresponds to the number of years that you selected in the Every X year field. So if you selected to run the job every 2 years and you selected the fourth Thursday of June in this field, the job runs every 2 years on the fourth Thursday of June.
   at	Designate the starting time for the first job in the recurrence pattern.
   Calendar	View all scheduled jobs on a calendar to check for scheduling conflicts.
   Reschedule the job if it does not start x hours after its scheduled start	Specify the amount of time past the job's scheduled start time at which Backup Exec changes the job completion status to Missed. The job is rescheduled to run based on the time window that you configured.
   Cancel the job if it is still running x hours after it scheduled start time	Specify the amount of time after the job's scheduled start time at which you want to cancel the job if it is still running. Backup Exec changes the job completion status to Canceled, timed out.
   Include dates with the schedule of this job	Specify dates to include with the job schedule. The job runs on all of the dates that you select using this option, in addition to the dates that are part of its normal schedule recurrence. The job resumes its normal schedule on the next day that it is scheduled after an include date.
   Exclude dates from the schedule for this job	Specify dates to exclude from the job schedule. The job does not run on any of the dates that you select using this option. It resumes its normal schedule on the next day that a job is scheduled after an excluded date.
   Run now with no recurring schedule	Run the job immediately without scheduling any more instances of it for the future.
   Run on	Run the job at the time and date that you specify.
   Create without a schedule	Create a job without scheduling it. When you use this option, the job does not run at the time of creation and it does not have a recurring schedule. The job remains unscheduled until you choose to run it. You can use a third-party job automation or task scheduling tool to run the job later. If you use this option to create a job, you cannot place the job on hold. You cannot place jobs on hold unless they are scheduled.

6. Click OK
7. (Optional) View the job history or click the Job Monitor tab for details about the job.
   See Viewing jobs, job histories, backup sets, and active alerts for storage devices.

Enable AD Recycle Bin & Restore Deleted AD Object

Step 1: Enable Active Directory Recycle Bin

14 van 27 hebben dit beoordeeld als nuttig - Dit onderwerp beoordelen

Bijgewerkt: januari 2009
Van toepassing op: Windows Server 2008 R2

This step provides instructions for the following tasks:

• Raising the forest functional level
  
  
• Enabling Active Directory Recycle Bin
  
  

Raising the forest functional level

You can enable Active Directory Recycle Bin only if the forest functional level of your environment is set to Windows Server 2008 R2. You can raise the forest functional level by using the following methods:

• Set-ADForestMode Active Directory module cmdlet
  
  

  Note

  The Active Directory module for Windows PowerShell in Windows Server 2008 R2 is a Windows PowerShell™ module (named Active Directory) that consolidates a group of cmdlets. You can use these cmdlets to manage your Active Directory domains, Active Directory Lightweight Directory Services (AD LDS) configuration sets, and Active Directory Database Mounting Tool instances in a single, self-contained package. For more information, see What's New in AD DS: Active Directory Module for Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=140056).

  
  
• Ldp.exe
  
  

Membership in Enterprise Admins, or equivalent, is the minimum required to complete these procedures. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To raise the forest functional level to Windows Server 2008 R2 using the Set-ADForestMode cmdlet

1. Click Start, click Administrative Tools, right-click Active Directory Module for Windows PowerShell, and then click Run as administrator.
   
2. At the Active Directory module for Windows PowerShell command prompt, type the following command, and then press ENTER:
   Set-ADForestMode [-Identity] [-ForestMode]
   To set the forest functional level to Windows Server 2008 R2, type Windows2008R2Forest for .
   For example, to set the forest functional level of contoso.com to Windows Server 2008 R2, type the following command, and then press ENTER:
   Set-ADForestMode –Identity contoso.com -ForestMode Windows2008R2Forest
   

For more information about the Set-ADForestMode cmdlet, at the Active Directory module for Windows PowerShell command prompt, type Get-Help Set-ADForestMode, and then press ENTER.

Note

You can use the Set-ADObject cmdlet to raise the functional level of an AD LDS configuration set. For example, to raise the functional level of an AD LDS configuration set on a local AD LDS server, where the distinguished name of the AD LDS configuration directory partition is CN=Configuration,CN={32E430E4-42D3-4663-BCA7-5F5DFDC898}, use the following cmdlet: Set-ADObject -Identity 'CN=Partitions,CN=Configuration,CN={32E430E4-42D3-4663-BCA7-5F5DFDC898}’ -Replace @{'msds-Behavior-Version'=4} -Server localhost:50000

To raise the forest functional level to Windows Server 2008 R2 using Ldp.exe

1. To open Ldp.exe, click Start, click Run, and then type ldp.exe.
   
2. To connect and bind to the server that hosts the forest root domain of your AD DS environment, under Connection, click Connect, and then click Bind.
   
3. Click View, and then click Tree. In BaseDN, select the configuration directory partition, and then click OK.
   
4. In the console tree, double-click the distinguished name (also known as DN) of the configuration directory partition, and then navigate to the CN=Partitions container.
   
5. Right-click the CN=Partitions container’s distinguished name, and then click Modify.
   
6. In the Modify dialog box, in Edit Entry Attribute, type msDS-Behavior-Version.
   
7. In the Modify dialog box, in Values, type 4 (the value of the Windows Server 2008 R2 forest functional level).
   
8. In the Modify dialog box, under Operation click Replace, click Enter, and then click Run.
   

Enabling Active Directory Recycle Bin

After the forest functional level of your environment is set to Windows Server 2008 R2, you can enable Active Directory Recycle Bin by using the following methods:

• Enable-ADOptionalFeature Active Directory module cmdlet (This is the recommended method.)
  
• Ldp.exe             

Step 2: Restore a Deleted Active Directory Object

15 van 28 hebben dit beoordeeld als nuttig - Dit onderwerp beoordelen

Bijgewerkt: januari 2009
Van toepassing op: Windows Server 2008 R2

This step provides instructions for completing the following tasks with Active Directory Recycle Bin:

• Displaying the Deleted Objects container
  
  
• Restoring a deleted Active Directory object using Ldp.exe
  
  
• Restoring a deleted Active Directory object using the Get-ADObject and Restore-ADObject cmdlets
  
  
• Restoring multiple, deleted Active Directory objects
  
  

Displaying the Deleted Objects container

When Active Directory objects are deleted, they are placed in the Deleted Objects container. By default, the CN=Deleted Objects container is not displayed. You can use the Ldp.exe administration tool in Active Directory Domain Services (AD DS) to display the Deleted Objects container.
Membership in Domain Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.
To display the Deleted Objects container

1. To open Ldp.exe, click Start, click Run, and then type ldp.exe.
   
2. On the Options menu, click Controls.
   
3. In the Controls dialog box, expand the Load Predefined pull-down menu, click Return deleted objects, and then click OK.
   
4. To verify that the Deleted Objects container is displayed:
   
   1. To connect and bind to the server that hosts the forest root domain of your AD DS environment, under Connections, click Connect, and then Bind.
      
   2. Click View, click Tree, and in BaseDN, type DC=,DC=, where and represent the appropriate forest root domain name of your AD DS environment.
      
   3. In the console tree, double-click the root distinguished name (also known as DN) and locate the CN=Deleted Objects, DC=,DC= container, where and represent the appropriate forest root domain name of your AD DS environment.
      

Restoring a deleted Active Directory object using Ldp.exe

You can use Ldp.exe to restore a single, deleted Active Directory object.
Membership in Domain Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.
To restore a deleted Active Directory object using Ldp.exe

1. To open Ldp.exe, click Start, click Run, and then type ldp.exe.
   
2. To connect and bind to the server that hosts the forest root domain of your AD DS environment, under Connections, click Connect, and then click Bind.
   
3. In the console tree, navigate to the CN=Deleted Objects container.
   
4. Locate and right-click the deleted Active Directory object that you want to restore, and then click Modify.
   
5. In the Modify dialog box:
   
   1. In Edit Entry Attribute, type isDeleted.
      
   2. Leave the Values box empty.
      
   3. Under Operation, click Delete, and then click Enter.
      
   4. In Edit Entry Attribute, type distinguishedName.
      
   5. In Values, type the original distinguished name (also known as DN) of this Active Directory object.
      
   6. Under Operation, click Replace.
      
   7. Make sure that the Extended check box is selected, click Enter, and then click Run.
      

Note

When you delete or recover an Active Directory object with link-valued attributes, AD DS must process the object’s link value table to maintain referential integrity on the linked attribute’s values. Because deleting or recovering an Active Directory object results in modifications to the object’s link value table, if you attempt to delete or recover an object during its ongoing link-value-table processing time, the operation will be blocked. For example, if you use the Active Directory Recycle Bin to recover a deleted object with a large number of link-valued attributes (for example, a group object with 10 million users) immediately after it was deleted (or anytime throughout the duration of its link-value-table processing), the object recovery will be blocked. (If you are using Ldp.exe to perform the recovery, you might see the following error message: "Error 0x2093 The operation cannot continue because the object is in the process of being removed.")

Restoring a deleted Active Directory object using the Get-ADObject and Restore-ADObject cmdlets

You can also restore a deleted Active Directory object by using the Get-ADObject and Restore-ADObject Active Directory module for Windows PowerShell cmdlets. The recommended approach is to use the Get-ADObject cmdlet to retrieve the deleted object and then pass that object through the pipeline to the Restore-ADObject cmdlet.
To restore a single, deleted Active Directory object using the Get-ADObject and Restore-ADObject cmdlets

1. Click Start, click Administrative Tools, right-click Active Directory Module for Windows PowerShell, and then click Run as administrator.
   
2. At the Active Directory module for Windows PowerShell command prompt, type the following command, and then press ENTER:
   Get-ADObject -Filter {String} -IncludeDeletedObjects | Restore-ADObject
   For example, if you want to restore an accidentally deleted user object with the display name Mary, type the following command, and then press ENTER:
   Get-ADObject -Filter {displayName -eq "Mary"} -IncludeDeletedObjects | Restore-ADObject
   

For more information about the Get-ADObject and Restore-ADObject cmdlets, at the Active Directory module for Windows PowerShell command prompt, type Get-Help Get-ADObject or Get-Help Restore-ADObject, and then press ENTER.

Restoring multiple, deleted Active Directory objects

Consider the following scenario: An administrator at Contoso.com accidentally deletes a nested organizational unit (OU) called Finance_Department, which contains user accounts for employees in the Finance department. The administrator deletes another OU called Admins, which contains user accounts for administrative assistants that work for the Finance department. Brian and Mary are user accounts in the Finance_Department OU. Tom is a user account in the Admins OU. The following illustration shows the Finance_Department OU.
When the Finance_Department OU is deleted, all its objects (a total of five objects) are moved to the Deleted Objects container, with their distinguished names mangled. The Deleted Objects container displays all logically deleted objects in a flat hierarchy as its direct children. The recommended approach to restoring a nested OU to its original state is to use the Get-ADObject Active Directory module cmdlet to retrieve the deleted objects one hierarchy level at a time and then to pass those objects through the pipeline to the Restore-ADObject cmdlet. If the administrator is not familiar with the original hierarchy of the Finance_Department OU, the administrator must first use the Get-ADOBject cmdlet to perform several investigation steps:

• For example, the administrator decides to search for the user account Mary with the Get-ADOBject cmdlet, using the msDS-lastKnownRDN attribute in the ldapFilter parameter and constructing the command so that the lastKnownParent attribute of Mary is returned, as follows:
  
  Get-ADObject -SearchBase "CN=Deleted Objects,DC=contoso,DC=com" -ldapFilter:"(msDs-lastKnownRDN=Mary)" –IncludeDeletedObjects –Properties lastKnownParent
  
  In the output that the Get-ADObject cmdlet returns, the administrator notices that the value for lastKnownParent of Mary is Finance_Department. The administrator also notices that the distinguished name of the Finance_Department OU is mangled, which indicates that the Finance_Department OU object itself is deleted. (An example of a mangled distinguished name is OU=Finance_Department\0ADEL:e954edda-db8c-41be-bbbd-599bef5a5f2a,CN=Deleted Objects,DC=contoso,DC=com.)
  
• The administrator then decides to search for all the objects in the Deleted Objects container whose lastKnownParent value is Finance_Department, using the following command:
  
  Get-ADObject –SearchBase "CN=Deleted Objects,DC=contoso,DC=com" -Filter {lastKnownParent -eq 'OU=Finance_Department\\0ADEL:e954edda-db8c-41be-bbbd-599bef5a5f2a,CN=Deleted Objects,DC=contoso,DC=com'} -IncludeDeletedObjects -Properties lastKnownParent | ft
  
  

  Note
  Make sure that you escape the slash (\) in the mangled distinguished name that is used in the Get-ADObject cmdlet with another slash.

  In the output that the Get-ADObject cmdlet returns, the administrator notices that Admins is an OU itself.
  
• The administer further searches for all the deleted objects with a lastKnownParent attribute equal to Admins, using the following command:
  
  Get-ADObject –SearchBase "CN=Deleted Objects,DC=contoso,DC=com" -Filter {lastKnownParent -eq 'OU=Admins\\0ADEL:6b405c87-027c-4135-95af-36c31002be5a,CN=Deleted Objects,DC=contoso,DC=com'} -IncludeDeletedObjects -Properties lastKnownParent | ft
  
  

  Note
  Make sure that you escape the slash (\) in the mangled distinguished name that is used in the Get-ADObject cmdlet with another slash.

  In the output that the Get-ADObject cmdlet returns, the administrator finds the user account Tom.
  
• In Windows Server 2008 R2, deleted nested objects must be restored from the highest level of their hierarchy to a live parent. Therefore, the Finance_Department OU object must be restored first. Because all previous investigation steps were performed using the lastKnownParent attribute, which points to the direct parent of the object and does not indicate whether the next parent object is also deleted, as a check the administrator can verify that the value of lastKnownParent for Finance_Department is indeed a live OU by running the following command:
  
  Get-ADObject -SearchBase "CN=Deleted Objects,DC=contoso,DC=com" -ldapFilter:"(msDs-lastKnownRDN=Finance_Department)" –IncludeDeletedObjects –Properties lastKnownParent
  
  This concludes the investigation and the administrator is ready to restore the Finance_Department OU to its original hierarchy and state.
  

Important
It is critical to begin restoring objects from the highest level of the hierarchy because deleted objects must be restored to a live parent.

To restore the Finance_Department OU, the administrator can perform the following procedure.
To restore the Finance_Department OU

1. Click Start, click Administrative Tools, right-click Active Directory Module for Windows PowerShell, and then click Run as administrator.
   
2. Restore the Finance_Department OU by running the following command at the Active Directory Module for Windows PowerShell prompt:
   Get-ADObject -ldapFilter:"(msDS-LastKnownRDN=Finance_Department)" –IncludeDeletedObjects | Restore-ADObject
   
3. Restore the user accounts Brian and Mary and the Admins OU (the direct children of the Finance_Department OU whose distinguished name was restored to OU=Finance_Department,DC=contoso,DC=com in the previous step) by running the following command at the Active Directory Module for Windows PowerShell prompt:
   Get-ADObject -SearchBase "CN=Deleted Objects,DC=contoso,DC=com" -Filter {lastKnownParent -eq "OU=Finance_Department,DC=contoso,DC=com"} -IncludeDeletedObjects | Restore-ADObject
   
4. Restore the user account Tom (the direct child of the Admins OU whose distinguished name was restored to OU=Admins,OU=Finance_Department,DC=contoso,DC=com in the previous step) by running the following command at the Active Directory Module for Windows PowerShell prompt:
   Get-ADObject -SearchBase "CN=Deleted Objects,DC=contoso,DC=com" -Filter {lastKnownParent -eq "OU=Admins,OU=Finance_Department,DC=contoso,DC=com"} -IncludeDeletedObjects | Restore-ADObject
   

For more information about the Get-ADObject and Restore-ADObject cmdlets, at the Active Directory Module for Windows PowerShell command prompt, type Get-Help Get-ADObject or Get-Help Restore-ADObject.
For a sample Windows PowerShell script that you can use to restore a deleted tree of Active Directory objects, see Appendix B: Restore Multiple, Deleted Active Directory Objects (Sample Script).