Re: [ActiveDir] Active Directory Log

[Michael Penland]

Title: Message

Here is a tid bit of an example! But I am not an authority.   When a domain contains more than one domain controller, Active Directory replicates directory objects, such as users, groups, organizational units, and computers, to all the domain controllers in that domain. When you are restoring a domain controller by using backup and restore programs, such as Ntbackup or those from third-party providers, the default mode for the restore is nonauthoritative. This means that the restored server is brought up-to-date with its replicas through the normal replication mechanism. For example, if a domain controller is restored from a backup tape that is two weeks old, when you restart it, the normal replication mechanism brings it up-to-date with respect to its replication partners. Authoritative restore allows the administrator to recover a domain controller, restore it to a specific point in time, and mark objects in Active Directory as being authoritative with respect to their replication partners. For example, you might need to perform an authoritative restore if an administrator inadvertently deletes an organizational unit containing a large number of users. If you restore the server from tape, the normal replication process would not restore the inadvertently deleted organizational unit. Authoritative restore allows you to mark the organizational unit as authoritative and force the replication process to restore it to all of the other domain controllers in the domain. ----- Original Message ----- From: Michael Penland To: [EMAIL PROTECTED] Sent: Wednesday, November 06, 2002 2:48 AM Subject: Re: [ActiveDir] Active Directory Log When you restore the DIT on a 2000 DC with NTDSUtil, doesn't that restore Active Directory.     If so how often does it update changes made to the functioning Schema and Objects.   MGP ----- Original Message ----- From: Jones, Rick J.(Desktop Engineering) To: [EMAIL PROTECTED] Sent: Tuesday, November 05, 2002 11:36 PM Subject: RE: [ActiveDir] Active Directory Log Doesn’t AD have a built in backup process it uses of any type at all?   Rick   -----Original Message----- From: Rick Kingslan [mailto:[EMAIL PROTECTED]] Sent: Tuesday, November 05, 2002 8:31 PM To: [EMAIL PROTECTED] Subject: RE: [ActiveDir] Active Directory Log   Rick,   AFAIK, there is a whole list of 'No's' here, unless you had a third party object auditing tool.  At best, Windows 2000 auditing might be able to tell you which ID moved the computer object.  This would assume that auditing was on and that you were auditing AD objects, and that the Security log still has the relevant entries.  But, for the rest of them, Win2k doesn't have a facility to be able to tell you these things.   Apologies....   Rick Kingslan  MCSE, MCSA, MCT Microsoft MVP - Active Directory Associate Expert Expert Zone - www.Microsoft.com/windowsxp/expertzone -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Jones, Rick J.(Desktop Engineering) Sent: Tuesday, November 05, 2002 9:37 PM To: [EMAIL PROTECTED] Subject: [ActiveDir] Active Directory Log We had a list of computers that got moved to an incorrect OU.   Is there a way of looking on the Computer account to see what NT ID was used to move that computer?   Is there a way of looking on the Computer account to see what OU it was moved from?   Is there a way of looking in a log file somewhere in AD to tell this information if none of the above is available?   Would appreciate anyone’s input, I am dieing here to fix a booboo (HUGE ONE)   Thanks;   Rick VIRUS FREE SMTP! MarinaOne VIRUS FREE SMTP! MarinaOne VIRUS FREE SMTP! MarinaOne VIRUS FREE SMTP! MarinaOne