How about mechanisms to maintain the integrity of Active Directory,
particularly Directory Services Restore Mode,
or DSRM.
DSRM, in a nutshell, is a password‑protected,
offline,
safe mode environment for Active Directory recovery and maintenance on domain
controllers. In DSRM, you can perform things like authoritative restore. Now
authoritative means that when you restore a deleted object, it becomes a
first‑class citizen in the domain and forest.
In other words,
that domain controller that has the authoritatively restored object is when it
receives a pull request from its partner domain controller,
that partner will say, whoa.
Whatever version of the object is in this authoritative restore is the latest,
make sure that that is so. You see what I mean?
It ensures that your restored object will be replicated properly.
We also can do Active Directory de‑fragmentation and compaction.
Those require that the database be offline.
Now, what are some consequences of DSRM? Well, number one,
it's going to take that domain controller offline, as long as
you're doing the recovery and maintenance, and that could be a
particular issue if, wait for it,
you have a particular FISMO, or Flexible Single
Master Operations role on that DC.
So a good practice would be to transfer FISMO roles off of that domain
controller first, reboot into Directory Services Restore Mode,
do your work, and then restart again to come back and bring
that domain controller back into the fold.
We use the NTDSUtil command line tool once we've rebooted. It's not, the DSRM is
a command line console; it is not a graphical environment.
So you need to use NTDSUtil and its arcane syntax to do your work.
DSRM isn't anywhere near as critical as it was in the very
early days of Active Directory. For example, now we have what's
called Restartable AD DS, and again,
that's been around for years; it's not new in Windows Server
2022, but this allows you to stop and start Active Directory
while the domain controller is online. Now, let me go into more detail about that, actually, in the next slide.