To use Restartable AD DS on a domain controller,
you can just do a net stop ntds, and it stops the service on the machine,
and it also stops dependent services, like if you're doing FRS replication,
certainly the Kerberos key distribution center,
DNS, and most importantly,
the Active Directory database on that domain controller is
inaccessible, and that would also affect FISMO roles.
However, what do you get in return?
Well,
you don't have to keep rebooting the machine. Because the
machine is still up, network connected, and online, you
can do your object restores,
you can do system state backup and restore, you can do your offline
de‑fragmentation, and then simply do a net start ntds to start up AD DS and its
dependent services again. You see what I mean? Now a best practice here is to
make sure you have regular system state backup.
System state backup, you might know, is a way to back up the core
state of a domain controller. Particularly, it will back up the
entire Active Directory database.
And why do I say you should keep your system state within a 180‑day
window? Hopefully, you back it up a lot more than that.
It's that tombstone lifetime. You never want to be in a situation
where you're restoring a system state and your conflicting with
objects that have been deleted and tombstoned out.
No, you don't want that.
You want to make sure that you've got a recent system state.
Lastly, let's troubleshoot Active Directory replication. Now,
of course, we can use the Active Directory Sites and Services console,
but for the purposes of AZ‑801,
it's important that you know just a little bit about the old repadmin
command line executable that uses syntax that takes us before Windows
into MS‑DOS. If any of you are old like me,
you remember DOS. We can do repadmin on a domain
controller with /? to get syntax help.
Some important commands you should know: showing overall
replication help with replsummary,
showing your replication partner for the current
domain controller in its status.
Remember that replication is a pull operation in AD. Show only replication
errors. Basically, we're filtering showrepl. Show the replication queue. What
changes haven't yet been replicated? Redadmin /queue.
And then very importantly, to force a pull, that is on that domain controller,
to query its replication partner and pull changes from it.
Repadmin /syncall, and then you specify the /AeD. Yes,
this helps me. I don't know about you, but it helps me appreciate the
consistency of PowerShell syntax as opposed to these old command line tools that each have their own unique syntax.