Nakivo, a backup company based out of Silicon Valley has been providing backup and replication software to the world since late 2012. Today we will not focus so much and getting Nakivo up and running, we’ve already done that thoroughly here, but instead we will take a look at one individual feature; Instant Object Level Recovery for Microsoft Active Directory. Let’s face it – mistakes happen – users get deleted, OU’s get wiped out, security groups get completely out of sync. This is all stuff that happens, and happens more often than we know it. Certainly performing a complete full restore of a domain controller can be a little bit over the top just to get one individual user back (depending on who it is I suppose 
), which is why Nakivo has been providing a means for restoring these individual Active Directory objects since their 5.5 release back in March of 2015. Today we will take a more in-depth look at just how we perform these restorations. Rather than simply showing how things are done I thought I’d have a little more fun with it this go around, put a little story behind it for all of our enjoyment 🙂 With that said, let’s dive in!
The Scenario
Let’s paint the scene – you are a sysadmin working for a pretty famous hockey club based out of Montreal. You are using Nakivo to protect a couple of datacenters, one in Montreal and another in Brossard, with a fully virtualized Active Directory. One morning for whatever reason your supervisor was a little off his game – maybe it was too much wine the night before, or perhaps he had a heaping of bad poutine at lunch, but when asked to disable and enable certain players directory accounts after a blockbuster trade, he had a slip up. Sure, he disabled the “psubban” account of the outgoing player as he was asked to, however in the process of creating the new “swebber” account, somehow he ended up deleting Andrei Markov’s account (amarkov).
It wasn’t until Andrei showed up for practice that morning that anyone noticed – Andrei attempted to log in and quickly realized that something was up. When the helpdesk ticket finally made its way to to your supervisors desk he knew immediately what had happened and quickly called upon you to help out. “No worries”, you said, “We’re protecting that server with Nakivo!”
How can Nakivo help you?
Thankfully you had already setup a backup job which processes a domain controller belonging to the canadiens.local domain, the same domain the user was accidentally deleted from. We won’t go into the nitty-gritty details of how to setup the backup job here, as this post focuses solely on the recovery, but we have covered it in detail in another post if you’d like to check it out. But instead we’ll go through the steps for us to restore Andrei’s account – The first thing we need to do is fire up his browser and log into Nakivo Backup and Replication. After logging into the application, simply selecting ‘Microsoft Active Directory objects’ under the ‘Recover’ menu kicks off the process (shown below).
The next step is quite simply and pretty self explanatory – we simply need to select the backup of our domain controller, in our case its named MSDC, and then select a desired restore point to restore from. As shown below we also have the option to ‘Automatically locate application databases’, which is checked by default. If we happened to know the exact location of the MS AD database then we could uncheck this an specify the path, and in turn maybe save a little time as Nakivo wouldn’t need to scan for the ntis.dit file. Honestly though, the amount of time it takes Nakivo to locate the Active Directory database is trivial, so let’s leave this checked, and click ‘Next’.
Nakivo will now take a moment to load the desired restore point and display it to us. The amount of time this takes greatly depends on the size of your Active Directory infrastructure. Canadiens.local is relatively small, and took only a few seconds to load – but before we move on to the next step it’s good to go over what is happening behind the scenes here. Nakivo Backup & Replication is actually scanning and mounting the server directly from within the compressed and deduplicated backup file – at no time does it perform a full recovery of the VM itself, saving us valuable time as we only need to restore that one individual object. As shown below we are presented with a screen on which we can browse through the entire Active Directory infrastructure and find the object we’d like to restore. It should be noted here that Nakivo supports object-level recovery for not just users, but containers and groups as well – so if it was an Organization Unit or Security Group that was deleted we would be able to restore it in the same manner. Next we select the object by simply clicking the checkbox beside it, and then click ‘Download Selected’. Alternatively we could click ‘Forward Selected’ to have Nakivo email out the ldif files to be used for import. At this point we will have a couple or Recovery settings we can specify; User will be disabled – will restore the user with the account disabled or User must change password at next logon – Nakivo automatically generates a new password for the restored user, and sets the ‘Change password on next logon’ flag in AD. Any password Nakivo generates will be stored in an included ‘Passwords.txt’ file added to our download.
After downloading the recovery bundle (should come in a .zip format) we can now get started on restoring Andrei Markov’s account back into the canadiens.local domain. We does this by first extracting the bundle and copying the extracted folder back to his domain controller. Since we are importing a user object back into Active Directory we need to have ldaps, or certification services enabled and configured on the domain controller. Thankfully the canadiens.local domain is already setup this way, however if we need to implement ldaps there is a great post here on how to go about it. Once we are back on the domain controller console we can simply open up an administrative command prompt and run the following command…
ldifde –I –t 636 –f filename –j logfolder <- where filename is the path the the downloaded ldif from Nakivo and logfolder is a path for import logs to be placed.
We can see a screenshot below of the before and after shots of the canadiens.local domain, with the after showing that Andrei Markov’s account has indeed been restored.
 |
 |
With that you can now breathe easy as Andrei’s account is fully restored back into Active Directory, including all of his user attributes, group memberships, etc. Honestly, it’s as if it was never deleted! This whole process moves very quickly within Nakivo, honestly, within minutes – and when the time comes where you need to do a restore, especially one revolving around user access, time is most certainly of the essence. Nakivo could certainly shave even more time off this process by implementing some way to automate the ldif import, or import directly back into the production VM – but honestly, the simplicity of this whole process far outshines the fact that it needs to be manually imported. For now, you and your supervisor can get back to what matters most; the quest for Lord Stanley.
If you would like to learn more about Nakivo’s Instant Object Recovery for Active Directory or any other feature they offer I highly recommend checking out their help center here, where you can find items such as their knowledge base, release notes, and a very well written user guide. Also if you want to check it out for yourself you can get a full featured trial here, or if you are a VMUG member, VCP, or vExpert why not grab a free NFR license to tinker with! If that isn’t enough options for you Nakivo also offers a fully featured free edition – yes, all of the same features of their premium paid versions, just limited to a couple VMs. Thanks for reading!
