Keenan s brief Guide to AD Snapshots

Transcription

1 Keenan s brief Guide to AD Snapshots Author: Keenan Buck Solutions Architect 1 P a g e K e e n a n B u c k

2 Disclaimer CTCS expressly disclaims any liability, which may arise in any manner and to any party through publication of this document. Any party acting for or failing to act as a result of this document assumes full responsibility for any use made of the information contained herein. This publication does not constitute an endorsement of the product or products described. The configuration or configurations tested or described, may or may not be the only available solution. 2 P a g e K e e n a n B u c k

3 Document Control Version History Version Date Author Comments V0.1 21/07/2011 Keenan Buck Document Ownership and Approval Document Owner Keenan Buck Solutions Architect Document Authorisation Document Distribution Name Title Enquiries Any enquiries relating to this document should be directed to: Keenan Buck Phone: P a g e K e e n a n B u c k

4 Table of Contents Disclaimer... 2 Document Control... 3 Background... 5 Process 1 Creating a snapshot... 6 Process 2 Mounting your Active Directory Snapshot... 6 Process 3 Connecting your Active Directory snapshot... 7 Process 4 Disconnecting your Active Directory snapshot... 8 Process 5 Unmounting your Active Directory snapshot... 9 Using Active Directory Users and Computers DSA.msc Using ADSIEDIT.msc Using CSVDE.exe Using LDIFDE.exe Restoring Information P a g e K e e n a n B u c k

5 Background Windows Server 2008 has a new feature allowing administrators to create snapshots of the Active Directory database for offline use. With AD snapshots you can mount a backup of AD DS under a different set of ports and have read-only access to your backups through LDAP. There are quite a few scenarios for using AD snapshots. For example, if someone has changed properties of AD objects and you need to revert to their previous values, you can mount a copy of a previous snapshot to an alternate port and easily export the required attributes for every object that was changed. These values can then be imported into the running instance of AD DS. You can also restore deleted objects or simply view objects for diagnostic purposes. AD snapshots, when mounted and connected to, allow you to see how the AD Database looked like at the moment of the snapshot creation, what objects existed and other type of information. However, out of the box, it does not allow you to move or copy items or information from the snapshot to the live database. In order to do that you will need to manually export the relevant objects or attributes from the snapshot, and manually import them back to the live AD database. Overall, the process of creating and using the AD snapshot involves using the following procedure: 1. Either manually create or schedule a task that regularly runs NTDSUTIL to take snapshots of the volume that contains the AD DS database. 2. Run NTDSUTIL to list the snapshots that are available, and mount the snapshot that you want to view. 3. Run DSAMAIN to expose the snapshot volume as an LDAP server. I have listed out this process as follows: Process 1 Creating a snapshot Process 2 Mounting your Active Directory Snapshot Process 3 connecting your Active Directory snapshot Process 4 disconnecting your Active Directory snapshot Process 5 Unmounting your Active Directory snapshot This is a lot better than taking down the DC, rebooting into DSRM, restoring the System State from a backup, and then exporting the attributes. 5 P a g e K e e n a n B u c k

6 Process 1 Creating a snapshot Open CMD.exe, Ntdsutil, activate instance ntds, snapshot, create, list all. Process 2 Mounting your Active Directory Snapshot Before connecting to the snapshot we need to mount it. By looking at the results of the List All command in above step, identify the snapshot that you wish to mount, and note the number next to it. Type Ntdsutil, Snapshot, List all, Mount 2. The snapshot gets mounted to c:\$snap_ _volumec$. Now you can refer this path to see the objects in these snapshots. 6 P a g e K e e n a n B u c k

7 Process 3 Connecting your Active Directory snapshot In order to connect to the AD snapshot you've mounted you will need to use the DSAMAIN command. DSAMAIN is a command-line tool that is built into Windows Server It is available if you have the Active Directory Domain Services (AD DS) or Active Directory Lightweight Directory Services (AD LDS) server role installed. After using DSAMAIN to expose the information inside the AD snapshot, you can use any GUI tool that can connect to the specified port, tools such as Active Directory Users and Computers (DSA.msc), ADSIEDIT.msc, LDP.exe or others. You can also connect to it by using command line tools such as LDIFDE or CSVDE, tools that allow you to export information from that database. dsamain -dbpath " c:\$snap_ _volumec$\windows\ntds\ntds.dit" - ldapport The above command will allow you to access the database using port P a g e K e e n a n B u c k

8 Now you can use LDP.exe tool to connect to this mounted instance. Process 4 Disconnecting your Active Directory snapshot In order to disconnect from the AD snapshot all you need to do is to type CTRL+C at the DSAMAIN command prompt window. You'll get a message indicating that the DS shut down successfully. 8 P a g e K e e n a n B u c k

9 Process 5 Unmounting your Active Directory snapshot Run command, Ntdsutil, Snapshot, List all, Unmount 2. 9 P a g e K e e n a n B u c k

10 These snapshots can be stored on the local hard disk of the Domain Controller (DC), or moved to an offline type of storage In all the following examples we will use port I have also created an OU called "Dev" in my test domain, and placed a few users in it. I've created a snapshot, and afterwards I have made some changes on the Dev users in the live AD. Using Active Directory Users and Computers DSA.msc Probably the easiest to use to visually see most of the needed information found in the snapshot. The benefit of using this tool in Windows Server 2008 is the fact that is now has some of ADSIEDIT's functionality built in, allowing you to view almost all the attributes for objects in the AD Domain partition. To use DSA.msc on an AD snapshot follow these steps: 1. Log on as a member of the Domain Admins group to the Windows Server 2008 R2 Domain Controller where you've mounted the AD snapshot. 2. Click Start, in the search box type DSA.msc and press Enter. 3. You'll see the live AD. Feel free to browse it. We'll use this instance of DSA.msc as a reference to the snapshot. 4. Repeat step #2. 5. In the second instance of DSA.msc, right-click on the domain name and select Change Domain Controller. 10 P a g e K e e n a n B u c k

11 6. In the Change Directory Server window, click on the <Type a Directory Server name[:port] here> line, and when it turns to a writable text, change it to the name of the server and port number you've used in DSAMAIN. In our case Server1: When you press Enter, the application will perform a check on the specified target, and if all is ok, you'll see the line turn "Online". Press Ok. 8. Open the 2 instances of DSA.msc side by side, you'll see that the second one is actually read-only. You cannot create or change any object. Even though the X button seems to be still available for object deletion, it won't work. 11 P a g e K e e n a n B u c k

12 9. If you open the properties window for a user ("isuser1" from the Anchor Users\Corporate & Shared Services\Information Services OU in our case) you'll see the attribute values in the snapshot version as grayed out. You can use this information to manually edit values in the live AD database, based upon the values you see in the snapshot version. 10. When done, close the second instance of DSA.msc. 12 P a g e K e e n a n B u c k

13 Using ADSIEDIT.msc The major benefit of ADSIEDIT.msc over DSA.msc is the fact that it can be used to connect to other AD partitions the Configuration partition and the Schema partition, as well as to the Domain partition. It too allows for graphical browsing for objects and attributes. Note: ADSIEDIT.msc is now included with Windows Server To use ADSIEDIT.msc on an AD snapshot follow these steps: 1. Log on as a member of the Domain Admins group to the Windows Server 2008 Domain Controller where you've mounted the AD snapshot. 2. Click Start, in the search box type ADSIEDIT.msc and press Enter. 3. In the ADSIEDIT window, right-click ADSI Edit and select Connect To. 13 P a g e K e e n a n B u c k

14 4. In the Connection Settings window, enter the name of the server and port number you've used in DSAMAIN. In our case WIN2008-DC1: When done, press Ok. 5. If all is ok, you'll see the AD snapshot information appear as a hierarchical tree on the left-hand side pane. Feel free to browse the tree and go to the right OU and object you need to look at. Note that here too, the information is read-only. 6. When done, close the ADSIEDIT.msc. 14 P a g e K e e n a n B u c k

15 As mentioned above, by using ADSIEDIT.msc you can see more than the Default naming context the AD Domain partition. You can use it to also connect to the Configuration partition and the Schema partition. Manually editing objects or restring them back to the Live Active Directory In this example and for all the following examples I will use port I have also created an OU called "Dev" in my test domain which is named ctcslab. I have placed a few users in it. I have also created a snapshot, and afterwards I have made some changes on the Dev users in the live AD. While both CSVDE and LDIFDE have almost the same syntax, here are some details about the relevant switches we're going to use for these examples. Note that there are many other options, however they are beyond the scope of this article. The -f switch specifies the filename. For example: -f c:'test.csv or -f c:'test.ldf. The -s switch specifies the server to connect to. For example: -s WIN2008-dc1. The t switch specifies the LDAP port to use. For example: -t The -d switch allows you to focus the export on one particular object or OU. For example, exporting just the "Dev" OU and not the entire Active Directory domain: -d "ou=dev,dc=ctcslab,dc=local", or exporting the user "James" in the "Dev" OU: -d "cn=james,ou=dev,dc=ctcslab,dc=local". The -r switch allows you to filter based upon object class of any other LDAP-type filter. For example: -r "(objectclass=user)". The -l switch (lower case "L") specifies the attributes to export. For example: -l telephonenumber. 15 P a g e K e e n a n B u c k

16 Using CSVDE.exe This tool is a command line tool that allows exporting of virtually any object or attribute from the AD database (or snapshot in this case). CSVDE.exe exports the data into CSV-based (Comma Separated Value) files. This makes it easy for usage in Excel or with a text editor. CSVDE does not work with passwords, so you cannot use it to export passwords from the database. Also, CSVDE does not allow the editing or deleting of existing objects, even though that is not a concern when exporting objects (unless you plan to import that information back to the live AD). To use CSVDE.exe on an AD snapshot follow these steps: 1. Log on as a member of the Domain Admins group to the Windows Server 2008 Domain Controller where you've mounted the AD snapshot. 2. Click Start, in the search box type CMD and press Enter. First, we'll export the data from the live AD database by running this command: C:'Users'Administrator>csvde -d "cn=james,ou=dev,dc=ctcslab,dc=local" -r "(objectclass=user)" -l telephonenumber -f c:'test.csv Connecting to "(null)" Logging in as current user using SSPI Exporting directory to file c:'test.csv Searching for entries... Writing out entries. Export Completed. Post-processing in progress... 1 entries exported The command has completed successfully Next, we will use the same command, this time to connect to the AD snapshot at port 10389: C:'Users'Administrator>csvde -s WIN2008-dc1 -t d "cn=james,ou=dev,dc=ctcslab,dc=local" -r "(objectclass=user)" -l telephonenumber -f c:'testsnap.csv Connecting to "WIN2008-dc1" Logging in as current user using SSPI 16 P a g e K e e n a n B u c k

17 Exporting directory to file c:'testsnap.csv Searching for entries... Writing out entries Export Completed. Post-processing in progress... 1 entries exported The command has completed successfully Looking at the resulting files, we see the difference in the information: See links below for detailed information about the usage of this command. Using LDIFDE.exe Like CSVDE.exe, this tool is a command line tool that allows exporting of virtually any object or attribute from the AD database (or snapshot in this case). LDIFDE.exe exports the data into LDIF-based (LDAP Data Interchange Format) files. LDIF files are a cross-platform standard. This provides a method to populate Active Directory with data from other directory services. Unlike CSV files, LDIF files cannot be used in Excel, but can be opened with a text editor. One of the major benefits of LDIFDE over CSVDE is that you can modify existing objects and even delete objects with LDIFDE. However, LDIFDE doesn t support changing Group Membership, and like CSVDE, it does not work with passwords, so you cannot use it to export passwords from the database. To use LDP.exe on an AD snapshot follow these steps: 1. Log on as a member of the Domain Admins group to the Windows Server 2008 Domain Controller where you've mounted the AD snapshot. 2. Click Start, in the search box type CMD and press Enter. 17 P a g e K e e n a n B u c k

18 First, we will export the data from the live AD database by running this command: C:'Users'Administrator>ldifde -d "cn=james,ou=dev,dc=ctcslab,dc=local" -r "(objectclass=user)" -l telephonenumber -f c:'test.ldf Connecting to "WIN2008-DC1.CtcsLab.local" Logging in as current user using SSPI Exporting directory to file c:'test.ldf Searching for entries... Writing out entries. 1 entries exported The command has completed successfully Next, we will use the same command, this time to connect to the AD snapshot at port 10389: C:'Users'Administrator>ldifde -s WIN2008-dc1 -t d "cn=james,ou=dev,dc=ctcslab,dc=local" -r "(objectclass=user)" -l telephonenumber -f c:'testsnap.ldf Connecting to "WIN2008-dc1" Logging in as current user using SSPI Exporting directory to file c:'testsnap.ldf Searching for entries... Writing out entries. 1 entries exported The command has completed successfully 18 P a g e K e e n a n B u c k

19 Looking at the resulting files, we see the difference in the information: Restoring Information You can take the information found in your exported files and manually insert them back to the Active Directory live database. 19 P a g e K e e n a n B u c k

20 END 20 P a g e K e e n a n B u c k