Considerations and Limitations

To be able to explore and recover necessary items within the Active Directory database files, make sure that you have a transactionally consistent backup of your Active Directory Domain Services server (a domain controller) created successfully. (For details, see the "Transaction Consistency" and "Enable Application-Aware Image Processing and Indexing" sections of Veeam Backup & Replication User Guide.) When planning for Active Directory objects restore, please be aware of the considerations and limitation described below.

The following logic is implemented in the Active Directory objects recovery process (except for Group Policy objects described later in this topic):

• If a tombstone object exists in the target Active Directory, Veeam will use this object for recovery. This will allow you to restore security attribute values including objectSID and objectGUID for recovered objects, which is especially important for security principals (including User, Computer, inetOrgPerson and Group objects).

• If no tombstone object exists in the target Active Directory, Veeam will create a new object during the recovery process and set all attributes to the same values as in corresponding object in the backup. However, these attributes (including security) will be new, which may result in losing access rights.

To read more about tombstone objects, see this Microsoft article.

Also, consider the following when planning AD objects restore:

• Veeam Explorer for Microsoft Active Directory does not support restore via PSDirect, VIX, or Sphere API.
• Restore of Microsoft Server 2003 databases is not supported when using Veeam Explorer for Microsoft Active Directory that is installed on Microsoft Windows Server 2016 or Microsoft Windows 10.

• Always use backups that are newer than the tombstone lifetime interval for Active Directory forest.

• When you move an object from one domain to another within a forest (for example, using the Movetree.exe utility or any 3rd party tool), no tombstone for this object will remain in the source Active Directory. Thus, such an object cannot be fully recovered to the original domain.
• Consider that when Group Policy objects are restored from the backup, both Active Directory data (storing Group Policy Containers) and %Sysvol% data (storing Group Policy Templates) is involved. Therefore, for successful restore data should be consistent in these two locations. Restore logic is implemented as follows: existing Group Policy objects are deleted from target, and new ones from the backup are written there.
• Link attributes without the corresponding back link to deleted objects are not restored, if both deleted objects and links are restored in a single restore operation. To work around, you will need to perform the restore once again.

In case you want to restore Active Directory Domain Services server as a whole, the recommendations provided in the series of Veeam blog posts at https://www.veeam.com/blog/how-to-recover-a-domain-controller-best-practices-for-ad-protection.html can be helpful.