Installation and User's Guide

objects). On the Windows Server 2008 server client, you can also restore individualActive Directory objects from system state backups on the Tivoli Storage Managerserver.Related tasks“Restoring Windows system state” on page 170Related reference“Restore Adobjects” on page 620Reanimate tombstone objects or restoring from a systemstate backupTombstone reanimation is a process to restore an object that had been deleted fromthe Active Directory. When an object is deleted from Active Directory, it is notphysically erased, but only marked as deleted. It is then possible to reanimate(restore) the object.When an object is reanimated, not all object attributes are preserved. When anobject becomes a tombstone object, many attributes are automatically stripped fromit, and the stripped attributes are lost. It is possible, however, to change the ActiveDirectory schema so that more attributes are preserved when the object is deleted.User-group links are not preserved in tombstones. For example, when a user objectis reanimated, the user account is not a member of any group. All of thisinformation must be recreated manually by the Active Directory administrator.Important: Tombstone object reanimation is the only method available on theWindows Server 2003 domain controller.When an Active Directory object is restored from a system state backup on theTivoli Storage Manager server, virtually all of its attributes and its groupmembership are restored. This is the best restore option using a Windows Server2008 domain controller. When an object is restored from the server:vvvvvThe Active Directory database is extracted from a system state backup andrestored into a temporary location.The restored database is opened.Select which objects you want to restore. For each object:– A search for the matching tombstone is performed. The Globally UniqueIdentifier (GUID) of the restored object is used to search for the tombstone.– If the matching tombstone is found, it is reanimated. In this case, the restoredobject retains the original Globally Unique Identifier (GUID) and the SecurityIdentifier (SID).– If the matching tombstone is not found, a new object is created in thedatabase. In this case, the new object has a new GUID and a new SID that aredifferent than the original object.Missing attributes are copied from the backup into the reanimated or recreatedobject. Existing attributes that have been changed since the backup was takenare updated to match the value in the backup. New attributes that have beenadded since the backup was taken are removed.Group membership is restored.Although all attributes that can be set and the group links are recreated, therestored objects might not be immediately available after the restore operation. AnActive Directory administrator might have to manually update the restored objectsChapter 5. Restoring your data 195