How to Perform an Authoritative Restore of Active Directory Objects

Applies to: Windows Server 2025 / 2022 / 2019 / 2016 / 2012 R2 / 2012 / 2008 R2 / 2008 / 2003 R2 / 2003

An authoritative restore is used when you need to recover deleted or unwantedly changed Active Directory objects from backup and make the restored copy win replication against the copies held by other domain controllers.

The original version of this article described this as an “authoritative DC restore.” More precisely, the domain controller is restored from backup and selected Active Directory objects or subtrees are then marked as authoritative with ntdsutil.

In This Article

• 1. Check Active Directory Recycle Bin First
• 2. When Authoritative Restore Is Needed
• 3. Restore the Domain Controller from Backup
• 4. Mark the Object as Authoritative
• 5. Restart and Validate Replication
• 6. Key Takeaways

1. Check Active Directory Recycle Bin First

If Active Directory Recycle Bin was enabled before the object was deleted, use it instead of restoring a domain controller from backup. Recycle Bin can restore deleted objects together with important attributes such as group memberships.

Authoritative restore is mainly relevant when the required object cannot be recovered through Recycle Bin or when a backup-based recovery is specifically required.

2. When Authoritative Restore Is Needed

A normal system-state restore of a domain controller is nonauthoritative. After the restored DC starts and replication resumes, newer data from replication partners normally updates the restored database.

For a deleted object, that would cause the deletion to replicate back to the restored DC. An authoritative restore increases the version of the selected object or subtree so that the restored copy is treated as newer and replicates outward to other domain controllers.

3. Restore the Domain Controller from Backup

1. Select a valid system-state or supported domain controller backup that contains the required object.
2. Start the domain controller in Directory Services Restore Mode (DSRM).
3. Restore Active Directory using Windows Server Backup or the supported backup application.
4. Do not start the DC normally yet.

The restore operation itself is nonauthoritative at this stage. The next step determines which object or container should become authoritative.

4. Mark the Object as Authoritative

Use ntdsutil before restarting the domain controller in normal mode.

To restore a single object:

ntdsutil "authoritative restore" "restore object cn=JohnDoe,ou=Users,dc=contoso,dc=com" q q

To restore an OU and the objects below it:

ntdsutil "authoritative restore" "restore subtree ou=Sales,dc=contoso,dc=com" q q

Use the lowest possible object or container in the directory tree. Restoring an unnecessarily large subtree can roll back attributes and changes that are unrelated to the incident.

5. Restart and Validate Replication

Restart the domain controller normally and allow Active Directory replication to resume. Then verify that the restored objects replicate to the other domain controllers.

repadmin /replsummary
repadmin /showrepl

Also validate the restored object itself, including group membership, permissions, and other attributes that matter to the application or user.

Note: Authoritative restore of Active Directory objects is different from an authoritative SYSVOL restore. SYSVOL recovery uses separate FRS or DFSR procedures and should not be mixed with this object-recovery process.

6. Key Takeaways

• Use Active Directory Recycle Bin first when it is available for the deleted object.
• A normal domain controller restore is nonauthoritative by default.
• Use ntdsutil authoritative restore to make selected objects or subtrees win replication.
• Restore the smallest possible object or container to reduce unnecessary rollback.
• Validate both replication health and the recovered object after the DC returns to service.

References

• Microsoft Learn – Restore deleted user accounts and groups in Active Directory
• Microsoft Learn – Active Directory Recycle Bin