Active Directory Maintenance, Database Optimization, and Backup

Overview

In this project, I performed several Windows Server maintenance and backup tasks to keep Active Directory healthy and recoverable. The work included cleaning up Active Directory objects left behind by removed domain controllers, checking the Active Directory topology, performing an offline defragmentation and integrity check of the AD database, and creating a System State backup for Active Directory recovery.

Objectives

• Remove leftover Active Directory objects from domain controllers that were forcibly removed or failed.

• Clean up obsolete domain controller objects from Active Directory Sites and Services.

• Check the Active Directory Recycle Bin for deleted objects.

• Defragment and verify the integrity of the Active Directory database.

• Create a System State backup containing Active Directory and other critical system components.

• Improve the maintainability and recoverability of the Windows Server environment.

Configurations

Metadata Cleanup

Metadata cleanup is the process of removing leftover Active Directory objects that belong to domain controllers that were removed incorrectly, for example, after a forced demotion or an unexpected failure. If these objects remain, Active Directory may continue to reference a non-existent domain controller and attempt replication with it, which can cause replication errors and unnecessary overhead.

Remove Force-removed DCs

To remove leftover domain controller objects, I opened Active Directory Users and Computers by running dsa.msc. I navigated to the Domain Controllers organizational unit and located domain controller objects that no longer existed in the environment. These objects can remain after a forced demotion or domain controller failure.

I right-clicked the obsolete domain controller object and selected Delete. This removes the obsolete domain controller object from Active Directory. When deleting a domain controller object in this situation, I first verified that the domain controller was permanently removed and would not be returned to the environment.

AD Sites and Services

To remove the leftovers of domain controllers that were forcibly removed, I opened Active Directory Sites and Services and reviewed the site structure.

I then removed domain controller objects that no longer existed under their respective sites and were no longer part of the Active Directory topology. This helped ensure that the site and replication topology did not contain references to obsolete domain controllers.

Recycle Bin

If the Active Directory Recycle Bin has been enabled, deleted Active Directory objects can be found and restored from the Recycle Bin during their retention period.

I also checked the Active Directory Recycle Bin to verify whether any deleted objects were available for recovery. The Recycle Bin can be accessed from Windows Administrative Tools > Active Directory Administrative Center.

Database Defragmentation

Similar to other databases, the Active Directory database can become internally fragmented over time as objects are created, modified, and deleted. Offline defragmentation compacts the database and can reduce its file size and improve database efficiency.

Since there had been many changes to the Active Directory database over the previous year, I decided to perform an offline defragmentation of the NTDS.dit database.

To perform the defragmentation, I opened Command Prompt and ran the following commands:

C:\Users\Administrator>ntdsutil

ntdsutil: active instance ntds

ntdsutil: activate instance ntds

Active instance set to "ntds".

ntdsutil: files

Service "NTDS" is running. Stop the service before binding to this Active Directory database.

ntdsutil:

Since the Active Directory Domain Services service was running, I needed to stop it before continuing. I opened the Services console by running services.msc, located Active Directory Domain Services, and stopped the service.

Then I returned to the command line and entered the remaining commands:

ntdsutil: files

file maintenance: compact to c:\

Initiating DEFRAGMENTATION mode...

     Source Database: C:\Windows\NTDS\ntds.dit

     Target Database: c:\ntds.dit

               Defragmentation  Status (Complete)

          0 10   20   30   40   50   60   70   80   90  100

          |----|----|----|----|----|----|----|----|----|----|

          ...................................................

It is recommended that you immediately perform a full backup

of this database. If you restore a backup made before the

defragmentation, the database will be rolled back to the state

it was in at the time of that backup.

Compaction is successful. You need to:

   copy "c:\ntds.*" "C:\Windows\NTDS"

and delete the old log files:

   del C:\Windows\NTDS\*.log

Then I performed an integrity check to make sure that the Active Directory database was structurally healthy and could be read successfully.

file maintenance: integrity

Doing Integrity Check for db: C:\Windows\NTDS\ntds.dit.

Checking database integrity.

                  Scanning  Status (Complete)

          0 10   20   30   40   50   60   70   80   90  100

          |----|----|----|----|----|----|----|----|----|----|

          ...................................................

Integrity check successful.

It is recommended you run semantic database analysis

to ensure semantic database consistency as well.

file maintenance: quit

ntdsutil: quit

The integrity check completed successfully, confirming that the database passed the basic database integrity check.

Then I used the following command to remove the old transaction log files:

C:\Users\Administrator>copy c:\ntds.dit c:\windows\ntds\ntds.dit

Overwrite c:\windows\ntds\ntds.dit? (Yes/No/All): yes

     1 file(s) copied.

Then I used the following command to remove the old transaction log files:

C:\Users\Administrator>del c:\windows\ntds\*.log

After completing the process, I restarted the server to bring the defragmented database back online and allow Active Directory Domain Services to start normally.

Backup Windows Server

Active Directory backup is important for disaster recovery and restoring Active Directory data in case of a server failure or other critical issue.

Backup AD

To back up Active Directory on the Windows Server, I followed these steps:

1.   Installed the Windows Server Backup feature from Server Manager > Add Roles and Features > Features > Windows Server Backup.

2.   From Server Manager > Tools, I opened the Windows Server Backup console.

3.   Right-clicked Local Backup and selected Backup Once.

4.   Chose Custom because I wanted to create a smaller backup containing only the required components rather than a full server backup.

5.   Selected System State from the available options. System State backup includes important components required for Active Directory recovery, including the Active Directory database (NTDS.dit), SYSVOL, the registry, and other system components.

6.   Selected the destination drive where I wanted to save the backup and completed the wizard. The backup size depends on the size and configuration of the server and Active Directory environment.

Results

The Active Directory environment was cleaned of obsolete domain controller objects and references left by forcibly removed domain controllers. The Active Directory database was successfully compacted and passed the database integrity check. Finally, a System State backup was created to provide a recovery point for Active Directory and other critical Windows Server components.