Unable to restore AD objects - case 01015253

[extremesanity]

My process:

- Right click on VM, Restore > Active direc. objects from backup
- Choose last restore point > next > next > finish
- Wait for mounting, appears to complete successfully

At this point the Veeam Explorer for AD window is blank, no AD database is mounted.

I attempt to mount c:\windows\ntds\ntdist.dit manually via Add Database, but this fails with "failed to open database...jeterror - 1019,jet_errpagenotinitialized,blank database page.

I am on all version 8, and have applied the recent patch 2 update.

What am I missing, not doing right?

[foggy]

Lucas, I'd check the job session log corresponding to the selected restore point for some warnings or errors.

[extremesanity]

I assume you mean the backup job session?

I monitor job status extremely closely. There are no errors in the backup job for this VM or the job. I also tried other restore points.

[foggy]

Then let's wait for what our engineers could tell after reviewing the log files.

[extremesanity]

Looks like AD database corruption is the root cause of not being able to do an object level restore. Surprised the heck out of me since there are no symptoms and all replication, event logs, and dcdiags are coming back green.

For anyone coming across this, this is how you check:

#Stop “Active Directory Domain Services” service
powershell > Stop-Service ntds -force

#The following command verifies the “checksum” of the database:
ntdsutil
activate instance ntds
files
checksum

#run file recovery to roll up any transactions into ntds.dit before running integrity check
file maintenance: recover

#semantic database analysis
ntdsutil.exe: semantic database analysis
semantic checker: go

#integrity test (takes a long time, 2-4 hours - not really needed unless you just want to be extremely sure)
ntdsutil
activate instance ntds
files
integrity

Start the “Active Directory Domain Services” (verify if the “dfs replication”,”intersite messaging”,”kdc” services are restarted too)
powershell > Start-Service ntds

[extremesanity]

Additionally, another procedure that doesn't require you taking down AD:

1. Start a file-level restore of your domain controller.
2. Copy the following files from the FLR to a local directory (such as ??c:\temp):
The entire contents of the c:\windows\ntds folder
C:\windows\system32\esentutl.exe
C:\windows\system32\esent.dll
3. Close the FLR session.
4. Start Veeam Explorer for Active Directory from the Start Menu (not from the Veeam console)
5. In VEAD, click 'Add Database', and browse to the restored ntds.dit file. Loading this database should fail as normal, we're just doing this to prepare the dit file for the next step, and to get some logging.
6. Close VEAD.
7. Open an administrator command line. CD to the directory where you restored files (c:\temp in this example). Run this command:
esentutl /g ntds.dit
8. There will be output both in the command line and in a file named ntds.INTEG.RAW.