User manual

210 Copyright © Acronis International GmbH, 2002-2016
A USN rollback is highly probable if any of the following is true:
 A domain controller was recovered partially: not all disks or volumes were recovered or only the
Active Directory database was recovered.
 A domain controller was recovered from a backup created without VSS. For example, the backup
was created by using bootable media or the Use VSS option (p. 97) was disabled or the VSS
provider malfunctioned.
The following information will help you avoid a USN rollback by taking a few simple steps.
Replication and USNs
Active Directory data is constantly replicated between the domain controllers. At any given moment,
the same Active Directory object may have a newer version on one domain controller and an older
version on another. To prevent conflicts and loss of information, Active Directory tracks object
versions on each domain controller and replaces the outdated versions with the up-to-date version.
To track object versions, Active Directory uses numbers called Update Sequence Numbers (USNs).
Newer versions of Active Directory objects correspond to higher USNs. Each domain controller keeps
the USNs of all other domain controllers.
USN rollback
After you perform a nonauthoritative restore of a domain controller or of its database, the current
USN of that domain controller is replaced by the old (lower) USN from the backup. But the other
domain controllers are not aware of this change. They still keep the latest known (higher) USN of that
domain controller.
As a result, the following issues occur:
 The recovered domain controller reuses older USNs for new objects; it starts with the old USN
from the backup.
 The other domain controllers do not replicate the new objects from the recovered domain
controller as long as its USN remains lower than the one they are aware of.
 Active Directory starts having different objects that correspond to the same USN, i.e. becomes
inconsistent. This situation is called a USN rollback.
To avoid a USN rollback, you need to notify the domain controller about the fact that it has been
recovered.
To avoid a USN rollback
1. Immediately after recovering a domain controller or its database, boot the recovered domain
controller and press F8 during startup.
2. On the Advanced Boot Options screen, select Directory Services Restore Mode, and log on to
Directory Services Restore Mode (DSRM).
3. Open Registry Editor, and then expand the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
4. In that registry key, examine the DSA Previous Restore Count value. If this value is present, write
down its setting. Do not add the value if it is absent.
5. Add the following value to that registry key:
 Value type: DWORD (32-bit) Value
 Value name: Database restored from backup
 Value data: 1