Restrictions and limitations when restoring Active Directory objects

Edit online

There are some restrictions and limitations to be aware of when restoring Active Directory objects.

Understand the following restrictions before restoring objects:

Do not restore the Active Directory as part of a system-state restore operation, unless it is intended to be used for a disaster recovery-level restore operation of the full Active Directory. This type of restore operation requires the Active Directory Server to be stopped and restarted.
You cannot perform a point-in-time restore of tombstone objects. You can perform a point-in-time restore of Active Directory objects that are backed up to the server.
You cannot restore Active Directory objects from backup sets.

Understand the following limitations before restoring objects:

Restoring Active Directory objects from the IBM® Storage Protect server requires temporary space on your local hard disk drive. You can use the stagingdirectory option to specify a directory on your local hard disk for storing temporary data from the server. Depending on the size of the temporary data, network bandwidth, and both client and server performance, this operation can take anywhere from 20 seconds to over an hour. There might be a delay in refreshing the Restore window when displaying the Active Directory tree.
User passwords cannot be restored by default. A restored user object is disabled until the administrator resets the password and re-enables the account. Also, if an account was deleted from the domain and is then restored by the backup-archive client, it must be manually joined to the domain after the restore operation. Otherwise, users on the target computer cannot log on to the domain.
In order to have a user or a computer object fully operational after restore, you must modify schema attribute Unicode-Pwd as described in Preserve attributes in tombstone objects.
The Active Directory schema is not recreated when the Active Directory object is restored. If the schema was modified after the backup, the restored object might no longer be compatible with the new schema, and some Active Directory object attributes might no longer be valid. The client issues a warning message if some attributes cannot be restored.
Group Policy Objects and their links to organizational units (OU) cannot be restored.
Local policies for restored Active Directory objects are not restored.
When you restore an object from the IBM Storage Protect server, if the target object already exists in the Active Directory and you replace it with its backup version, the object is not deleted and recreated. The existing object is used as a base, and its attributes are overwritten by the backup version. Some attributes, such as the GUID and the SID, stay with the existing object and are not overwritten by the backup version.
If there are multiple tombstone objects for the same container, reanimate them from the backup-archive client command line using the object GUID, in which case the command-line client only reanimates the container object and not its children. In the backup-archive client GUI, the entire container can be selected to reanimate.
When you restore an object from the IBM Storage Protect server, if the live Active Directory object exists and has the prevent deletion bit on, the client can modify the attributes of the object. However, if there is a tombstone object of the same name but a different object GUID, the Directory Services returns the access denied error.
When you restore an object from the IBM Storage Protect server and the container of the object has been renamed, the client recreates the container using the original name at the time of the backup. When restoring a tombstone object, the client restores it to the renamed container because the lastKnownParent attribute of the tombstone object has been updated to reflect the new container name.