Exam AZ-801 topic 3 question 9 discussion

Two requirements make this proposed answer incorrect. First, you are being asked to minimize data loss. So restoring from 2300 the previous night as opposed to an hour old isn't minimizing data loss. Second, you're asked to get this fixed as quickly as possible. If you've ever done a system state restore on a DC with a lot of object, it's takes a long time. So: Boot into DSRM Authoritative restore Boot normally Is the only answer that makes sense

Correct Answers

Start DC1 in Directory Services Restore mode Perform a system state restore on DC1 Preform an authoritative restore on DC1

I think the answers are correct https://itingredients.com/perform-authoritative-restore-active-directory-objects-2012-r2/

Agree with arnitjoe

Case 1 : I start DC1 Directory Service Restore Mode , perform a system state restore on DC1 , perform an authoritative restore on DC1 . Case 2 : I start DC1 Directory Service Restore Mode, perform authoritative restore , reboot normally. ChatGPT : If the primary goal is to recover the user account details as quickly as possible and minimize data loss, case 2 would be the preferred choice. In case 2, you directly perform an authoritative restore targeting the specific objects or data (user account details) that need to be recovered. This approach skips the system state restore, which can be a time-consuming process, especially if the domain controller has a large database or additional components. By focusing on the authoritative restore alone, you can quickly restore the specific data you need without waiting for the entire system state restore to complete. This minimizes downtime and reduces the risk of potential issues that could arise during the system state restore process.

Why not recover it from AD recycle bin? I did so many times it is the fastest way.

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732211(v=ws.11) Restores domain controllers to a specific point in time https://www.itprotoday.com/active-directory/how-can-i-perform-authoritative-restoration-active-directory-ad-windows-server-2003 From the Windows Advanced Options Menu, select Directory Services Restore Mode Select the Restore option, then select the media where the backup is stored and ensure that the System State To access the authoritative restore mode, type ntdsutil: authoritative restore Answer is correct

The given answer is correct. https://www.serverbrain.org/active-directory-2008/authoritative-restore-of-active-directory-domain-services.html

Contactfornitish has a point- so autorative restore is replication not backup- you have to start the server in regular mode to do a d4 burglags (or equivalent)- so start the DC normally would come before the current last step of the question- so my contention is there is really 4 steps - or this is really asking only for the restore steps- the replication issue not be considered here- strictly speaking - be aware of this for testing purposes

Given answer is correct, check this guide out: https://www.itprotoday.com/active-directory/how-can-i-perform-authoritative-restoration-active-directory-ad-windows-server-2003

Why would you need to perform a system state restore? That would set your recovery point back to 23:00 the previous day, instead of 8:00 which is only an hour before the attribute was changed. The requirements state: Recover the user account details as quickly as possible. The solution must minimize data loss.

Don't think it's correct Since changes done on another DC have incremented the number, without authoritative restore it won't work. For that, you need to start the unchanged DC in directory restore mode, perform restore and then start normally so that changes get synced across. System state restore has no role in this