Chapter purpose
Tie auditing and recovery together so the organization can answer who changed what, then restore service safely if a mistake or failure occurs.
Learning objectives
- Choose audit events from real investigation questions.
- Capture replication and directory health evidence.
- Explain why replication is not backup.
- Use Recycle Bin and recovery planning appropriately.
Why this matters in a real company
When a privileged group changes unexpectedly or an OU is deleted, logs and tested recovery turn a crisis into a controlled procedure.
6.1 Audit for questions you need to answer
Microsoft publishes baseline and advanced audit recommendations. The correct policy depends on risk, retention and monitoring capacity.
Important questions include who changed privileged group membership, who created or disabled an account, where a logon came from and when a policy changed.
6.2 Collect directory health evidence before disruption
Capture evidence before restarting DCs or forcing replication. A reboot can remove transient clues. Keep clocks synchronized so events from different systems can be correlated.
dcdiag /v
repadmin /replsummary
repadmin /showrepl
Get-ADReplicationFailure -Target * -Scope Forest6.3 Replication is not backup
Multiple DCs provide availability, but a bad deletion or malicious change can replicate. High availability and historical recovery solve different problems.
Microsoft Active Directory Recycle Bin preserves deleted-object attributes when enabled, making accidental-object recovery easier.
6.4 Recovery has several levels
Document which scenario you are facing before selecting a tool. Restoring a whole domain controller for one deleted user is usually the wrong problem definition.
- Object recovery: deleted user/group/OU.
- DC replacement: failed server when other healthy DCs exist.
- Authoritative recovery: selected directory data in appropriate scenarios.
- Forest recovery: severe compromise or corruption affecting the directory as a whole.
Deleted objects, replicated mistakes and recovery scope
A directory deletion is itself a legitimate directory change and can replicate quickly. That is why multiple DCs do not protect against an administrator deleting the wrong OU. Recycle Bin can preserve deleted-object attributes for supported recovery, while backups and forest-recovery procedures handle different classes of failure.
Classify the incident before acting: one deleted user, one failed DC, widespread corruption and forest compromise are not the same recovery problem. Using the biggest restore procedure for the smallest incident adds unnecessary risk.
Evidence before recovery
Record event logs, replication state, role ownership, DNS health and recent changes before emergency action. If a DC is isolated because of suspected compromise, document why and preserve the evidence needed for later investigation.
Recovery is complete only when authentication, DNS service location, SYSVOL, replication and dependent applications work again. A server booting successfully is not the acceptance test.
A production OU is accidentally deleted
The OU contains users and groups and the deletion replicates to all DCs.
Decision: Treat it as object recovery, not a DC failure. Use the supported deleted-object recovery path and verify linked attributes and access.
Evidence: Show restored objects, group memberships, authentication and healthy replication.
Hands-on lab
In an isolated lab, generate an account-management event and recover a deleted test object using approved recovery features.
Troubleshooting exercise
- Restored account exists but access missing: verify group links and permissions.
- One DC was offline for a long period: assess replication safety before returning it.
- Logs rolled over too quickly: increase retention or central collection.
Field checklist
- Audit policy documented.
- Privileged changes monitored.
- AD Recycle Bin state known.
- Backups/recovery plan tested.
- Time synchronization monitored.
- Evidence preserved before major recovery actions.
Current technical references
The supplied PDF books are used as a historical curriculum map. Current implementation guidance is checked against current Microsoft documentation.