Active Directory must be restored offline. The system must be rebooted in Directory Services Restore mode. In this mode, the operating system is running without Active Directory and all user validation occurs through the Security Accounts Manager (SAM) in the registry. To restore Active Directory, use the credentials of a local administrator on the domain controller that is restored.
The caller of the restore functions must have the SE_RESTORE_NAME privilege. Use the DsSetAuthIdentity function to set the security context under which the directory backup and restore functions are called.
Be aware that when you restore Active Directory, you must also restore the other system state components.
To restore Active Directory, perform the following steps
After a restore in Directory Services Restore mode, the domain controller should be rebooted in normal mode. When the directory service starts, the domain controller will perform the normal consistency check and the restored directory will then be online.
Be aware that restoring an Active Directory is always a two-part operation. First, restore the database to a time when the backup was taken and not beyond. Second, replicate the directory, where the newly restored DSA replicates post-backup updates from other DSAs in the domain and enterprise forest.
Any computer running on Windows® 2000 or Windows Server 2003 family that contains a replica of the directory service is a domain controller.
The DsRestoreRegister function adds data to the registry that must survive the registry restoration process for the Active Directory restoration to work correctly. To ensure this registry data is preserved, restore Active Directory with the DsRestore* functions prior to rebooting the computer after the RegReplaceKey function has been called. This process works because RegReplaceKey does not actually replace the registry hive until the computer is rebooted and the registry data added by the DsRestoreRegister function is specifically excluded from being replaced during a registry restore operation.