USN Rollback
Lately, the only thing I've talked about is Vista. And although there is a lot more, today I would like to discuss something else: USN Rollback.
When talking about backup and restore of Active Directory, a question that I get regularly is: can we restore a Domain Controller from an image?
At first sight you might say: why not?
Restoring a system state backup to get Active Directory back to a previous state, or restoring a disk image you took a few days ago: the end result will be the same.
And that would be true in an environment with only 1 domain controller.
But in most situations there will be multiple DCs and then you will encounter a serious, yet very difficult to troubleshoot, problem: USN Rollback.
When you restore a DC by performing a system state restore, AD will change the database Invocation ID. The Invocation ID identifies the version of the database. After a correct system state restore this ID is reset before AD starts. (Event ID 1587 of source Replication will be logged in the Directory Services event log.)
For the other DCs this indicates that the database version has changed and in response they reset their high-water marks and update the restored DC with changes that occurred after the backup.
If you restore a DC from an image on the other hand, the Invocation ID will not be reset and noone will be aware of the fact that one of the DCs actually rolled back to a previous state. This will lead to inconsistencies in the database, since the restored DC will not get any updates that were taken since the backup and never will.
Why is this?
AD replication is triggered by comparing USNs (Update Sequence Numbers). Every DC has a USN table for every attribute. In that table it keeps track of the highest USN it received for this attribute from a given replication partner. If the current USN on the replication partner is higher than the one in his list, the DC knows that a change has been made and that it still has to copy these changes.
Imagine the following scenario: You have a domain containing 3 domain controllers DC1, DC2 and DC3.
A second problem arises when new objects are now created on DC1.
If you create a new user, that account will be given the next unused USN on DC1: USN 11.
Since DC2 and DC3 think that they already have every update from DC1 up until USN 40 they will not do anything and the new changes are not replicated.
All changes created on DC1 with USNs 11 to 40 will never be available on DC2 and DC3.
In case of a proper system state restore these problems do not arise, since the reset of the Invocation ID informs the replication partners of the restore and causes them to reset their up-to-dateness vector for the restored DC.
A USN rollback can be very difficult to detect, since no errors are logged in the Event Viewer (unless you are running W2003 SP1 or hotfix 875495, then Event ID 2095 is logged).
One way to detect a USN rollback is running the following command on a DC and its replication partners: repadmin /showutdvec.
If the USN for the DC on the replication partners is higher than the one the DC has for itself and no replication errors are reported, you are probably dealing with USN rollback!
Tomorrow: Recovering from USN rollback!
When talking about backup and restore of Active Directory, a question that I get regularly is: can we restore a Domain Controller from an image?
At first sight you might say: why not?
Restoring a system state backup to get Active Directory back to a previous state, or restoring a disk image you took a few days ago: the end result will be the same.
And that would be true in an environment with only 1 domain controller.
But in most situations there will be multiple DCs and then you will encounter a serious, yet very difficult to troubleshoot, problem: USN Rollback.
When you restore a DC by performing a system state restore, AD will change the database Invocation ID. The Invocation ID identifies the version of the database. After a correct system state restore this ID is reset before AD starts. (Event ID 1587 of source Replication will be logged in the Directory Services event log.)
For the other DCs this indicates that the database version has changed and in response they reset their high-water marks and update the restored DC with changes that occurred after the backup.
If you restore a DC from an image on the other hand, the Invocation ID will not be reset and noone will be aware of the fact that one of the DCs actually rolled back to a previous state. This will lead to inconsistencies in the database, since the restored DC will not get any updates that were taken since the backup and never will.
Why is this?
AD replication is triggered by comparing USNs (Update Sequence Numbers). Every DC has a USN table for every attribute. In that table it keeps track of the highest USN it received for this attribute from a given replication partner. If the current USN on the replication partner is higher than the one in his list, the DC knows that a change has been made and that it still has to copy these changes.
Imagine the following scenario: You have a domain containing 3 domain controllers DC1, DC2 and DC3.
- You create 10 new users on DC1 corresponding to USN 1 through 10. These user accounts replicate to DC2 and DC3.
- At this moment an image is created on DC1.
- You make more changes to AD: you reset the passwords on the 10 user accounts (USNs 11 to 20), you create 10 computer accounts (USNs 21 to 30), you create 10 security groups (USNs 31 to 40). All these changes replicate to DC2 and DC3.
- Then DC1 encounters a hardware or software failure. The image that was created is used to restore DC1. DC1 now uses a database that has a record of USNs 1 to 10 when AD starts.
- DC1 maintains its original invocation ID and DC2 and DC3 maintain their original up-to-dateness vector of USN 40 for DC1.
A second problem arises when new objects are now created on DC1.
If you create a new user, that account will be given the next unused USN on DC1: USN 11.
Since DC2 and DC3 think that they already have every update from DC1 up until USN 40 they will not do anything and the new changes are not replicated.
All changes created on DC1 with USNs 11 to 40 will never be available on DC2 and DC3.
In case of a proper system state restore these problems do not arise, since the reset of the Invocation ID informs the replication partners of the restore and causes them to reset their up-to-dateness vector for the restored DC.
A USN rollback can be very difficult to detect, since no errors are logged in the Event Viewer (unless you are running W2003 SP1 or hotfix 875495, then Event ID 2095 is logged).
One way to detect a USN rollback is running the following command on a DC and its replication partners: repadmin /showutdvec.
If the USN for the DC on the replication partners is higher than the one the DC has for itself and no replication errors are reported, you are probably dealing with USN rollback!
Tomorrow: Recovering from USN rollback!
posted by Els at
9:17 PM
8 Comments:
Fascinating article and I think maybe relevant to some problems that our network is experiencing. The problem I have now is that repadmin /showutdvec doesn't seem to do anything on Windows 2000. Any ideas as to why?
By
Anonymous, at 4:15 PM
i found this as a good explanation for USN rollback,
By
Vijay, at 7:05 PM
Really useful article which clearly explain the advantage of systen state restore over image restore and its fundamental.
By
Hemant Singh, at 4:56 PM
[url=http://www.ile-maurice.com/forum/members/wetter-vorhersage.html][b]das wetter ist[/b][/url]
[url=http://www.ile-maurice.com/forum/members/wetter-vorhersage.html][b]twister wetter[b][/url]
By
Anonymous, at 8:50 AM
Yes undoubtedly, in some moments I can reveal that I acquiesce in with you, but you may be considering other options.
to the article there is quiet a definitely as you did in the downgrade publication of this solicitation www.google.com/ie?as_q=avast! 4 professional edition 4.7.1098 ?
I noticed the phrase you have in the offing not used. Or you functioning the dreary methods of helping of the resource. I take a week and do necheg
By
Anonymous, at 12:30 AM
I have often found true religion jeans outlet the young shieldscxy cowbunting in the nests of small birds; and have seen these last followed by the young foundling, calling out clamorously for true religion sale food; and I once took a very fine one from the nest of the true religion jeans sale Maryland yellow throat, where it was fostered with great care. The migrations of these birds extend very fa? north. true religion jeans for men On their way they frequently stop in June, and are observed loitering singly, among diesel jeans thickets, reconnoitering no doubt for proper nurses to whose care G-star jeans they may True religion jeans true religion mens jeans outlet commit the hatching of their eggs, and the rearing of their helpless orphans. Among the birds selected for this duty are the diesel jeans outlet redeyed and whiteeyed flycatchers, the chipping sparrow, the goldencrowned thrush, the bluebird, the small blue gray flycatcher and and the yellow throat. mens true religion jeans The yellow throat and the redeyed flycatcher, appear to be particular favorites; and the kindness and affectionate attention which those two little birds pay to their nurslings, fully justifies the partiality of the parents. What reason nature cheap jeans may have for this extraordinary deviation true religion kids from her general practice, is beyond my comprehension.These birds often frequent corn and ricefields; but are more commonly found accompanying the skinny outlet cattle, feeding on the true religion jeans cheap seeds and worms, &;c., which they pick up amongst the fodder, &;c. Hence they are called cowbirds, •cowpen birds, and crow blackbirds. G-star jeans outlet They are generally found associated with the redwinged blackbirds, which they in many respects resemble.In the month jeans outlet of July, says Wilson, I took from the nest of a Maryland yellow throat, a young male cowbunting, which filled and occupied the whole nest. I took the bird home with me, and placed it in the same cage with a redbird, who at first and for several minutes after examined it closely and seemingly with great curiosity. It soon became clamorous for food, and from that moment the redbird seemed to adopt it as his own, feeding it true religion outlet with all the assiduity and tenderness of the most affectionate nurse.
By
2011bagnews, at 8:39 AM
Celebrities like wholesale sunglasses West and kdkjcxy0gkh Britney Spears propelled the popularity of the aviator sunglasses. When such celebrities discount oakley sunglasses endorse a particular brand or style, the followers and fans automatically starts falling for those products. Same thing happened with the aviator sunglasses. When blockbuster movies like Top Gun and cheap oakley sunglasses The Aviators got released during that period, sunglasses enthusiasts maui jim sunglasses were are only craving for the aviator sunglasses. Every time, the aviator style came back into trend, it penetrated the domain carrying a new characteristic. Many of us don’t know but the aviator carrera sunglasses style has been around for a much longer period. Very few connoisseurs are aware of this fact that the first pair of aviator sunglass was developed by Ray Ban in 1936.
Those pair of aviator shades Cocoons Sunglasses was specifically meant for the pilots because they were cosy and highly protective. Wholesale Ray Ban Sunglasses While flying, the pilots wear these pair of shades cebe sunglasses because the lenses were highly protective and cover the eye and skin around from the harmful sunrays. In that vintage aviator sunglasses period, the lenses were impact proof that is why those sunglasses were terrifically durable. adidas sunglasses If we take today’s aviator sunglasses into regard then nothing has changed drastically. The overall structure of these sunglasses is very much similar to what US army men used to wear. In the following year of their debut, adidas sunglasses Ray Ban offered the aviator sunglasses to the public and the company received hordes of gratitude in return from the connoisseurs as well as the customers.
By
2011bagnews, at 9:41 AM
They might as well have none at all.Late in life I have come on fern.
Now lichens are due to have their turn.I bade men tell me hidh81ke which in brief,Which is fairer, flower or leaf.
Wholesale New Era Hats
Cheap 59fifty Hats
Cheap New Era Hats
New Era Snapback Hats
New Era Fitted Hats
By
Unknown, at 3:18 AM
Post a Comment
<< Home