AZ-802: Administering Windows Server

Because Active Directory Recycle Bin is disabled, deleted objects cannot be reanimated from tombstones, so recovery must come from a system state backup taken before the deletion, combined with an authoritative restore so the recovered objects are not immediately overwritten by inbound replication from the domain controller that still has the deletion. A system state restore can only be performed while normal Active Directory replication is not running on that domain controller, which requires starting it in Directory Services Restore Mode. Restoring the full system state alone would also roll back every other AD DS object to its pre-backup state, discarding legitimate changes made after the backup. Running an authoritative restore scoped to only the distinguished name of the Finance organizational unit (a subtree restore, rather than a full database authoritative restore) increases the version number solely on that OU and its child objects. When the domain controller is rebooted into normal mode and replication resumes, only the Finance subtree is pushed out authoritatively to the other domain controller, while every unrelated object is treated as non-authoritative and is simply refreshed from the replication partner's current data — recovering the deleted OU, replicating that recovery, and leaving unrelated post-backup changes intact.