Step by step - restore active directory objects from Windows backup

I accidentally deleted some active directory objects when I was deleting some Exchange mailboxes.  Chaos ensued, but I had to restore the active directory users.

Here's what Microsoft helped me do (step by step).

Boot into Directory services restore mode.  (see here for how: https://blogs.technet.microsoft.com/activedirectoryua/2008/11/20/how-to-start-in-directory-service-restore-mode-dsrm-in-windows-server-2008-and-windows-server-2008-r2/)

Log in

Open an elevated command prompt

type "wbadmin get versions"
This will give you all the backups that you can restore from.
Pay attention to the version identifier as this will define what backup you're working with.

type "wbadmin start systemstaterecovery -version:10/01/2016-04:30" where 10/01/2016-04:30 will vary based on the actual version that you are restoring from that you found when you ran "wbadmin get versions"

Choose yes twice.

Now, you'll need to wait 45 to 90 minutes while the system preps itself.  Ugh.

Next, you'll restore organization units (OUs) as a whole to the version the the OUs were at the time of the backup.  So for example, if I have an OU named accounting and I'm doing a restore on October 3, 2016 where the backup I'm restoring from is October 1, 2016 - all changes from 10/1/16 to 10/3/16 will be lost.

This gets less intuitive here.  After the system has loaded the backup, the system will ask you to reboot the server.  Don't do it.

Instead, launch a command prompt, type ntdsutil, and then press Enter.

1 .           Type activate instance ntds and press Enter.

2.            Type authoritative restore and press Enter.

3.            At this point, determine whether you're restoring an OU or an object. The previous table showed the syntax to restore either an OU or an object. Type the restore command and press Enter.

For example, to restore a user object, use the following format:

•             restore object dn

•             restore object "cn=Sally,ou=sales,dc=pearson,dc=pub"

Or, to restore an OU, use the following format:

•             restore subtree dn

•             restore subtree "ou=sales,dc=pearson,dc=pub"

NOTE

This increments the update sequence number (USN) so that all other DCs consider it the most recent change.

4.            Type quit and press Enter twice to exit ntdsutil.

5.            Restart the DC normally.

As an example. if you were restoring an OU called distribution groups which sits under an OU called MyBusiness, you'd type:

restore subtree "OU=distribution groups,OU=MyBusiness,DC=contoso,DC=local"
if you're not familiar with LDAP syntax (which I'm not), some googling and trial and error will help you find what you need.  If you type in the wrong values, the process willl just fail.

This is what a successful restore looks like.  Look at "successfully updated records"

What's weird for me in the two times I've tried this is that I rebooted once, and my 2008 R2 server had no internet connectivity and no restored AD items on first reboot.  I had reboot again to get my items and to get internet connectivity.  So weird.

To do list when an employee departs an organization

When an employee leaves an organization, these are the steps that should be followed after his/her departure:

1. change password in ADUC
2. change password on email service, if managed separated
3. remove user from all distribution groups he/she may be a member of
4. ask the user's manager what should be done with his/her email.  This post discusses common options

new user setup (new version as of 5/1/13)

These are generic steps for setting up a new user.  These steps assume that the laptop is set up as needed as per the steps listed computer setup here:
http://t-solve.blogspot.com/2013/04/new-computer-setup-steps-revised-41113.html

Steps for new user setup (to be followed in order):

1. create user account (and if necessary, mail account if done separately)
2. adjust user profile script
3. if needed, configure home folder and backup folder in ADUC
4. add to appropriate security groups in ADUC
5. put user on appropriate distribution lists
6. log into computer as user
7. confirm drives mapped correctly
8. set up Outlook
9. disable email archiving (if not already disabled)
10. add Bcc to view when composing new message
11. configure user to see any shared calendars and/or contacts lists
12. set up printers or confirm printers mapped correctly
13. make sure user has appropriate local permissions on computer (admin or standard/restricted)
14. make sure laptop is configured from Microsoft updates
15. install all applicable updates for Office and Windows
16. confirm antivirus is up to date
17. configure default printer based on nearest applicable printer
18. make sure VPN icon is on desktop and connect to VPN one time with the user's name and password
19. add terminal server icon to desktop, if applicable
20. configure backup to appropriate backup folder
21. add off-site backup program if applicable (Backblaze, ibackup, etc)
22. Install Google Chrome and set it as the default browser
23. Add company specific IM program (Google Talk, Skype)
24. make sure computer is added appropriately in inventory spreadsheet
25. Add user to address book on company scan to email copier (if applicable)
26. Alter user's name on phone (if applicable)
27. Alter extension's voicemail to email properties (if applicable)
28. Make sure the user's phone is not forwarding to another person
29. Configure user's mobile broadband card
30. leave intro sheet for new user
31. set up desk as needed (keyboard, mouse, monitor, docking station, leave extra power cord for travel)
32. put computer in appropriate location for organization (for some organizations, this means in a locked server room)

steps on creating a new user

1) create user account (and if necessary, mail account if done separately)

2) adjust user profile script and home folder, if necessary

3) put user on appropriate distribution lists

4) log into computer as user

5) confirm drives mapped correctly

6) set up Outlook with appropriate archiving

7) add Bcc to view when composing new message

8) set up printers or confirm printers mapped correctly

9) make sure user has appropriate local permissions on computer (admin or standard/restricted)

10) confirm computer has latest updates/patches for OS and Office

11) confirm antivirus is up to date

12) configure default printer

13) configure VPN if needed

14) leave intro sheet for new user