Your network contains an Active Directory forest named contoso.com. The forest contains a single
domain. All domain controllers run Windows Server 2012 R2.
The domain contains two domain controllers. The domain controllers are configured as shown in the
following table.
Active Directory Recycle Bin is enabled.
You discover that a support technician accidentally removed 100 users from an Active Directory
group named Group1 an hour ago.
You need to restore the membership of Group1.
What should you do?
A.
Perform tombstone reanimation.
B.
Export and import data by using Dsamain.
C.
Perform a non-authoritative restore.
D.
Recover the items by using Active Directory Recycle Bin.
Explanation:
As far as the benefits of the Windows 2012 Recycle Bin, they are the same as the Windows 2008 R2
recycle bin with the exception of the new user interface which makes it more user-friendly. These
additional benefits include:
· All deleted AD object information including attributes, passwords and group membership can be
selected in mass then undeleted from the user interface instantly or via Powershell
· User-friendly and intuitive interface to filter on AD objects and a time period · Can undelete
containers with all child objects
https://www.simple-talk.com/sysadmin/exchange/the-active-directory-recycle-bin-in-windowsserver-2008-r2/
http://communities.quest.com/community/quest-itexpert/blog/2012/09/24/the-windows-server-
2012-recycle-binand-recovery-manager-for-active-directory
It think correct answer should be D, not B
D can only work if you are messing around with deleted object, but in this case you only have deleted group memberships! So A won’t work either.
B – dsamain can only be used to view objects from an AD snapshot
C – could work but would be quite a mess with however temporarily disabling replication and performing other f*ck ups nobody really wants to handle…
all answers are WTF but I think B is less WTF than the others: you take a look at the former group state using DSAMAIN, and then you have to apply group memberships manually…no fun but neither authoritative restore nor Recycle Bin is an option here :-/
Answer B is fine, there is not way to recover the membership, so another way to see it, is by mounting a backup with dsamain and checking which users were added to that group
Yeah, another twisted MS question. You’d never do it that way, but Dsamain is the only feasible answer in the bunch.