Your network contains an Active Directory domain named contoso.com. The domain contains a domain
controller named DC1 that runs Windows Server 2012 R2.
You create an Active Directory snapshot of DC1 each day.
You need to view the contents of an Active Directory snapshot from two days ago.
What should you do first?
A.
Start the Volume Shadow Copy Service (VSS).
B.
Run the dsamain.exe command.
C.
Run the ntdsutil.exe command.
D.
Stop the Active Directory Domain Services (AD DS) service.
Explanation:
Mounting an Active Directory snapshot
Before connecting to the snapshot we need to mount it. By looking at the results of the List All command in step
#8 above, identify the snapshot that you wish to mount, and note the number next to it.
In order to mount an Active Directory snapshot follow these steps:
Log on as a member of the Domain Admins group to one of your Windows Server 2008 Domain Controllers.
Open a Command Prompt window by clicking on the CMD shortcut in the Start menu, or by typing CMD and
pressing Enter in the Run or Quick Search parts of the Start menu.
Note: You must run NTDSUTIL from an elevated command prompt. To open an elevated command prompt,
click Start, right-click Command Prompt, and then click Run as administrator.
In the CMD window, type the following command:
ntdsutil
In the CMD window, type the following command:
snapshot
To view all available snapshots, in the CMD window, type the following command:
list all The result should look like this:
snapshot: List All
1: 2008/10/25:03:14 {ec53ad62-8312-426f-8ad4-d47768351c9a}
2: C: {15c6f880-cc5c-483b-86cf-8dc2d3449348}
In this example we only have one snapshot available, one from 2008/10/25 at 03:14AM (yes, I write articles at
this time…). We’ll mount this one.
In the CMD window, type the following command:
mount 2
The result should look like this:
snapshot: mount 2
Snapshot {15c6f880-cc5c-483b-86cf-8dc2d3449348} mounted as
C:’$SNAP_200810250314_VOLUMEC$’
Next, you can leave the NTDSUTIL running, or you can quit by typing quit 2 times.
Note: Like the above command, the mounting process can also be run in one line. However, note that
NTDSUTIL requires that the “list all” command be run in the same session that you mount the snapshot. So in
order to mount the snapshot with a one-liner, you will need to run “list all” first.
ntdsutil snapshot “list all” “mount 2” quit quit
Note: You do not need to quit from the NTDSUTIL command, you can keep it open assuming that you’ll
probably want to unmount the snapshot right after working with it.