CSS2024-COC4
CSS2024-COC4
Materials
Sector : ELECTRONICS
Unit of Competency:
Maintain and Repair Computer Systems and Networks
Module Title:
Maintaining and Repairing Computer Systems and Networks
List of Competencies
No. Unit of Competency Module Title Code
MODULE CONTENT
ASSESSMENT CRITERIA:
1 Maintenance and/or Diagnosis of faults is planned and prepared in
line with job requirements.
2 Tools, equipment and testing devices needed for the maintenance are
obtained and checked for correct operation and safety
3 Materials necessary to complete the work are obtained in
accordance with established procedures and checked against
job requirements.
4 OHS policies and procedures are followed in line with job requirements.
5 Computer systems and networks for maintenance are checked against
job/service order or instructions and specifications.
CONTENTS:
CONDITIONS:
METHODOLOGIES:
Lecture/ Discussion
Demonstration/ Role playing
Film viewing
ASSESSMENT METHODS:
Written exam
Practical exam/ Demonstration
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 6 of 94
II CRT Technical
Group
Revision # 03
Assessment Criteria
CONDITIONS:
METHODOLOGIES:
Lecture/ Discussion
Demonstration/ Role playing
Film viewing
ASSESSMENT METHODS:
Written exam
Practical exam/ Demonstration
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 8 of 94
II CRT Technical
Group
Revision # 03
Assessment Criteria:
1. Appropriate personal protective equipment is used in line with
standard procedure. Faults or problems in the computer systems and
networks are diagnosed according to requirements and in line with
the standard procedures.
2. Fault and problems are recorded in accordance with standard
procedures
3. Appropriate measures are determined in accordance with established
procedures
4. Unplanned events or conditions are responded to in accordance with
established procedures
5. Documentation and reports are accomplished and submitted to
appropriate personnel in accordance with enterprise requirements.
CONTENTS:
• Personal Protective Equipment (PPE)
• Diagnostic procedures
• Problem solving in emergency situation
• Responding to unplanned/unexpected events
• Identifying and isolating faults/problems
o Diagnostic software utilities
o Gathering of information
• Accomplished forms
o Diagnostic reports
o Proposal reports
CONDITIONS:
The students/trainees must be provided with the following:
• Hardware and software tools and utilities
• Computers and peripherals
• Test instruments
• PPE
• Technical manuals
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 9 of 94
II CRT Technical
Group
Revision # 03
METHODOLOGIES:
• Lecture/ Discussion
• Demonstration/ Role playing
• Film viewing
ASSESSMENT METHODS:
• Written exam
• Practical exam/ Demonstration
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 10 of 94
II CRT Technical
Group
Revision # 03
Written exam
Practical exam/ Demonstration
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 11 of 94
II CRT Technical
Group
Revision # 03
METHODOLOGIES:
Lecture/ discussion
Demonstration/ role playing
Film viewing
ASSESSMENT METHODS:
Written exam
Practical exam/ demonstration
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 12 of 94
II CRT Technical
Group
Revision # 03
(4) Disk or file maintenance is the periodic reorganizing of disk files that have
become fragmented due to continuous updating.
Identified Hazards
risks associated with hazards
Clarification on understanding of
OHS policies and procedures
Communication and consultation
processes
Follow up on reports and
feedback. Effectiveness of risk
controls in place Training
needs
(2) Programming tools help the user analyze or search for data. For example,
query and report programs are often called query tools and report tools.
3. On Backup Options select Different options then click next, on Select Backup
Configuration you can choose Full Server or Custom in Full Server backup you will
backup all the settings and files of the server but in custom you can only select
specific files or folders to backup, in this example we will choose custom, select
custom then click next.
4. On Select Items for backup click Add items, then expand Local Disk (C:) then
check the Users folder then click OK, then click Next.
7. Perform the deletion of the Public folder on the user or delete the user folder.
Then on Window Server Backup click Recover.
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 19 of 94
II CRT Technical
Group
Revision # 03
8. On Getting Started select This Server then click next, on Select Backup Date just
click Next, then on Select Recovery Type select Files and Folders then click Next,
then on Select Items to Recover expand WIN- then expand Local Disk (C:), expand
Users then click Public (which you have deleted) then click Next.
9. On Specify Recovery Options select Original location and Overwrite the existing
versions with the recovered versions then click Next, on confirmation click Recover,
then wait for it to recover the files then check if you have successfully recover the
files.
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 20 of 94
II CRT Technical
Group
Revision # 03
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 21 of 94
II CRT Technical
Group
Revision # 03
Supplies/Materials :
Equipment :
Steps/Procedure:
1. Prepare/Design a daily maintenance plan for your
hardware, (time allotment: 1 week)
Clean computer case
Clean the keyboard
Clean the mouse
Clean the screen
Clean up hard drives
2. Design a systematic daily plan for your software, (
time allotment: 1 week)
Create an emergency diskette
Check for viruses
Back up files
Defragment hard drive
Scan hard drive for errors
3. Record the result of your maintenance process
Assessment Method:
Demonstration with oral interview
Tools and equipment used to protect the user and the computer system.
Types of personal protective devices
1. Anti-static devices
2. Power surge protectors
3. Personal equipments
Personal Equipment
2. Screw drivers
4. Compressed air
5. Handheld vacuum
Reboot upon crash- Reboot the computer to fix your pc upon crash.
Weekly
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 23 of 94
II CRT Technical
Group
Revision # 03
Yearly
expansion cards if
necessary
Check internal Annually No
connections and cables
1. Turn off the monitor and unplug it from the power source.
2. Using compressed air, clean away any dust on the top of the monitor’s
case.
3. Use a soft cloth and isopropyl alcohol to clean the outside of the monitor.
4. Holding the case together, turn the keyboard over, and then remove the
top cover. Use the compressed gas and/or brush and vacuum to clean out
the keys.
5. Taking care not to dislodge any keys, remove the key assembly from the
case.
6. If the keyboard has a circuit card attached to the key assembly, remove it
and set it aside.
7. Remove the screws that hold the back metal plate to the key assembly.
Put the screws in a cup or another container so you won’t lose them.
8. Carefully lift off the metal plate. What you find underneath depends on the
design of the keyboard. Carefully lift and clean the contacts on the card with
the alcohol and cloth.
9. Probably, there will be some type of rubber pad between the printed
circuit and the back of the keys. Carefully lift this up and clean any spill
residue from the pad as well as the backs of the keys.
10. Reassemble the pads, printed circuit, circuit card and metal plate, and
then turn the assembly right-side up again.
11. It would be a good idea to remove the keys and clean them, as well.
They should pop off. Just don’t remove more than a few at a time, because
you’ll have a real nightmare to figure out which key go where. Clean under
them with the alcohol and cloth.
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 30 of 94
II CRT Technical
Group
Revision # 03
Printer Cleaning Inkjet Printer
1. Clean the print nozzle regularly. Most inkjet printers have a built-in utility
to clean or unclog the print head nozzles. You should do this regularly,
especially if the printer sits idle for a couple of weeks.
2. Never turn a printer off by pulling the plug from the power source. Always
use the printer’s power switch to turn it off. The printer has some built-in
functions, such as parking the print head that are tied to the power-off
function of the printer’s on/off switch.
4. Dust and paper scraps and bits can collect in the bottom of the paper path
in an inkjet printer. Remove the paper scraps and blow out any dust or paper
bits that have accumulated with compressed air.
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 31 of 94
II CRT Technical
Group
Revision # 03
Cleaning your system unit - Cleaning the system unit and its parts is not
really difficult to do; you just need the proper tools to clean it properly. Using
compressed air antistatic strap and a Phillips screw driver you can effectively
clean your unit. The parts that need cleaning are the ff:
1. Motherboard
2. Memory
3. Interface cards
4. Hard drives
5. Optical Drives
6. System Case
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 32 of 94
II CRT Technical
Group
Revision # 03
Computer Virus
A virus is a destructive executable program that
infects the other programs in the system and
spreads by replicating itself.
Such a program is designed to damage the
victim’s computer files.
Viruses are coded by malicious programmers in a
way that they can spread in the system without one's permission and
knowledge.
Macro Virus Macro viruses infect files that are created using certain
applications or programs that contain macros. These mini-programs make
it possible to automate series of operations so that they are performed as
a single action, thereby saving the user from having to carry them out
one by one. Examples of macro viruses: Relax, Melissa.A, Bablas,
O97M/Y2K.
Directory Virus Directory viruses change the paths that indicate the location
of a file. By executing a program (file with the extension .EXE or .COM)
which has been infected by a virus, you are unknowingly running the virus
program, while the original file and program have been previously moved
by the virus. Once infected it becomes impossible to locate the original
files.
Polymorphic Virus Polymorphic viruses encrypt or encode themselves in a
different way (using different algorithms and encryption keys) every time
they infect a system. This makes it impossible for anti-viruses to find
them using string or signature searches (because they are different in
each encryption) and also enables them to create a large number of
copies of themselves. Examples include: Elkern, Marburg, Satan Bug, and
Tuareg.
File Infectors This type of virus infects programs or executable files (files
with an .EXE or .COM extension). When one of these programs is run,
directly or indirectly, the virus is activated, producing the damaging
effects it is programmed to carry out. The majority of existing viruses
belong to this category, and can be classified depending on the actions
that they carry out. Companion Viruses Companion viruses can be
considered file infector viruses like resident or direct action types. They
are known as companion viruses because once they get into the system
they "accompany" the other files that already exist. In other words, in
order to carry out their infection routines, companion viruses can wait in
memory until a program is run (resident viruses) or act immediately by
making copies of themselves (direct action viruses). Some examples
include: Stator, Asimov.1539, and Terrax.1069
Logic Bombs They are not considered viruses because they do not replicate.
They are not even programs in their own right but rather camouflaged
segments of other programs.
How do Virus Affect a System?
• It corrupts files
• It slows down the speed of the computer system
• It causes the system to hang frequently
• It deletes various files
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 36 of 94
II CRT Technical
Group
Revision # 03
Methods of Eliminating Viruses Removing the virus – When the virus can
be easily identified and can be removed without affecting other files, then
the antivirus removes it from the host place. Quarantine – This is done
when the virus cannot be easily identified removed from the file and the
removal of virus means the removal of the complete file. In this method,
although the virus is not eliminated, it is rendered inactive by moving the
file into "quarantine" and renaming it.
Anti-virus Software Software is designed to cure virus infected machines.
An anti-virus is a program that searches for, identifies and removes
potential viruses existing in the computer system
Examples of Anti-virus
software
• Symantec Norton
antivirus
• AVG antivirus
• McAfee Scan
• Microsoft Antivirus
• Kaspersky
• Avast
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 38 of 94
II CRT Technical
Group
Revision # 03
But before going through with this process, you should turn your
Computer off and disconnect the power cord. It is also important to
ground yourself by touching the frame of the case before going through
the troubleshooting process. All of your PC’s components are sensitive to
static electric charges.
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 39 of 94
II CRT Technical
Group
Revision # 03
Take out all non-essential parts so that only the basic part such as the
motherboard, power supply, display card, controller and drive are left.
You can pull-out the cards by removing the screw as shown in the screen
shot below.
• Replace each part one at a time, until the problem reoccurs. • When
you replace a part and the computer stops working, You know that
part is the reason for the problem, It can then be replaced. • If the
computer still doesn’t operate.
• Remove all the remaining cards including the display card and
floppy controller.
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 40 of 94
II CRT Technical
Group
Revision # 03
• If you use your computer more than a few hours per day, we
suggest you not to turn off your computer at the end of the day.
Instead turn off only the monitor to save electricity. Daily power
up and down makes the components exposed to high and low
temperature cycles that are not good for the life-time of the
components, particularly the critical ones such as hard drives,
CPU, and memory. The temperature cycle would result in
expansion-shrinking cycle for the components. The life-time of
electronic components would be increased if they are run at
constant temperature with adequate ventilation.
• If your area experiences a few times of power outage per year, it is
necessary to use a UPS. Sudden power downs while the system
is running may cause severe damage to hard drives.
• A tape backup and a lock to make systems hard to move are
worthy investment for critical data.
• Use your hand to touch and feel the cover of your computer at
least once a week. The cover should be at room temperature. If it
feels warm there may be a problem! Check to make sure that the
cooling fans on the power supply and CPU are working properly.
Clean the air pathway on the back of the power supply on a
regular basis.
Over time, your hard drive may become fragmented, thereby slowing down your
computer. You should therefore de-fragment your computer every few weeks or
so. Just go to the start menu - accessories - system tools - disk defragmenter.
• Overheating
Computers can generate a lot of heat, especially if they're left on for long periods
of time. A simple way to combat this is just to turn off your computer for a while
and give it time to 'cool off'. If overheating is a recurring issue, you might want to
look into investing in a larger cooling fan for your computer.
• A corrupted registry
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 41 of 94
II CRT Technical
Group
Revision # 03
Self-Check 4.3-1
A.
B.
as commercial music and video files. Popular P2P file sharing applications
include BitTorrent and LimeWire.
Self-Check 4.3-2
3) 4)
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 47 of 94
II CRT Technical
Group
Revision # 03
Model Answers 1
• If you use your computer more than a few hours per day, we suggest you
not to turn off your computer at the end of the day. Instead turn off only
the monitor to save electricity. Daily power up and down makes the
components exposed to high and low temperature cycles that are not good
for the life-time of the components, particularly the critical ones such as
hard drives, CPU, and memory. The temperature cycle would result in
expansion-shrinking cycle for the components. The life-time of electronic
components would be increased if they are run at constant temperature
with adequate ventilation.
• A tape backup and a lock to make systems hard to move are worthy
investment for critical data.
• Use your hand to touch and feel the cover of your computer at least once a
week. The cover should be at room temperature. If it feels warm there
may be a problem! Check to make sure that the cooling fans on the power
supply and CPU are working properly. Clean the air pathway on the back
of the power supply on a regular basis.
▪ To save yourself alot of money and unneedless trips to the computer shop
for repairs,there are a series of very simple steps you can take to keep
your new computer running fast and efficient. Myself,I have windows xp
home edition running on my computer. I find it to be the best system out
there at the moment.The choice is of course yours as to what operating
system you install on your machine. When you get your new computer
home and you configure an internet connection,the first thing I
recommend that you do is to get to the windows update site. The site will
automatically update your new operating system with files to prevent
people on other computers from accessing your data. Next step is to
install an anti-virus and spyware program on your computer.
▪ Before you do anything, make sure the computer is unplugged from the
outlet and is completely turned off! Next is to get a screwdriver for those
little round screws you will need to undo to get inside your case. When
both sides of the case are removed,you will need a can of compressed
air..you can buy this from any computer store. You then spray all the
areas inside the case..you will see the dust and dirt flyng off from the
places you sprayed. Doing this 4 times a year(every 3 months)Is a great
way to save a lot of money and keep your computer running like its brand
new.
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 49 of 94
II CRT Technical
Group
Revision # 03
ACT Yellow: Port traffic for Network traffic Heavy network No traffic
either speed present traffic
• Connect a file server and a client PC back to back with a crossover cable to
verify that the NIC and network operating system are properly configured. • To
make a crossover cable, simple connect TD+ to RD+ and TD- to RD-. The
cable performs the crossover that is usually performed by the hub.
Make sure that two twisted-pair wires are used. If the file server and client
PC function together as a small network, then either the existing cabling or
the hub is the problem.
• If there is a proper crossover, the appropriate LED comes on. If there is a
straight-through connection, the LED does not light. A blinking LED
indicates that there is a polarity mismatch (that is, TD+ to RD- instead of
TD+ to RD+).
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 52 of 94
II CRT Technical
Group
Revision # 03
Self Check 3
Learning Objective:
After reading this INFORMATION SHEET, YOU MUST be able to identify
Common Faults and Problems of Computer
Today's computers
have faster microprocessors, more memory and bigger hard drives. When
you think about the differences between a Pentium 4 and 386, you have
to conclude the improvement is astounding! But when error attacks our
computer we have to do something for the computers to survive. Here are
some of the common faults and problems that we may encounter:
When you install new software on your computer, often times you
install it to run in the background every time you start up. Most times you
do this without knowing it. Look at the bottom right hand side of your
screen.
If you see several icons there, you have extra programs running and
stealing resources. Right click on these and see if you have the option of
closing them. Many times, you can open the program and choose an
option to keep these programs from starting automatically.
• Corrupted registry
After months of corrupting your registry, it will become good. This will,
in its early stages, cause your computer to slow down. In its advanced
stages, it will freeze and crash and do more mysterious and troublesome
things.
Nothing happened
• Check fitting of CPU, RAM, Video card, sound card etc. If necessary,
remove and refit these components
• Check the motherboard manual and perform a BIOS reset
procedure
• This may indicate a faulty motherboard
• Check
seating of CPU, RAM, Video card,
sound card etc. If necessary, remove and refit
these components
• Check the motherboard manual and perform
a BIOS reset procedure
• This may indicate a faulty Motherboard or
Video card
• Check display options for the monitor usually under control panel
under the display icon. Select at least 256 colors for standard
display. If you had 16 color selected, this may be why your screen
displays limited colors. Some programs such as Fast Cat require you
to set display settings to 256 colors.
If screen appears distorted around the edges and the color does not
look right, you may have incorrect display adapters. Select Start, Settings,
and Control Panel. Double click on System Icon and select Device
Manager. You will see a listing of devices. Double click on Display
adapters to view the type. If there is a yellow exclamation point next to
device, there is a conflict. To view conflicts for a certain device, click on
the device, select properties, and select the general tab. There should be
a description of the device and why it is not working properly.
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 59 of 94
II CRT Technical
Group
Revision # 03
Things to Try...
Do you have correct print drivers installed? Find print drivers under
Device Manager.
• Check to be sure you have correct print drivers installed. Double click
on System Icon and select Device Manager. You will see a listing of
devices. Double click on the Ports button to view the type. If there
is a yellow exclamation point next to device, there is a conflict.
Self-Check 2.2-2
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 60 of 94
II CRT Technical
Group
Revision # 03
Answer Key
1. A
2. A
3. C
4. D
5. D
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 62 of 94
II CRT Technical
Group
Revision # 03
System Unit
Monitor
Keyboard
Mouse
Printer
Steps/ Procedure:
when you detached the following:
1. Prepare the necessary tools, equipment and
materials 2. Detached the following
Devices Port
- Keyboard - PS/2
- Mouse - PS/2
- Hard disk - IDE cable
- Floppy disk drive - IDE cable
- CD-Rom drive - IDE cable
- RAM chip - Memory slot
3. List the messages or errors it will prompt you.
Assessment Method:
Demonstration , Performance Criteria checklist
1. Disk Clean Up
Open the My Computer Icon or the Library Icon down in the Task Bar
Select the appropriate file types so your screen matches below. You may see
other options in addition to the ones listed and it is safe to clean them, (See
Figure 2). After making your selection, click the OK button to begin Disk
Cleanup.
2. Check Disk
Click on the Tools Tab. Click the Check Now… button to open the Check
Disk program, put a checkmark in the “Automatically fix file system
errors” option and click the Start Button to run it.
A window will tell you Windows cannot
check the disk while it is in use. Click the
Schedule disk check button. Your computer
will restart and Check Disk will run. If you
have more than one hard drive, repeat this
step for each.
Note: If you must be away from your
computer, while running any of these steps,
please lock your computer (Ctrl+Alt+Del)
and click on the Lock this Computer
option).
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 67 of 94
II CRT Technical
Group
Revision # 03
Assessment Method:
Introduction
You all know that Active Directory Domain Services (ADDS) is a mission-critical
component in your Windows infrastructure. If Active Directory goes down, your
network is essentially useless. Consequently, your backup and recovery plans for
Active Directory are fundamental to security, business continuity, and regulatory
compliance. Windows Server 2008 brings many new features to Active
Directory®, two of which have a significant impact on your backup and recovery
plans: the new Windows Server Backup utility and the ability to take and work
with Volume Shadow Copy Service snapshots of Active Directory. In this article I
will describe everything you need to know about Active Directory backup and
disaster recovery.
The system state data includes at least the following data, plus
additional data, depending on the server roles that are
installed: • Registry
• COM+ Class Registration database
• Boot files
• Active Directory Certificate Services (AD CS) database
• Active Directory database (Ntds.dit)
• SYSVOL directory Cluster service information
• Microsoft Internet Information Services (IIS) metadirectory
System files that are under Windows Resource Protection
• The volume that hosts the boot files, which consist of the Bootmgr
file and the Boot Configuration Data (BCD) store
• The volume that hosts the Windows operating system and the
registry
• The volume that hosts the SYSVOL tree
• The volume that hosts the Active Directory database (Ntds.dit) •
The volume that hosts the Active Directory database log files
Versioning, target size and backup type Depending on the commands used
to schedule the backup job or the backup target location, backups are made
differently:
• When backing up to a local critical volume, backups are always full, one
backup target folder created for each backup and versioning is enabled.
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 71 of 94
II CRT Technical
Group
Revision # 03
• The backup type, scheduled or manual backup hasn’t any influence upon
the versioning. It simply follows the above rules.
When you enable Active Directory Recycle Bin, all link-valued and non-link-valued
attributes of the deleted Active Directory objects are preserved and the objects
are restored in their entirety to the same consistent logical state that they were
in immediately before deletion. For example, restored user accounts
automatically regain all group memberships and corresponding access rights
that they had immediately before deletion, within and across domains.
Remarks:
• When backing up SystemState backup through an UNC path, the
backup will be overwritten, there is no way to get an older
version.
• By default, SystemState Backup onto the local system will not
accept the system partition as backup target. A remote target
through UNC can be stored on any partition. This protection can
be disabled by changing the AllowSSBToAnyVolume parameter
in the registry.
Snapshot Backups
Active Directory Snapshots are made through NTDSUtil. NTDSUtil can
be used to create a one-time Snapshot backup of your Active
Directory as well as a scheduled Snapshot backup mechanism.
Manual Snapshots
To manually create and view Active Directory Snapshots: Logon to
the system with at least domain controller local administrator
privileges
From the command prompt, start NTDSUtil
To activate the current instance of NTDS, type: Activate Instance
NTDS
Enter: snapshot to change to the snapshot part of NTDSUtil
Enter: create to create a snapshot
Enter: list all to view all current snapshots. This command does not
only list the snapshots made by NTDSUtil, but all snapshots, those
made by your system state backups too.
Scheduled Snapshots
NTDSUtil can be used in an automated way of working by putting all
commands on one single command line. This command line can be
scheduled through the Windows OS build-in scheduling service.
COMPUTER July 2024 Document No. RIR-CSS04
SYSTEMS
SERVICING NC Issued by: Page 75 of 94
II CRT Technical
Group
Revision # 03
When to Restore
When an object is deleted in Windows 2008R2, the DC from which
the object was deleted informs the other DCs in the environment
about the deletion by replicating what is known as a tombstone(if the
recycle bin isn’t enabled) or Deleted (with recycle bin). A tombstone
or deleted object is a representation of an object that has been
deleted from the directory. The tombstone object is removed by the
garbage collection processes, based on the tombstone lifetime
setting, which by default is set to 180 days by default in Windows
2008R2. A Deleted object will be recycled after the “Recycle object
lifetime”, which is by default equal to the tombstone lifetime, or 180
days in Windows 2008R2.
A backup older than the tombstone lifetime set in Active Directory is
not considered to be a good backup.
Active Directory protects itself from restoring data older than the
tombstone lifetime. For example, let’s assume that we have a user
object that is backed up. If after the backup the object is deleted, a
replication operation is performed to the other DCs and the object is
replicated in the form of a tombstone. After 180 days, all the DCs
remove the tombstone as part of the garbage collection process. This
is a process routinely performed by DCs to clean up their copy of the
database.
If you attempt to restore the deleted object after 180 days, the
object cannot be replicated to the other DCs in the domain because
it has a USN that is older than the level required to trigger
replication. And the other DCs cannot inform the restored DC that
the object was deleted, so the result is an inconsistent directory.
Where to restore
Authoritative Restore
An authoritative restore is, in essence, an extension of the non
authoritative restore process. That is, it requires all the steps of a
non-authoritative restore before it can be initiated. The authoritative
restore distinguishing characteristic is that it increments the version
number of an entire directory, a sub tree, or individual objects
(provided that they are leaf objects) to mark them as authoritative in
the directory.
Non-Authoritative Restore
Non-authoritative restore is the default method for the restoration of
Active Directory, and is used for the majority of restore operations.
Using this method, the settings and entries that existed in the
Domain, Schema, Configuration, and (optionally) Global Catalog
naming contexts maintain the version number they had at the time
of backup.