Preserving the Last Password and SIDHistory for Deleted Active Directory Objects

Overview

You must run adLdapTool.exe before the first backup to configure Active Directory to preserve the unicodePwd and SIDHistory attributes for deleted objects.

This configuration allows Active Directory to preserve the most recent password state and SIDHistory attributes for deleted objects.

Commvault does not back up or store password values and does not support point-in-time password rollback.

How It Works

The adLdapTool sets the following values to the searchFlags attributes of Unicode-Pwd and SID-History found under CN=Schema and Cn=Configuration:

Value for Unicode-Pwd: 0x00000008
Value for SID-History: 0x00000009

Due to this setting, Active Directory will preserve these two attributes on deletion.

Important

Commvault does not store or back up Active Directory passwords.
Password history and historical password rollback are not supported.
Only the most recent password state preserved by Active Directory may remain usable after restoring a deleted object.
Restored users may be required to reset their password depending on Active Directory deletion state, recycle bin configuration, and domain behavior.

Password Restore Behavior

Commvault does not back up or restore historical password values. The restored authentication behavior depends on the state of the Active Directory object at the time of deletion.

Password retention behavior is dependent on how Active Directory preserves deleted object attributes and is not based on password data stored in Commvault backups.

The following table shows the expected password behavior for common restore scenarios:

Restore Scenario	Result
User password changed after backup, user still exists	Most recent AD password remains valid
Soft-deleted user restored	Most recent preserved AD password is typically retained
Hard-deleted user restored	Password reset is typically required
Point-in-time restore to earlier password	Not supported
Password history recovery	Not supported

Prerequisites

Verify that you have credentials for a user account that has administrative privileges for modifying the Active Directory. By default, a member of the Schema Admins group will have this privilege.

Procedure

Log on to the server using the user account that has administrative privileges.
On the command line, go to software_installation_directory/Base, and then type the following command:
Note
- The command must be run on each AD domain. It only needs to be run once on each domain. Changing only the parent domain will NOT apply settings to the child domain.
- To handle passwords that contain special characters, use quotation marks.
  
  For example, if the password is ABC"DE"F, specify the same as "ABC""DE""F". ///
```
 
adLdapTool.exe $[domain_name\schema_admin_user_name] $[password] -hostserver $[fully_qualified_directory_host_server_name] -port     $[LDAP_port_number, default 389] -setschema $[1]
    ////
///
```