Discuss how to take Active Directory snapshots and why it is important to do so.

What will be an ideal response?

Windows Server 2008 enables you to use the ntdsutil.exe Active Directory database management tool along with the new Active Directory Database Mounting Tool or dsamain.exe tool to enable Active Directory snapshots to be taken for later viewing. These tools are used in combination from the Command Prompt window. This process does not enable the administrator to restore lost data, but instead is intended to enable a snapshot of Active Directory information to be compared to what is in the Active Directory after it is restored; or to determine which of several restores has the most complete Active Directory data. As you plan Active Directory use, include in your planning to take regular snapshots of the Active Directory contents. In this way, if you do have to recover Active Directory, you have a way to make sure its contents are up to date. For example, a snapshot might show that the recovered Active Directory does not contain a specific fine-grained password policy or that it is missing a domain that was recently created. You can then use the snapshot information to help you rebuild the missing data.

These tools can additionally be used to determine if a security object has been deleted by an intruder or if an administrator has accidentally deleted an Active Directory object.