{"id":166,"date":"2007-10-02T00:19:21","date_gmt":"2007-10-01T22:19:21","guid":{"rendered":"http:\/\/www.corelan.be:8800\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/"},"modified":"2007-10-02T00:19:21","modified_gmt":"2007-10-01T22:19:21","slug":"how-to-properly-restore-objects-in-the-2003-ad-database","status":"publish","type":"post","link":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/","title":{"rendered":"How to properly restore (objects in) the 2003 AD database"},"content":{"rendered":"
\n

Windows 2000 \/Active Directory has been around for more than 7 years now. I've been using AD for almost 7 years, and due to its stability, I never had to recover a deleted object in AD. (Knock on wood). So it's not a real surprise to find out that a lot of admins don't even know how to properly restore a deleted object, or even restore AD the proper way.<\/p>\n

First of all, you need to have a System State backup from your Domain Controller, created with ntbackup. This System state backup contains various components from that server (such as the registry) and also contains a snapshot of the AD database (ntds.dit). Before explaining how to use the System State backup to restore an object, it's important to know that you will need to take down a DC in order to restore an object; and that you need to use the System State backup that was made on that DC. (Well, at least, that is the recommended way. There are ways to just recover objects using the ntds.dit file, but that procedure should be used in emergency situations only \"when everything else fails\"). Next, you need to know the Directory Services Restore Mode password. This password was defined when you ran the dcpromo. If you don't know that password anymore, then you should change it prior to running the backup. This is how you can change the password :<\/p>\n

\n\n\n<\/colgroup>\n\n\n
Open a command prompt and run \"ntdsutil<\/strong><\/span>\" <\/span><\/p>\n

at the ntdsutil prompt, run \"set dsrm password<\/strong><\/span>\" <\/span><\/p>\n

If you want to reset the password on the current server, run \"reset password on server null<\/strong><\/span>\". If you want to change the password on a remote server, run \"reset password on server <servername><\/strong><\/span>\". Type in the new password when prompted. <\/span><\/p>\n

At the dsrm prompt, type 'q' and press enter. At the ntdsutil prompt, type 'q' and press enter.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Due to the fact that you need to bring down a DC, it's important to plan for this. If it is difficult to bring down a DC because you only have one DC, or if it is a problem to take down a DC because it is the PDC emulator, then you need to prevent this from becoming a problem by setting up a second DC. This will not only provide redundancy and load balancing for certain applications, but it will also allow you to take down that second DC without users noticing.<\/p>\n

Case : suppose you've deleted a user account called \"Charles Dickens\" from the \"Authors\" OU, which is a child OU from \"United Kingdom\". The domain in my example is called \"mylibrary.com\", and the affected object tree looks like this :<\/p>\n

\"100207_1818_Howtoproper1\"<\/a><\/p>\n

The distinguished name of the object is CN=Charles Dickens,OU=Authors,OU=United Kingdom,DC=mylibrary,DC=com<\/p>\n

In fact, when you want to restore a deleted user object, you have 2 options : either use ldp to de-tombstone the object, or use an authoritative restore of the object. If you choose to use ldp, check http:\/\/support.microsoft.com\/kb\/840001\/<\/a> . This procedure requires you to have documented the group membership of that user. Also, the password will not be restored and as a result, the object will be disabled. That procedure does not require you to take down a DC, but as explained, you need to have documentation. Alternatively, if you did not document anything and you don't want to take down a DC, you can use this procedure to use one of Longhorn's (Windows 2008 server) features to get the information you need.
\nAnyways, I'll use the authoritative restore method this time.<\/p>\n

Last quick note before proceeding with the restore : When an object is deleted in AD, it's not gone yet. It is tombstoned and will only vanish completely after a while. So the object is still there, and has a specific USN.<\/p>\n

First of all, restart the DC (the one used to create the AD System State backup (.bkf) file). At boot time, press F8 go enter Directory Services Restore Mode<\/p>\n

\"100207_1818_Howtoproper2\"<\/a><\/p>\n

Wait until the system boots, and log on with \"administrator\" and the Directory Services Restore Mode password. Accept the warning about \"Safe Mode\"<\/p>\n

Use ntbackup to restore the System State to the server. Choose to \"restore to the original location\", and \"overwrite existing files\". Also, ensure to \"restore junction points\"
\nWhen the ntbackup restore process has completed, do NOT reboot the machine. You have now essentially overwritten the existing ntds.dit file with an older copy of the file. At that point, the USN of the object is lower than the USN of the tombstoned object, so if you restart the DC, it will not only receive all updates from other DC's, but the user object will be overwritten by the tombstoned object. Result : the object will be deleted again. So before rebooting and enabling replication again, you'll need to update the USN of that object, so it becomes \"authoritative\".<\/p>\n

\n\n\n<\/colgroup>\n\n\n
Open a command prompt and run \"ntdsutil<\/strong><\/span>\" <\/span><\/p>\n

At the ntdsutil prompt, type \"authoritative restore<\/strong><\/span>\" <\/span><\/p>\n

Type \"restore object <DN>\" (where <DN> is the distinguished name of the object to recover) <\/span><\/p>\n

In our example, the command would look like this : <\/span><\/p>\n

restore object CN=Charles Dickens,OU=Authors,OU=United Kingdom,DC=mylibrary,DC=com <\/strong><\/span><\/span><\/p>\n

This will increment the USN with 10000. If you're not satisfied with this value, you can use the verinc parameter in the \"restore\" command to specify your own value. <\/span><\/p>\n

Example : restore object CN=Charles Dickens,OU=Authors,OU=United Kingdom,DC=mylibrary,DC=com verinc 11111<\/span> <\/strong><\/span><\/p>\n

Type quit<\/span> to exit authoritative restore mode and Type quit<\/span> again to exit ntdsutil. <\/span><\/p>\n

Reboot the DC, let it start as a regular DC (not in Restore Mode) and check replication. If all goes well, your object will re-appear in AD and will still have all attributes set.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

  <\/p>\n

If you want to delete an entire OU and everything below, you can use the \"restore subtree<\/strong><\/span>\" command (followed by the distinguished name of the OU). If you want to restore the entire AD, you can simply use the \"restore database<\/strong><\/span>\" command.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Windows 2000 \/Active Directory has been around for more than 7 years now. I've been using AD for almost 7 years, and due to its stability, I never had to recover a deleted object in AD. (Knock on wood). So it's not a real surprise to find out that a lot of admins don't even … Continue reading \"How to properly restore (objects in) the 2003 AD database\"<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[31,26],"tags":[3740,32],"class_list":["post-166","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-windows-server","tag-backup-restore","tag-active-directory"],"yoast_head":"\nHow to properly restore (objects in) the 2003 AD database - Corelan | Exploit Development & Vulnerability Research<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to properly restore (objects in) the 2003 AD database - Corelan | Exploit Development & Vulnerability Research\" \/>\n<meta property=\"og:description\" content=\"Windows 2000 \/Active Directory has been around for more than 7 years now. I've been using AD for almost 7 years, and due to its stability, I never had to recover a deleted object in AD. (Knock on wood). So it's not a real surprise to find out that a lot of admins don't even … Continue reading "How to properly restore (objects in) the 2003 AD database"\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/\" \/>\n<meta property=\"og:site_name\" content=\"Corelan | Exploit Development & Vulnerability Research\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/corelanconsulting\" \/>\n<meta property=\"article:published_time\" content=\"2007-10-01T22:19:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.corelan.be\/wp-content\/uploads\/2008\/09\/100207-1818-howtoproper1-thumb.png\" \/>\n<meta name=\"author\" content=\"corelanc0d3r\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@corelanc0d3r\" \/>\n<meta name=\"twitter:site\" content=\"@corelanc0d3r\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"TechArticle\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/\"},\"author\":{\"name\":\"corelanc0d3r\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/person\\\/3be5542b9b0a0787893db83a5ad68e8f\"},\"headline\":\"How to properly restore (objects in) the 2003 AD database\",\"datePublished\":\"2007-10-01T22:19:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/\"},\"wordCount\":1018,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2008\\\/09\\\/100207-1818-howtoproper1-thumb.png\",\"keywords\":[\"backup restore\",\"Active Directory\"],\"articleSection\":[\"Active Directory\",\"Windows Server\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/\",\"name\":\"How to properly restore (objects in) the 2003 AD database - Corelan | Exploit Development & Vulnerability Research\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2008\\\/09\\\/100207-1818-howtoproper1-thumb.png\",\"datePublished\":\"2007-10-01T22:19:21+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2008\\\/09\\\/100207-1818-howtoproper1-thumb.png\",\"contentUrl\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2008\\\/09\\\/100207-1818-howtoproper1-thumb.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/2007\\\/10\\\/02\\\/how-to-properly-restore-objects-in-the-2003-ad-database\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.corelan.be\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to properly restore (objects in) the 2003 AD database\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#website\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/\",\"name\":\"Corelan CyberSecurity Research\",\"description\":\"Corelan publishes in-depth tutorials on exploit development, Windows exploitation, vulnerability research, heap internals, reverse engineering and security tooling used by professionals worldwide.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.corelan.be\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#organization\",\"name\":\"Corelan CyberSecurity Research\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/corelanlogo2_small-20.png\",\"contentUrl\":\"https:\\\/\\\/www.corelan.be\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/corelanlogo2_small-20.png\",\"width\":200,\"height\":200,\"caption\":\"Corelan CyberSecurity Research\"},\"image\":{\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/corelanconsulting\",\"https:\\\/\\\/x.com\\\/corelanc0d3r\",\"https:\\\/\\\/x.com\\\/corelanconsulting\",\"https:\\\/\\\/instagram.com\\\/corelanconsult\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.corelan.be\\\/#\\\/schema\\\/person\\\/3be5542b9b0a0787893db83a5ad68e8f\",\"name\":\"corelanc0d3r\",\"pronouns\":\"he\\\/him\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x\",\"caption\":\"corelanc0d3r\"},\"description\":\"Peter Van Eeckhoutte is the founder of Corelan and a globally recognized expert in exploit development and vulnerability research. With over two decades in IT security, he built Corelan into a respected platform for deep technical research, hands-on training, and knowledge sharing. Known for his influential exploit development tutorials, tools, and real-world training, Peter combines a strong research mindset with a passion for education\u2014helping security professionals understand not just how exploits work, but why.\",\"sameAs\":[\"https:\\\/\\\/www.corelan-training.com\",\"https:\\\/\\\/instagram.com\\\/corelanc0d3r\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/petervaneeckhoutte\\\/\",\"https:\\\/\\\/x.com\\\/corelanc0d3r\"],\"url\":\"https:\\\/\\\/www.corelan.be\\\/index.php\\\/author\\\/admin0\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to properly restore (objects in) the 2003 AD database - Corelan | Exploit Development & Vulnerability Research","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/","og_locale":"en_US","og_type":"article","og_title":"How to properly restore (objects in) the 2003 AD database - Corelan | Exploit Development & Vulnerability Research","og_description":"Windows 2000 \/Active Directory has been around for more than 7 years now. I've been using AD for almost 7 years, and due to its stability, I never had to recover a deleted object in AD. (Knock on wood). So it's not a real surprise to find out that a lot of admins don't even … Continue reading \"How to properly restore (objects in) the 2003 AD database\"","og_url":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/","og_site_name":"Corelan | Exploit Development & Vulnerability Research","article_publisher":"https:\/\/www.facebook.com\/corelanconsulting","article_published_time":"2007-10-01T22:19:21+00:00","og_image":[{"url":"https:\/\/www.corelan.be\/wp-content\/uploads\/2008\/09\/100207-1818-howtoproper1-thumb.png","type":"","width":"","height":""}],"author":"corelanc0d3r","twitter_card":"summary_large_image","twitter_creator":"@corelanc0d3r","twitter_site":"@corelanc0d3r","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/#article","isPartOf":{"@id":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/"},"author":{"name":"corelanc0d3r","@id":"https:\/\/www.corelan.be\/#\/schema\/person\/3be5542b9b0a0787893db83a5ad68e8f"},"headline":"How to properly restore (objects in) the 2003 AD database","datePublished":"2007-10-01T22:19:21+00:00","mainEntityOfPage":{"@id":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/"},"wordCount":1018,"commentCount":0,"publisher":{"@id":"https:\/\/www.corelan.be\/#organization"},"image":{"@id":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/#primaryimage"},"thumbnailUrl":"https:\/\/www.corelan.be\/wp-content\/uploads\/2008\/09\/100207-1818-howtoproper1-thumb.png","keywords":["backup restore","Active Directory"],"articleSection":["Active Directory","Windows Server"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/","url":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/","name":"How to properly restore (objects in) the 2003 AD database - Corelan | Exploit Development & Vulnerability Research","isPartOf":{"@id":"https:\/\/www.corelan.be\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/#primaryimage"},"image":{"@id":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/#primaryimage"},"thumbnailUrl":"https:\/\/www.corelan.be\/wp-content\/uploads\/2008\/09\/100207-1818-howtoproper1-thumb.png","datePublished":"2007-10-01T22:19:21+00:00","breadcrumb":{"@id":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/#primaryimage","url":"https:\/\/www.corelan.be\/wp-content\/uploads\/2008\/09\/100207-1818-howtoproper1-thumb.png","contentUrl":"https:\/\/www.corelan.be\/wp-content\/uploads\/2008\/09\/100207-1818-howtoproper1-thumb.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.corelan.be\/index.php\/2007\/10\/02\/how-to-properly-restore-objects-in-the-2003-ad-database\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.corelan.be\/"},{"@type":"ListItem","position":2,"name":"How to properly restore (objects in) the 2003 AD database"}]},{"@type":"WebSite","@id":"https:\/\/www.corelan.be\/#website","url":"https:\/\/www.corelan.be\/","name":"Corelan CyberSecurity Research","description":"Corelan publishes in-depth tutorials on exploit development, Windows exploitation, vulnerability research, heap internals, reverse engineering and security tooling used by professionals worldwide.","publisher":{"@id":"https:\/\/www.corelan.be\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.corelan.be\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.corelan.be\/#organization","name":"Corelan CyberSecurity Research","url":"https:\/\/www.corelan.be\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.corelan.be\/#\/schema\/logo\/image\/","url":"https:\/\/www.corelan.be\/wp-content\/uploads\/2026\/03\/corelanlogo2_small-20.png","contentUrl":"https:\/\/www.corelan.be\/wp-content\/uploads\/2026\/03\/corelanlogo2_small-20.png","width":200,"height":200,"caption":"Corelan CyberSecurity Research"},"image":{"@id":"https:\/\/www.corelan.be\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/corelanconsulting","https:\/\/x.com\/corelanc0d3r","https:\/\/x.com\/corelanconsulting","https:\/\/instagram.com\/corelanconsult"]},{"@type":"Person","@id":"https:\/\/www.corelan.be\/#\/schema\/person\/3be5542b9b0a0787893db83a5ad68e8f","name":"corelanc0d3r","pronouns":"he\/him","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","url":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3783bed6acd72d7fa5bb2387d88acbb9a3403e7cada60b2037e1cbb74ad451f9?s=96&d=mm&r=x","caption":"corelanc0d3r"},"description":"Peter Van Eeckhoutte is the founder of Corelan and a globally recognized expert in exploit development and vulnerability research. With over two decades in IT security, he built Corelan into a respected platform for deep technical research, hands-on training, and knowledge sharing. Known for his influential exploit development tutorials, tools, and real-world training, Peter combines a strong research mindset with a passion for education\u2014helping security professionals understand not just how exploits work, but why.","sameAs":["https:\/\/www.corelan-training.com","https:\/\/instagram.com\/corelanc0d3r","https:\/\/www.linkedin.com\/in\/petervaneeckhoutte\/","https:\/\/x.com\/corelanc0d3r"],"url":"https:\/\/www.corelan.be\/index.php\/author\/admin0\/"}]}},"views":4100,"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts\/166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/comments?post=166"}],"version-history":[{"count":0,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/posts\/166\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/media?parent=166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/categories?post=166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.corelan.be\/index.php\/wp-json\/wp\/v2\/tags?post=166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}