Inspect a directory snapshot with DSAMAIN

What a directory snapshot gives you

An AD snapshot lets you inspect a historical directory through a separate LDAP endpoint. You can compare old and current values or inspect a backup before choosing a recovery point. You’re looking at directory data, though, rather than running an old DC. Nothing is automatically merged into production.

Use a privileged administrative session on an appropriate AD DS server. Snapshot creation consumes storage; mounted backups contain sensitive directory data. Keep the listener and files in the recovery environment and close them when finished.

List available snapshots

ntdsutil "activate instance ntds" snapshot "list all" quit quit

If a new point-in-time copy is required, this creates a VSS snapshot:

ntdsutil "activate instance ntds" snapshot create quit quit

The snapshot captures the state when created. Creating one after an accidental edit cannot recover the earlier value.

Mount the selected snapshot

In Ntdsutil’s snapshot context, run list all, identify the required snapshot’s index or GUID, and use mount with that exact value. Record the returned mount path. Avoid choosing the first entry merely because an example used index 1.

The file-system mount and the LDAP database mount are separate steps. Mounting the snapshot makes files available; DSAMAIN exposes the database to directory tools.

Expose the database on unused ports

In PowerShell, use a single-quoted literal path when it contains $SNAP_. Replace this example with the mount path actually returned on your server:

dsamain.exe -dbpath 'C:\$SNAP_202611111200_VOLUMEC$\Windows\NTDS\ntds.dit' `
    -ldapport 51389 -sslport 51636 -gcport 53268 -gcsslport 53269

This starts a process and opens listeners, so check the ports are unused first. The TLS listener options still need the appropriate certificates. If access fails, investigate the permissions before adding -allowNonAdminAccess. DSAMAIN’s command reference covers the options and database consistency requirements.

Connect explicitly to the historical endpoint

In LDP, connect to localhost on port 51389, bind, and query RootDSE. Then search the appropriate historical naming context. Keep the old and live connection windows clearly identified, including the server and port.

The AD PowerShell module can also address a mounted snapshot when AD Web Services on the hosting server exposes that instance. The module connects to ADWS on TCP 9389; the port in -Server identifies the directory instance that ADWS accesses locally. It does not make the module a direct LDAP client. This is why LDP can succeed on the snapshot’s LDAP port while the module fails because ADWS is unavailable. Microsoft’s server/port reference explicitly includes snapshot instances.

$historical = 'dc1.contoso.com:51389'
$snapshotRoot = Get-ADRootDSE -Server $historical
$snapshotRoot | Format-List dnsHostName,defaultNamingContext,namingContexts
Get-ADUser -Server $historical -SearchBase $snapshotRoot.defaultNamingContext `
    -LDAPFilter '(sAMAccountName=alice)' -Properties description,whenChanged |
    Select-Object ObjectGUID,DistinguishedName,description,whenChanged

Use the hosting server’s name, the selected instance port and the snapshot’s own naming context. Get-ADUser’s supported targets include AD snapshot instances. The mounted view remains read-only; a write-capable cmdlet name does not make historical data writable.

Compare identities as well as values

Use the object’s GUID and former parent to ensure the historical object is the one you intend. Compare the specific attributes relevant to the incident. A matching display name can belong to another object created later.

The snapshot can help you decide which values to correct. You can’t restore a user’s password by copying visible LDAP values, and an LDIF export won’t necessarily preserve links, security descriptors and all metadata. Object recovery explains the different recovery cases.

Compare a property by GUID

A DN can change because an object or its parent moved. Once the intended GUID has been identified in the snapshot, use the same identity on the live replica:

$old = Get-ADUser -Server $historical -Identity 'alice' -Properties description
$current = Get-ADUser -Server 'dc1.contoso.com' -Identity $old.ObjectGUID `
    -Properties description
[pscustomobject]@{
    ObjectGUID = $old.ObjectGUID
    HistoricalDN = $old.DistinguishedName
    CurrentDN = $current.DistinguishedName
    HistoricalDescription = $old.description
    CurrentDescription = $current.description
}

These commands only compare values. Before changing production, check the differences and which application owns the attribute. If the GUID doesn’t resolve live, the object may have been deleted, or the query may be incomplete or aimed at the wrong partition. Don’t substitute a new object just because its account name matches.

Distinguish mounting failure from directory-access failure

Do not use -allowUpgrade as a default attempt to open a database on a different Windows release. Version/page-format compatibility is part of backup selection, especially with 32 KB capable databases. Preserve the original recovery media before any operation that can change its format.

Shut down and unmount

Stop DSAMAIN, then return to Ntdsutil’s snapshot context and unmount the snapshot you used. Avoid unmount * when other administrators or recovery sessions share the server. Check that the listener stopped and record which snapshot you inspected.