Right way to restore deleted objects (in samba 4.1 or newer with or without "ad recycle bin")

[Лыков Михаил]

Hello all!

I operate two-dc domain, based on samba 2:4.1.9+dfsg-1~bpo70+1
Forest function level: (Windows) 2003
Domain function level: (Windows) 2003
Lowest function level of a DC: (Windows) 2008 R2	

AD Recycle bin not enabled (it can be enabled only on Dom.Level 2008R2)

Previous week one of our administrators delete computer accounts from AD 
by accident, and we are not able to restore it.
I try to restore it as shown here: 
https://bugzilla.samba.org/show_bug.cgi?id=10371#c4
because recipe from wiki are only for active "AD recycle bin"
https://wiki.samba.org/index.php/The_Active_Directory_Recycle_Bin#On_a_Samba_DC_2

method from bug (without recycle bin)  - rename object from "Deleted 
objects" to lastknown place by ldbrename, and then delete IsDeleted 
attribute + add objectcategory attribute with ldbedit
after that object can be viewed in ADUC again
What about attributes as "lastKnownParent", "isRecycled" when restore 
objects, must i delete it also?

Why attribute "isRecycled" set, on wiki it present only if recycle bin 
enabled? Is it because replication to second DC are done and "Multi-DC 
Environment: Deleted Objects are Recycled Too Fast"?
I restore objects with attribute "isRecycled" set and clear it, but now 
samba-tool dbcheck show me errors like
"Not moving object 
DC=MYCOMP137\0ADEL:55eb09d2-26a4-4226-9d55-d36cfb37dd34,CN=Deleted 
Objects,DC=DomainDnsZones,DC=dc,DC=mydom,DC=ru into LostAndFound
ERROR: parent object not found for 
DC=SAMG18\0ADEL:8f40e027-6757-44e8-b5ee-3651ab0421b0,CN=Deleted 
Objects,DC=DomainDnsZones,DC=dc,DC=samges,DC=ru"
If i run samva-tool dbcheck --fix, is it safe to fix it?

Second question is about lost attributes after restore by this methods.
Many attributes are lost, and after restore deleted machine account that 
computer cannot login to domain, saying "there are no trust with that 
domain" (from my memory).
In samba log, for example, I see errors like
"auth_check_password_recv: sam_ignoredomain authentication for user 
[MYDOMAIN\MYWS194$] FAILED with error NT_STATUS_WRONG_PASSWORD"
I googling and find that deleting attributes when move it to "deleted 
objects" are controlled by "searchflags" attribute, as listed here:
https://msdn.microsoft.com/en-us/library/ms679765(v=vs.85).aspx#windows_server_2003_r2
If I set for some attribute in schema an "8 (0x00000008)" value (in sum 
with other) that attribute must saved.  But for edit the schema i must 
set special permissions,
are worth it?
Or I need to enable recycle bin and not to mess with schema editing and 
searchflags (additionaly I don't know which attributes I need to preserve)?

Third question:
What are right sequence for raise functional level for domain with 
samba-tool domain level raise --domain-level=2008_R2 ?
Run it on DC with no FSMO roles and then on DC with it, and that's done? 
How to see that it successful other than "domain level show", is it 
affect replication?

After raise level and run (found in sources) enablerecyclebin script - 
how I can restore objects, with ldbmodify as it shown on wiki, and all 
needed
(for communicate with computer account, for example) attribites are 
restored?
A. Bartlett wrote in 
https://bugzilla.samba.org/show_bug.cgi?id=10371#c27 about "Recycle bin 
not tested and therefore unsupported".
Are there a version there it is working, is it working in samba 4.1, 4.2 
or 4.4  (debian stable or testing)?

What about a changelog for samba 4.5: "Samba now supports tombstone 
reanimation, a feature in the AD DC allowing tombstones, that is objects 
which have been deleted, to be restored with the original SID and GUID 
still in place."
But are this "tombstone reanimation" conflicts with enabled "recycle 
bin" ? (#10371 comment 25)
wiki stated that "Windows Tools for Restoring Deleted Objects Does Not 
Work", but #1071 comment says about working "adrestore -r" ?

I find an Marc Muehlfeld's letter about similar themes :) 
https://lists.samba.org/archive/samba-technical/2016-August/115719.html


-- 
Mike Lykov, system administrator, Russia