Create snapshots with Active Directory Explorer (AD Explorer) from Sysinternals

%3CLINGO-SUB%20id%3D%22lingo-sub-2232412%22%20slang%3D%22en-US%22%3ECreate%20snapshots%20with%20Active%20Directory%20Explorer%20(AD%20Explorer)%20from%20Sysinternals%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2232412%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Windows%20Active%20Directory%20Friends%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWouldn't%20it%20be%20interesting%20to%20know%20what%20change%20there%20was%20in%20our%20Windows%20Active%20Directory%3F%3CBR%20%2F%3EIf%20there%20was%20a%20change%2C%20what%20exactly%20has%20changed%20since%20yesterday%2C%20for%20example%3F%20You%20can%20answer%3CBR%20%2F%3Eexactly%20such%20questions%20when%20you%20create%20snapshots%20with%20AD%20Explorer.%20You%20can%20then%20compare%20these%3CBR%20%2F%3Esnapshots.%20How%20this%20works%20exactly%2C%20I%20will%20explain%20in%20this%20post.%20Let's%20go!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20a%20first%20step%20we%20organize%20the%20AD%20Explorer%20from%20Sysinternals.%20To%20do%20this%2C%20you%20can%20either%20navigate%3CBR%20%2F%3Edirectly%20to%20the%20Live%20Internals%20page%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Flive.sysinternals.com%2F%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Flive.sysinternals.com%2F%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eor%20you%20go%20to%20the%20following%20URL%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fsysinternals%2Fdownloads%2Fadexplorer%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fsysinternals%2Fdownloads%2Fadexplorer%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20stored%20the%20AD%20Explorer%20directly%20on%20my%20domain%20controller.%20This%20does%20not%20have%20to%20be%20the%20case%2C%3CBR%20%2F%3Eyou%20can%20also%20store%20the%20AD%20Explorer%20on%20another%20system%20that%20is%20a%20member%20of%20the%20domain.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWith%20a%20double%20click%20on%20the%20AD%20Explorer%20you%20get%20a%20first%20message.%20Confirm%20the%20EULA.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ADExplorer_1.JPG%22%20style%3D%22width%3A%20200px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F266655i471CD6EDA93771C3%2Fimage-size%2Fsmall%3Fv%3Dv2%26amp%3Bpx%3D200%22%20role%3D%22button%22%20title%3D%22ADExplorer_1.JPG%22%20alt%3D%22ADExplorer_1.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20we%20need%20to%20establish%20a%20connection%20with%20the%20domain%20controller.%20Specify%20the%20name%20of%20the%20DC%2C%20the%3CBR%20%2F%3Eaccount%20of%20the%20domain%20administrator%20and%20the%20password%20click%20OK.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ADExplorer_2.JPG%22%20style%3D%22width%3A%20279px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F266656iD297C3269B187FCD%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22ADExplorer_2.JPG%22%20alt%3D%22ADExplorer_2.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20we%20are%20connected%20to%20the%20Active%20Directory.%20Navigate%20to%20File%20in%20the%20menu%20and%20select%20%22Create%20Snapshot%22.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ADExplorer_3.JPG%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F266657i0F257CCBBBBA2715%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22ADExplorer_3.JPG%22%20alt%3D%22ADExplorer_3.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EGive%20the%20snapshot%20a%20name%20and%20specify%20the%20location%20and%20click%20OK.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ADExplorer_4.JPG%22%20style%3D%22width%3A%20372px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F266658iF06EE46A5EC96C35%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22ADExplorer_4.JPG%22%20alt%3D%22ADExplorer_4.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20placed%20the%20snapshot%20in%20the%20C%3A%5CTemp%20drive.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ADExplorer_5.JPG%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F266659i602EB2979DC56ECA%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22ADExplorer_5.JPG%22%20alt%3D%22ADExplorer_5.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENavigate%20back%20to%20the%20menu%20on%20File%20and%20select%20%22Connect%22.%20But%20now%20select%20the%20following%3A%3CBR%20%2F%3E%22Enter%20the%20path%20of%20the%20previous%20snapshot%20to%20load%22%20and%20navigate%20to%20the%20location%20of%20your%20snapshot.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ADExplorer_6.JPG%22%20style%3D%22width%3A%20327px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F266660iDECBA1C0316894D3%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22ADExplorer_6.JPG%22%20alt%3D%22ADExplorer_6.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20snapshot%20is%20now%20visible%20in%20AD%20Explorer.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ADExplorer_7.JPG%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F266661iA7FDCAC43C41DEF6%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22ADExplorer_7.JPG%22%20alt%3D%22ADExplorer_7.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENow%20let's%20imagine%20a%20leap%20in%20time.%20A%20day%20later%2C%20you%20create%20another%20snapshot%2C%20just%20as%20you%20created%3CBR%20%2F%3Ethe%20first%20one.%20Load%20the%20second%20Snapshot%20into%20the%20tool%20along%20with%20the%20first%20Snapshot.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ADExplorer_8.JPG%22%20style%3D%22width%3A%20309px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F266663i57C89AB08979F43C%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22ADExplorer_8.JPG%22%20alt%3D%22ADExplorer_8.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMark%20the%20first%20snapshot%20as%20in%20the%20picture%20above.%20Navigate%20to%20%22Compare%22%20in%20the%20menu%20and%20select%20%22Compare%20Snapshot%22.%20At%20%22Select%20an%20archive%20to%20compare%20to%22%2C%20find%20your%20second%20snapshot.%20Then%20click%20Compare.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ADExplorer_8b.JPG%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F266664i8AA4410008422425%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22ADExplorer_8b.JPG%22%20alt%3D%22ADExplorer_8b.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EBingo!%3C%2FSTRONG%3E%20Now%20you%20know%20what%20has%20changed%20in%20Active%20Directory%20between%20one%20day.%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22ADExplorer_9.JPG%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F266665iD5FBEC1893080994%2Fimage-size%2Fmedium%3Fv%3Dv2%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22ADExplorer_9.JPG%22%20alt%3D%22ADExplorer_9.JPG%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWith%20this%20great%20tool%20from%20Windows%20Sysinternals%20Suite%20you%20can%20super%20manage%20and%20monitor%20your%20Windows%20Active%20Directory.%20I%20hope%20I%20could%20give%20you%20a%20little%20idea%20how%20to%20use%20AD%20Explorer%20among%20other%20things.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you%20and%20kind%20regards%2C%20Tom%20Wechsler%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2238993%22%20slang%3D%22en-US%22%3ERe%3A%20Create%20snapshots%20with%20Active%20Directory%20Explorer%20(AD%20Explorer)%20from%20Sysinternals%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2238993%22%20slang%3D%22en-US%22%3EScenario%3A%20take%20a%20snapshot%20before%20you%20raise%20the%20forest%2Fdomain%20functional%20level%2C%20Can%20you%20use%20it%20to%20rollback%20from%20the%20previous%20functional%20level%3F%3C%2FLINGO-BODY%3E
MVP

 

Hi Windows Active Directory Friends,

 

Wouldn't it be interesting to know what change there was in our Windows Active Directory?
If there was a change, what exactly has changed since yesterday, for example? You can answer
exactly such questions when you create snapshots with AD Explorer. You can then compare these
snapshots. How this works exactly, I will explain in this post. Let's go!

 

As a first step we organize the AD Explorer from Sysinternals. To do this, you can either navigate
directly to the Live Internals page:
https://live.sysinternals.com/

 

or you go to the following URL:
https://docs.microsoft.com/en-us/sysinternals/downloads/adexplorer

 

I have stored the AD Explorer directly on my domain controller. This does not have to be the case,
you can also store the AD Explorer on another system that is a member of the domain.

 

With a double click on the AD Explorer you get a first message. Confirm the EULA.

ADExplorer_1.JPG

 

Now we need to establish a connection with the domain controller. Specify the name of the DC, the
account of the domain administrator and the password click OK.

ADExplorer_2.JPG

 

Now we are connected to the Active Directory. Navigate to File in the menu and select "Create Snapshot".

ADExplorer_3.JPG

 

Give the snapshot a name and specify the location and click OK.

ADExplorer_4.JPG

 

I placed the snapshot in the C:\Temp drive.

ADExplorer_5.JPG

 

Navigate back to the menu on File and select "Connect". But now select the following:
"Enter the path of the previous snapshot to load" and navigate to the location of your snapshot.

ADExplorer_6.JPG

 

The snapshot is now visible in AD Explorer.

ADExplorer_7.JPG

 

Now let's imagine a leap in time. A day later, you create another snapshot, just as you created
the first one. Load the second Snapshot into the tool along with the first Snapshot.

ADExplorer_8.JPG

 

Mark the first snapshot as in the picture above. Navigate to "Compare" in the menu and select "Compare Snapshot". At "Select an archive to compare to", find your second snapshot. Then click Compare.

ADExplorer_8b.JPG

 

Bingo! Now you know what has changed in Active Directory between one day.

ADExplorer_9.JPG

 

With this great tool from Windows Sysinternals Suite you can super manage and monitor your Windows Active Directory. I hope I could give you a little idea how to use AD Explorer among other things.

 

Thank you and kind regards, Tom Wechsler

3 Replies
Scenario: take a snapshot before you raise the forest/domain functional level, Can you use it to rollback from the previous functional level?
An Active Directory snapshot and raise the forest/domain functional level are not directly related. Regards, Tom Wechsler
Hello. I'm very curious how manually taking so many steps affects security because the data write path is created, I would rather not use it because manual configuration is always a risk of error - not predictable, and the information obtained is basically not important and necessary! Thank you very much! .
www.000webhost.com