Create snapshots with Active Directory Explorer (AD Explorer) from Sysinternals

[TomWechsler]

Hi Windows Active Directory Friends,

Wouldn't it be interesting to know what change there was in our Windows Active Directory? If there was a change, what exactly has changed since yesterday, for example? You can answer exactly such questions when you create snapshots with AD Explorer. You can then compare these snapshots.

(Attention, this snapshot is a kind of copy, but is not to be confused with a snapshot like you get from Hyper-V (for example) where you can go back to a previous state.)

How this works exactly, I will explain in this post. Let's go!

As a first step we organize the AD Explorer from Sysinternals. To do this, you can either navigate directly to the Live Internals page:
https://live.sysinternals.com/

or you go to the following URL:
https://docs.microsoft.com/en-us/sysinternals/downloads/adexplorer

I have stored the AD Explorer directly on my domain controller. This does not have to be the case, you can also store the AD Explorer on another system that is a member of the domain.

With a double click on the AD Explorer you get a first message. Confirm the EULA.

Now we need to establish a connection with the domain controller. Specify the name of the DC, the account of the domain administrator and the password click OK.

Now we are connected to the Active Directory. Navigate to File in the menu and select "Create Snapshot".

Give the snapshot a name and specify the location and click OK.

I placed the snapshot in the C:\Temp drive.

Navigate back to the menu on File and select "Connect". But now select the following:
"Enter the path of the previous snapshot to load" and navigate to the location of your snapshot.

The snapshot is now visible in AD Explorer.

Now let's imagine a leap in time. A day later, you create another snapshot, just as you created
the first one. Load the second Snapshot into the tool along with the first Snapshot.

Mark the first snapshot as in the picture above. Navigate to "Compare" in the menu and select "Compare Snapshot". At "Select an archive to compare to", find your second snapshot. Then click Compare.

Bingo! Now you know what has changed in Active Directory between one day.

With this great tool from Windows Sysinternals Suite you can super manage and monitor your Windows Active Directory. I hope I could give you a little idea how to use AD Explorer among other things.

Thank you and kind regards, Tom Wechsler

[#2]

Scenario: take a snapshot before you raise the forest/domain functional level, Can you use it to rollback from the previous functional level?

[#3]

An Active Directory snapshot and raise the forest/domain functional level are not directly related. Regards, Tom Wechsler

[#4]

Hello. I'm very curious how manually taking so many steps affects security because the data write path is created, I would rather not use it because manual configuration is always a risk of error - not predictable, and the information obtained is basically not important and necessary! Thank you very much! .

[#5]

Would it be possible to automate the snapshot creation to once pr day?

[#6]

The term snapshot in this case refers to the Sysinternals terminology (more precisely to the AD Explorer tool). This snapshot is not comparable to checkpoints in Hyper-V or snapshots in VMWare. Kind regards, Tom Wechsler