Before I begin, I will be the first to admit that much of you this problem stemmed from failing to follow best practices pertaining to deployment and disaster recovery of AD servers. Much has been learned from this going forward, but right now I’m just trying to do damage control before reestablishing best practices.
Currently I have a WS2016 Domain Controller (unfortunately I failed to create a second one before my problem occurred). I seriously botched some DNS modifications and I’m needing to roll back to a snapshot I created shortly after setting up the AD/DNS/DHCP roles. My problem is that I do not have any backups/save states in between then and the botched DNS problem.
My hope was to backup and restore the different components individually (such as GPOs, DHCP configurations, registry, and AD database (especially Users and Computers)) without restoring the entire save state or server. As I don’t have any full backups or save states that include the users and computers from before this problem, I don’t believe restoring the server state backup I have would solve my issue.
I have already created individual backups for GPOs, DHCP configurations, and registry. However, I am struggling to figure out how to backup and restore the Users and Computers components.
I would rather not start completely over with a new AD, as migrating users would be cancerous. If there is not a way to backup and restore Users and Computers, I would also be comfortable with a solution that allows me to manually recreate every user and computer in such a way that would be compatible with the restored GPOs. Additionally, if there’s a way to backup the entire AD database without requiring a full server restore, that would also be acceptable.
After fixing this my plan is to setup a proper secondary DC, schedule regular backups, and require snapshots before every attempt to modify the server. But, I need to have this targeted restore handled first.
EDIT: Turns out my DNS problem was a lot easier to fix than I thought. I was getting access denied when trying to load several AD-related snap-ins, such as DNS or Active Directory Administrative Services. Additionally, joining new computers to the domain was resulting in errors. This was the solution: https://support.microsoft.com/en-us/help/2751452/dns-zones-do-not-load-event-4000-4007
Due to this fix, I no longer have this backup problem, but I have marked Massimo's answer as correct to my original question, as it is good to know that partial/separate backups of AD are not possible and that DNS is tied into AD database. Very much noted to take more regular state and full server backups!
