Fine-grained recovery method and device of activity directory, computer equipment and medium

Abstract

The invention relates to a fine-grained recovery method and device of an activity directory, computer equipment, a computer readable storage medium and a computer program product, and can be used in the technical field of computers. The method comprises the following steps: receiving identification information of a to-be-recovered target object aiming at an active directory; acquiring data in a recycle bin of the active directory, and matching the identification information with the data in the recycle bin to obtain a matching result; under the condition that the matching result shows that the matching is successful, recovering the target object from the recycle bin; comparing the attribute information of the target object with backup attribute information corresponding to the target object in a backup set of the active directory to obtain a comparison result; under the condition that the comparison result shows that the difference exists, the target object is updated according to the backup attribute information, and a recovery object of the active directory is obtained. By adopting the method, the object recovery efficiency can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a fine-grained recovery method and device of active directory, computer equipment, computer readable storage medium and computer program product. BACKGROUND

[0002] With the continuous development of informatization construction, directory service technology gradually becomes the core component of enterprise infrastructure. Among them, active directory is widely used in enterprises and organizations, which is used to uniformly manage core resources such as accounts, computers, group policies, permissions, etc. How to efficiently recover the active directory has become an important research direction.

[0003] The traditional technology usually recovers the objects of the active directory through the system state backup mode; however, the recovery through this mode needs to use command line tools or scripts for operation, resulting in low efficiency of object recovery. SUMMARY

[0004] Therefore, it is necessary to provide a fine-grained recovery method, device, computer equipment, computer readable storage medium and computer program product of active directory, which can improve the efficiency of object recovery.

[0005] In a first aspect, the present application provides a fine-grained recovery method of active directory. The method comprises:

[0006] receiving identification information of a target object to be recovered in the active directory;

[0007] obtaining data in the recycle bin of the active directory, matching the identification information with the data in the recycle bin, and obtaining a matching result;

[0008] in the case that the matching result indicates a successful match, recovering the target object from the recycle bin;

[0009] comparing attribute information of the target object with backup attribute information corresponding to the target object in the backup set of the active directory, and obtaining a comparison result;

[0010] in the case that the comparison result indicates a difference, updating the target object according to the backup attribute information, and obtaining a recovery object of the active directory.

[0011] In one of the embodiments, after obtaining the data in the recycle bin of the active directory, matching the identification information with the data in the recycle bin, and obtaining a matching result, it further comprises:

[0012] In a case where the matching result indicates a matching failure, obtaining the backup attribute information from the backup set;

[0013] According to the backup attribute information, performing a reconstruction process on the target object to obtain the recovery object.

[0014] In one of the embodiments, the method further comprises:

[0015] According to each object in the active directory, constructing a directory tree of the active directory;

[0016] According to the number of child nodes of each node of the directory tree, determining task information of the node;

[0017] According to the task information of each node, performing a backup process on the node to obtain attribute information of the object;

[0018] According to the attribute information of each object, constructing the backup set.

[0019] In one of the embodiments, the determining of the task information of each node according to the number of child nodes of each node of the directory tree comprises:

[0020] According to the number of child nodes of each node, classifying the node into a batch processing node and a single processing node;

[0021] The task information of each node comprises a batch acquisition task corresponding to the batch processing node and a single acquisition task corresponding to the single processing node.

[0022] In one of the embodiments, the performing of the backup process on each node according to the task information of each node to obtain attribute information of each object comprises:

[0023] Through a first type of thread, performing a backup process on the batch processing node according to the batch acquisition task to obtain attribute information of a first object;

[0024] Through a second type of thread, performing a backup process on the single processing node according to the single acquisition task to obtain attribute information of a second object;

[0025] According to the attribute information of the first object and the attribute information of the second object, determining the attribute information of each object.

[0026] In one of the embodiments, the constructing of the directory tree of the active directory according to each object in the active directory comprises:

[0027] Obtaining identification information of each object in the active directory;

[0028] According to the identification information of each object, a directory tree of the active directory is constructed.

[0029] In a second aspect, the present application provides an active directory fine-grained recovery device.

[0030] An information receiving module is configured to receive identification information of a target object to be recovered in the active directory;

[0031] A data obtaining module is configured to obtain data in a recycle bin of the active directory, match the identification information with the data in the recycle bin, and obtain a matching result;

[0032] An object recovery module is configured to recover the target object from the recycle bin when the matching result indicates a matching success;

[0033] An information processing module is configured to compare attribute information of the target object with backup attribute information corresponding to the target object in a backup set of the active directory, and obtain a comparison result;

[0034] An object processing module is configured to update the target object according to the backup attribute information when the comparison result indicates a difference, and obtain a recovery object of the active directory.

[0035] In a third aspect, the present application provides a computer device. The computer device comprises a memory and a processor. The memory stores a computer program. The processor implements the following steps when executing the computer program:

[0036] Receiving identification information of a target object to be recovered in the active directory;

[0037] Obtaining data in a recycle bin of the active directory, matching the identification information with the data in the recycle bin, and obtaining a matching result;

[0038] Recovering the target object from the recycle bin when the matching result indicates a matching success;

[0039] Comparing attribute information of the target object with backup attribute information corresponding to the target object in a backup set of the active directory, and obtaining a comparison result;

[0040] Updating the target object according to the backup attribute information when the comparison result indicates a difference, and obtaining a recovery object of the active directory.

[0041] In a fourth aspect, the present application provides a computer readable storage medium. The computer readable storage medium has a computer program stored thereon, and the computer program, when executed by a processor, implements the following steps:

[0042] receiving identification information of a target object to be recovered in an active directory;

[0043] obtaining data in a recycle bin of the active directory, matching the identification information with the data in the recycle bin to obtain a matching result;

[0044] recovering the target object from the recycle bin when the matching result indicates a successful matching;

[0045] comparing attribute information of the target object with backup attribute information corresponding to the target object in a backup set of the active directory to obtain a comparison result;

[0046] updating the target object according to the backup attribute information to obtain a recovered object of the active directory when the comparison result indicates a difference.

[0047] In a fifth aspect, the present application provides a computer program product. The computer program product comprises a computer program, and the computer program, when executed by a processor, implements the following steps:

[0048] receiving identification information of a target object to be recovered in an active directory;

[0049] obtaining data in a recycle bin of the active directory, matching the identification information with the data in the recycle bin to obtain a matching result;

[0050] recovering the target object from the recycle bin when the matching result indicates a successful matching;

[0051] comparing attribute information of the target object with backup attribute information corresponding to the target object in a backup set of the active directory to obtain a comparison result;

[0052] updating the target object according to the backup attribute information to obtain a recovered object of the active directory when the comparison result indicates a difference.

[0053] The activity directory fine-grained recovery method, device, computer device, computer readable storage medium and computer program product, receive identification information of a target object to be recovered of an activity directory; obtain data in a recycle bin of the activity directory, and perform matching processing on the identification information and the data in the recycle bin to obtain a matching result; in a case where the matching result indicates a matching success, recover the target object from the recycle bin; compare attribute information of the target object with backup attribute information corresponding to the target object in a backup set of the activity directory to obtain a comparison result; in a case where the comparison result indicates a difference, update the target object according to the backup attribute information to obtain a recovery object of the activity directory. The scheme receives the identification information of the target object to be recovered of the activity directory, and performs matching processing on the identification information and the data in the recycle bin of the activity directory, which is beneficial to quickly and accurately positioning the target object to be recovered; in a case where the matching result indicates a matching success, the target object is preferentially recovered from the recycle bin, which is beneficial to fully utilizing existing object data in the recycle bin, thereby being beneficial to improving the efficiency of the recovery operation; by comparing the attribute information of the target object with the backup attribute information corresponding to the target object in the backup set of the activity directory, and in a case where the comparison result indicates a difference, updating the target object according to the backup attribute information, it is beneficial to avoid unnecessary attribute modification operation, thereby being beneficial to improving the efficiency of object recovery. BRIEF DESCRIPTION OF DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the following will briefly introduce the drawings needed to be used in the embodiments or the related art description. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0055] Figure 1 A flowchart of the activity directory fine-grained recovery method in an embodiment;

[0056] Figure 2 A flowchart of the backup step in an embodiment;

[0057] Figure 3 A flowchart of the recovery step in an embodiment;

[0058] Figure 4 A structural block diagram of the activity directory fine-grained recovery device in an embodiment;

[0059] Figure 5 An internal structure diagram of the computer device in an embodiment. DETAILED DESCRIPTION

[0060] In order to make the purposes, technical solutions and advantages of the present application clearer, further detailed description will be given below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application and not to limit the present application.

[0061] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0062] In an exemplary embodiment, as shown in Figure 1 A fine-grained recovery method of an active directory is provided, and the present embodiment takes the method applied to a terminal as an example; it should be understood that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is realized through the interaction between the terminal and the server. The terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, etc.; the server can be a standalone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. In the present embodiment, the method includes the following steps:

[0063] Step S101, receiving identification information of a target object to be recovered of an active directory;

[0064] Step S102, obtaining data in a recycle bin of the active directory, and performing matching processing on the identification information and the data in the recycle bin to obtain a matching result;

[0065] Step S103, in the case that the matching result indicates that the matching is successful, recovering the target object from the recycle bin;

[0066] Step S104, comparing attribute information of the target object with backup attribute information corresponding to the target object in a backup set of the active directory to obtain a comparison result;

[0067] Step S105, in the case that the comparison result indicates that there is a difference, updating the target object according to the backup attribute information to obtain a recovery object of the active directory.

[0068] The active directory can be a directory service, which is applied to enterprises and organizations, and is used to uniformly manage core resources such as user accounts, computers, group policies, permissions, etc., for example, the active directory can be Active Directory (AD for short).

[0069] The target object to be recovered can be a specific data entity in the active directory that needs to be recovered. For example, the target object can be an entry (e.g., an entry of the active directory).

[0070] The identification information can be information for uniquely identifying an object in the active directory. For example, the identification information can be a distinguished name (DN).

[0071] The recycle bin of the active directory can be a storage area in the active directory system for storing deleted objects.

[0072] The matching process can be a process of comparing and corresponding the identification information of the target object to be recovered with the data in the recycle bin.

[0073] The matching result can be a matching result obtained after the identification information is matched with the data in the recycle bin.

[0074] The attribute information of the target object can be various attribute data contained in the target object recovered from the recycle bin, such as current attribute information.

[0075] The backup set of the active directory can be a backup data set formed by scanning the entire active directory, obtaining all DNs, and saving the entry as an ldif format (file format). For example, the backup set of the active directory can be a data set formed by using a multi-channel parallel backup algorithm to backup the entire active directory.

[0076] The backup attribute information can be attribute data corresponding to the target object to be recovered stored in the backup set of the active directory. For example, the backup attribute information can be attr (attribute) information of the entry in the backup set.

[0077] The comparison process can be a process of comparing and analyzing the attribute information of the target object recovered from the recycle bin with the backup attribute information corresponding to the target object in the backup set of the active directory. For example, the comparison process can be a process of comparing whether the attr under the entry is consistent with the backup set.

[0078] The comparison result can be a comparison result obtained after the attribute information of the target object and the backup attribute information corresponding to the target object in the backup set of the active directory are compared.

[0079] The update process can be a process of modifying the attributes of the target object recovered from the recycle bin according to the backup attribute information corresponding to the target object in the backup set of the active directory.

[0080] The recovery object of the active directory can be a target object after update processing, and attribute information of the target object is consistent with backup attribute information corresponding to the target object in the backup set of the active directory. For example, the recovery object of the active directory can be a final recovery result after fine-grained recovery without interrupting current active directory service.

[0081] Optionally, the terminal receives identification information of a target object to be recovered of the active directory, the identification information is distinguished name (DN), the terminal acquires all data in the recycle bin of the active directory, and performs matching processing on the identification information and the data in the recycle bin. The matching result is obtained by comparing whether the id (identification) in the identification information is in the recycle bin. In the case where the matching result indicates matching success, the terminal calls an interface to recover the target object from the recycle bin, compares attribute information of the target object with backup attribute information corresponding to the target object in the backup set of the active directory, and obtains a comparison result by comparing whether attr under entry is consistent with the backup set. In the case where the comparison result indicates difference, the terminal updates the target object according to the backup attribute information, specifically, performs overwrite operation if inconsistent, and obtains a recovery object of the active directory, thereby realizing fine-grained recovery without interrupting current active directory service.

[0082] In the fine-grained recovery method of the active directory, identification information of a target object to be recovered of the active directory is received, data in a recycle bin of the active directory is acquired, matching processing is performed on the identification information and the data in the recycle bin, and a matching result is obtained. In the case where the matching result indicates matching success, the target object is recovered from the recycle bin. Attribute information of the target object is compared with backup attribute information corresponding to the target object in a backup set of the active directory, and a comparison result is obtained. In the case where the comparison result indicates difference, the target object is updated according to the backup attribute information, and a recovery object of the active directory is obtained. The scheme is advantageous in quickly and accurately positioning the target object to be recovered by receiving the identification information of the target object to be recovered of the active directory and performing matching processing on the identification information and data in the recycle bin of the active directory. The scheme is advantageous in fully utilizing existing object data in the recycle bin by preferentially recovering the target object from the recycle bin in the case where the matching result indicates matching success, thereby improving the efficiency of recovery operation. The scheme is advantageous in avoiding unnecessary attribute modification operation by comparing the attribute information of the target object with the backup attribute information corresponding to the target object in the backup set of the active directory and updating the target object according to the backup attribute information in the case where the comparison result indicates difference, thereby improving the efficiency of object recovery.

[0083] In an example embodiment, after the identification information is matched with the data in the recycle bin of the active directory, and a matching result is obtained, the method further includes: in a case where the matching result indicates a matching failure, obtaining backup attribute information from the backup set; and performing a reconstruction process on the target object according to the backup attribute information to obtain a recovery object.

[0084] The matching failure can be a result state that the identification information fails to find a corresponding object after being matched with the data in the recycle bin of the active directory.

[0085] The reconstruction process can be a process of completely constructing the target object according to backup attribute information corresponding to the target object in the backup set of the active directory, in a case where the target object cannot be found in the recycle bin of the active directory.

[0086] Optionally, in a case where the matching result indicates a matching failure, the terminal obtains backup attribute information corresponding to the target object to be recovered from a backup set of the active directory, and the backup set is a data set formed by scanning the entire active directory, obtaining all distinguished names (DNs), and saving entry parsing in an ldif format. The terminal performs a reconstruction process on the target object to be recovered according to the backup attribute information, the reconstruction process includes a process of obtaining the entire entry from the backup set to reconstruct, and a recovery object of the active directory is obtained, so that even in a case where the target object cannot be found in the recycle bin, fine-grained recovery can be completed through the backup set without interrupting the current active directory service.

[0087] The technical solution provided in the embodiment is advantageous in ensuring that complete object recovery can be completed even in a case where the recycle bin fails to provide the target object, thereby being advantageous in enhancing the reliability and integrity of the recovery operation.

[0088] In an example embodiment, the method further includes: constructing a directory tree of the active directory according to each object in the active directory; determining task information of each node of the directory tree according to a number of child nodes of each node; performing a backup process on each node according to the task information of each node to obtain attribute information of each object; and constructing the backup set according to the attribute information of each object.

[0089] The each object in the active directory can be all data entities in the active directory system.

[0090] The directory tree of the active directory can be a hierarchical tree structure built by the objects in the active directory, reflecting the parent-child relationship and hierarchical relationship between the objects, for example, the directory tree of the active directory can be a tree structure built by all distinguished names (DN).

[0091] The nodes of the directory tree can be each specific tree node in the directory tree of the active directory, corresponding to the objects in the active directory, for example, the nodes of the directory tree can be each entry node in the directory tree.

[0092] The number of child nodes can be the number of direct subordinate nodes contained under each node of the directory tree.

[0093] The task information can be the task type and processing method information determined according to the number of child nodes of each node of the directory tree, for guiding the backup processing.

[0094] The backup processing can be the data acquisition and saving processing of each node of the directory tree.

[0095] Optionally, the terminal builds the directory tree of the active directory by acquiring all distinguished names (DN) according to the objects in the active directory, and the directory tree is a tree structure reflecting the hierarchical relationship between the objects. The terminal determines the task information of each node of the directory tree according to the number of child nodes of each node, specifically, if the number of child nodes is in the range of 200-2000, the task information of a batch download task is created, and if the number of child nodes is not in the above range, the task information of a single entry download task is created. The terminal determines whether to start multiple threads according to the total number of nodes, at least two threads are started, one thread processes batch tasks, and one thread processes single entry tasks, and according to the task information of each node, the backup processing of each node is performed, including batch acquisition of entries or download of single entries, and then parsing and saving as ldif format to obtain attribute information of each object. The terminal builds a backup set of the active directory according to the attribute information of each object, and implements a multi-channel parallel backup algorithm for the backup of the entire active directory.

[0096] The technical scheme provided by the embodiment is advantageous in establishing a hierarchical data processing structure and adopting differentiated processing strategies according to the data scale of different nodes, thereby being advantageous in improving the efficiency of backup processing; the attribute information of each object is obtained by performing backup processing on each node according to the task information of each node, and a backup set is constructed according to the attribute information of each object, which is advantageous in realizing targeted backup processing and forming a complete backup data set, thereby being advantageous in improving the efficiency of backup operation.

[0097] In an exemplary embodiment, the task information of each node is determined according to the number of child nodes of each node in the directory tree, including: classifying each node into a batch processing node and a single processing node according to the number of child nodes of each node; the task information of each node includes a batch acquisition task corresponding to the batch processing node and a single acquisition task corresponding to the single processing node.

[0098] The batch processing node can be a node suitable for batch processing mode classified according to the number of child nodes of each node, for example, the batch processing node can be a node with a child node number in the range of 200-2000.

[0099] The single processing node can be a node suitable for single processing mode classified according to the number of child nodes of each node, for example, the single processing node can be a node with a child node number less than 200 or greater than 2000.

[0100] The batch acquisition task can be a batch download processing task performed on the batch processing node, for example, the batch acquisition task can be a batch download task created.

[0101] The single acquisition task can be a single download processing task performed on the single processing node, for example, the single acquisition task can be a task of adding a single entry download.

[0102] Optionally, the terminal classifies each node in the directory tree of the active directory into a batch processing node and a single processing node according to the number of child nodes of each node in the directory tree, and the specific classification standard is that when the number of child nodes of a node is in the range of 200-2000, the terminal classifies the node as a batch processing node, and when the number of child nodes of a node is less than 200 or greater than 2000, the terminal classifies the node as a single processing node. The terminal determines the task information of each node, and the task information of each node includes a batch acquisition task corresponding to the batch processing node and a single acquisition task corresponding to the single processing node, wherein the batch acquisition task is a batch download task created, and the single acquisition task is a task of downloading a single entry added, which will be assigned to the corresponding thread pool to complete, realizing a differentiated processing strategy to optimize the backup efficiency.

[0103] The technical scheme provided by the embodiment classifies each node into a batch processing node and a single processing node according to the number of child nodes of each node, which is beneficial to adopting a differentiated classification processing strategy according to the data size of different nodes, thereby improving the processing efficiency; and the task information of each node includes a batch acquisition task corresponding to the batch processing node and a single acquisition task corresponding to the single processing node, which is beneficial to assigning the most suitable task type to different types of nodes, realizing accurate task matching and optimized resource allocation.

[0104] In an exemplary embodiment, according to the task information of each node, each node is subjected to backup processing to obtain attribute information of each object, including: through a first type of thread, according to the batch acquisition task, the batch processing node is subjected to backup processing to obtain attribute information of a first object; through a second type of thread, according to the single acquisition task, the single processing node is subjected to backup processing to obtain attribute information of a second object; and according to the attribute information of the first object and the attribute information of the second object, attribute information of each object is determined.

[0105] The first type of thread can be an execution thread specially used for processing the batch acquisition task.

[0106] The second type of thread can be an execution thread specially used for processing the single acquisition task.

[0107] The attribute information of the first object can be object attribute data obtained by the first type of thread through backup processing of the batch processing node according to the batch acquisition task.

[0108] The attribute information of the second object can be object attribute data obtained by the second type of thread through backup processing of the single processing node according to the single acquisition task.

[0109] Optionally, the terminal backs up the batch processing node according to the batch acquisition task through the first type of thread, specifically, one thread in the thread pool processes the batch task, acquires data of the batch processing node in the form of batch acquisition of entries, then parses the acquired entries and saves them in the format of ldif to obtain attribute information of the first object. The terminal backs up the single processing node according to the single acquisition task through the second type of thread, specifically, another thread in the thread pool processes the single entry task, acquires data of the single processing node in the form of downloading a single entry, then parses the downloaded entry and saves it in the format of ldif to obtain attribute information of the second object. The terminal integrates the attribute information obtained by the two types of threads according to the attribute information of the first object and the attribute information of the second object, determines the attribute information of each object, and realizes unified management of data under the multi-thread parallel processing mechanism.

[0110] The technical scheme provided by the embodiment is advantageous in realizing the multi-thread parallel processing mechanism, avoiding the low efficiency problem caused by single-thread serial processing, thereby being advantageous in improving the overall efficiency of backup processing, in backup processing according to the batch acquisition task through the first type of thread and in backup processing according to the single acquisition task through the second type of thread; the attribute information of each object is determined according to the attribute information of the first object and the attribute information of the second object, which is advantageous in uniformly integrating the attribute data obtained by different threads, ensuring the completeness and consistency of backup data, thereby being advantageous in improving backup quality and reliability.

[0111] In one exemplary embodiment, a directory tree of the active directory is constructed according to each object in the active directory, including: obtaining identification information of each object in the active directory; and constructing the directory tree of the active directory according to the identification information of each object.

[0112] Optionally, the terminal obtains identification information of each object in the active directory, specifically, scans the entire active directory to obtain distinguished names of each object in the active directory, the distinguished name being unique identification information of each object in the active directory, including identification data of all objects such as user accounts, computers, organizational units, etc. The terminal constructs the directory tree of the active directory according to the identification information of each object, specifically, constructs a complete directory tree structure through all obtained distinguished names, the directory tree reflecting the hierarchical relationship and membership relationship between each object in the active directory, forming a tree structure with parent-child node relationship, providing a basic data structure for subsequent node classification and task allocation.

[0113] The technical scheme provided by the embodiment is advantageous in ensuring complete identification and accurate positioning of all objects in the active directory, thereby improving the completeness of data collection; and in constructing a directory tree of the active directory according to the identification information of the objects, thereby establishing a hierarchical relationship between the objects in the active directory, integrating originally dispersed object information into an ordered tree structure, and thereby providing a basic data structure for subsequent node classification and task allocation.

[0114] The following is an application example of the fine-grained recovery method of the active directory provided by the present application. The application example is used to illustrate the application of the method in a terminal.

[0115] Active Directory (AD for short) is a directory service applied in enterprises and organizations, and is used to uniformly manage core resources such as user accounts, computers, group policies, permissions, etc. The security and consistency of AD play a crucial role in the normal operation of the entire IT system.

[0116] In the traditional backup and recovery mechanism, the data of AD is mainly implemented through System State Backup. This method usually includes the registry, SYSVOL directory (shared directory), AD database, certificate service, and other key components of the domain controller. However, such a backup solution has the following limitations:

[0117] Coarse recovery granularity: Traditional system state backup is suitable for the recovery of the entire machine or AD instance, and does not support fine-grained restoration of individual users, groups, OUs (Organizational Units), etc. Once a certain object is mistakenly deleted, the entire database may need to be restored or rely on additional techniques, which is low in efficiency and high in risk.

[0118] Complex recovery process: The recovery operation usually requires the domain controller to be restarted to Directory Services RestoreMode (DSRM for short), and the operation is performed using command-line tools or scripts, which is cumbersome and prone to errors, and is not suitable for frequent use in production environments.

[0119] Therefore, in the current native AD environment, there is still a lack of an efficient, stable, and secure solution that supports object-level and attribute-level fine-grained recovery. There is an urgent need for a fine-grained backup and recovery mechanism that does not require service interruption, supports accurate positioning of object and attribute states, and can quickly restore.

[0120] Although the current Active Directory supports basic recovery mechanisms such as system state backup and recycle bin, there are still the following main technical problems and deficiencies in fine-grained backup and recovery:

[0121] Restoration granularity is coarse, lacking object-level and attribute-level restoration capabilities: Traditional AD backup solutions are usually based on the whole database, and cannot restore a single user, group, organizational unit, or specific attributes (such as phone number, email, etc.) of an object. When a mistake occurs, restoring a single object may require restoring the entire system state, resulting in resource waste and increased risk.

[0122] Restoration efficiency is low, and the operation process is complex: The current AD restoration process usually requires entering Directory Services Restore Mode for offline restoration, which is complex and time-consuming, and may cause interruptions to the production environment, making it unsuitable for daily small-scale restoration needs.

[0123] Insufficient recovery capabilities for attribute modification errors: Although the AD Recycle Bin supports restoration after object deletion, it does not support restoration of modified or overwritten object attributes. This means that if an administrator inadvertently modifies a critical attribute, they will not be able to restore it to its previous state using existing methods.

[0124] Lack of point-in-time recovery functionality and imperfect version management: Existing backup mechanisms usually only support full restoration based on backup time points, and cannot roll back individual objects to a specific time point, lacking flexible version control and rollback capabilities.

[0125] The backup process of the application example is as follows Figure 2 , including: start, get all Distinguished Name (DN, identification name), build directory tree, judge total node number, if greater than 2000, start multi-thread, otherwise start single thread, traverse the entire directory tree, judge the sub (subnode) node number of the current node, if the subnode number > 200 && < 2000, add the task of batch acquiring entry, batch acquire entry, if the subnode number < 200 || > 2000, multi-thread batch download one by one entry, get entry, parse, save as ldif format, end.

[0126] Step explanation:

[0127] 1. Scan the entire Active Directory to obtain all Distinguished Names;

[0128] 2. Build a directory tree based on all Distinguished Names;

[0129] 3. Determine whether to start multi-threading based on the total number of nodes, with a minimum of 2 threads, one thread handling batch tasks and one thread handling individual entries (entries);

[0130] 4. Traverse the directory built above, determine the number of child nodes of the current node, if the number of child nodes is in the range of 200-2000, create a batch download task; if the number of child nodes is not in the above range, add a task of downloading a single entry, and hand over to the thread pool to complete;

[0131] 5. After downloading the entry, parse and save in the format of ldif.

[0132] The recovery process of the application example refers to Figure 3 , including: start, the user selects a time point to be restored, enumerates all entries in the form of a directory, selects an entry 1 to be restored, an agent acquires all data in the recycle bin, compares the id of the entry 1 with the data in the recycle bin, if the id is in the recycle bin (i.e. Y), calls an interface to recover part of the data from the recycle bin, compares the recovered entry with the data in the backup set, and modifies if they are inconsistent; if the id is not in the recycle bin (i.e. N), match in the backup set, reconstruct the entry from the backup set, and complete.

[0133] Step description:

[0134] 1. The user selects an entry to be restored;

[0135] 2. The agent acquires all data in the recycle bin;

[0136] 3. The agent matches whether the id in the entry is in the recycle bin, if it is, calls an interface to recover from the recycle bin, and then compares whether the attributes under the entry are consistent with those in the backup set, if they are not consistent, overwrite;

[0137] 4. If it is not in the recycle bin, the agent acquires the entire entry from the backup set to reconstruct.

[0138] The technical scheme provided by the application example realizes: 1. Multiple channels are adopted, and an algorithm is used to perform parallel backup on the entire Active Directory; 2. A single entry can be restored, achieving fine-grained recovery without interrupting the current Active Directory service; 3. It can be restored to any time point, while ensuring that the SID (Security Identifier) and UUID (Universally Unique Identifier) are also consistent; 4. When restoring, if it is a system state entry, it is ensured to be restored from the recycle bin without modifying its attributes.

[0139] It should be understood that although each step in the flowchart involved in each embodiment as described above is shown in sequence according to the arrow, these steps are not necessarily executed in the order indicated by the arrow. Unless explicitly stated herein, there is no strict order limitation for the execution of these steps, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily sequential, but can be alternately executed with at least part of other steps or steps or stages in other steps.

[0140] Based on the same inventive concept, the embodiments of the present application also provide an activity directory fine-grained recovery device for implementing the activity directory fine-grained recovery method described above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more activity directory fine-grained recovery device embodiments provided below can refer to the limitations of the activity directory fine-grained recovery method in the above text, which will not be repeated here.

[0141] In one exemplary embodiment, as shown in Figure 4 An activity directory fine-grained recovery device is provided, which can include:

[0142] An information receiving module 401 is configured to receive identification information of a target object to be recovered in an activity directory;

[0143] A data obtaining module 402 is configured to obtain data in a recycle bin of the activity directory, match the identification information with the data in the recycle bin, and obtain a matching result;

[0144] An object recovery module 403 is configured to recover the target object from the recycle bin if the matching result indicates a matching success;

[0145] An information processing module 404 is configured to compare attribute information of the target object with backup attribute information corresponding to the target object in a backup set of the activity directory, and obtain a comparison result;

[0146] An object processing module 405 is configured to update the target object according to the backup attribute information to obtain a recovery object of the activity directory if the comparison result indicates that there is a difference.

[0147] In an exemplary embodiment, the apparatus 400 further comprises an object reconstruction module configured to, in the case that the matching result indicates a matching failure, acquire backup attribute information from the backup set; and perform a reconstruction process on the target object according to the backup attribute information to obtain a recovery object.

[0148] In an exemplary embodiment, the apparatus 400 further comprises a backup construction module configured to construct a directory tree of the active directory according to each object in the active directory; determine task information of each node of the directory tree according to a number of child nodes of each node; perform a backup process on each node according to the task information of each node to obtain attribute information of each object; and construct the backup set according to the attribute information of each object.

[0149] In an exemplary embodiment, the backup construction module is further configured to classify each node into a batch processing node and a single processing node according to the number of child nodes of each node; and the task information of each node comprises a batch acquisition task corresponding to the batch processing node and a single acquisition task corresponding to the single processing node.

[0150] In an exemplary embodiment, the backup construction module is further configured to perform a backup process on the batch processing node according to the batch acquisition task through a first type of thread to obtain attribute information of a first object; perform a backup process on the single processing node according to the single acquisition task through a second type of thread to obtain attribute information of a second object; and determine the attribute information of each object according to the attribute information of the first object and the attribute information of the second object.

[0151] In an exemplary embodiment, the backup construction module is further configured to acquire identification information of each object in the active directory; and construct a directory tree of the active directory according to the identification information of each object.

[0152] Each of the above modules of the fine-grained recovery apparatus of the active directory can be implemented in whole or in part by software, hardware, and combinations thereof. Each of the above modules can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a memory in the computer device in software form, so as to be called and executed by a processor to perform operations corresponding to each of the above modules.

[0153] In an exemplary embodiment, a computer device is provided, which can be a terminal, and an internal structure diagram of the computer device can be as shown in Figure 5The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus. The communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to perform wired or wireless communication with external terminals. The wireless communication can be achieved through WIFI, mobile cellular network, NFC (Near Field Communication) or other technologies. The computer program is executed by the processor to implement the method for fine-grained recovery of an active directory. The display unit of the computer device is configured to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, a trackball or a touchpad arranged on the shell of the computer device, or an external keyboard, a touchpad or a mouse, etc.

[0154] Those skilled in the art can understand that Figure 5 The skilled in the art can understand that

[0155] In an exemplary embodiment, a computer device is also provided, including a memory and a processor. The memory stores a computer program. The processor executes the computer program to implement the steps in the above method embodiments.

[0156] In an exemplary embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0157] In an exemplary embodiment, a computer program product is provided, which includes a computer program. The computer program is executed by a processor to implement the steps in the above method embodiments.

[0158] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0159] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0160] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A fine-grained recovery method for Active Directory, characterized in that, The method includes: Receive the identification information of the target object to be restored in Active Directory; Obtain data from the recycle bin of the Active Directory, and match the identification information with the data in the recycle bin to obtain a matching result; If the matching result indicates a successful match, the target object is restored from the recycle bin; The attribute information of the target object is compared with the backup attribute information of the target object in the backup set of the Active Directory to obtain the comparison result; If the comparison results indicate a difference, the target object is updated based on the backup attribute information to obtain the Active Directory recovery object.

2. The method according to claim 1, characterized in that, After obtaining data from the recycle bin of the Active Directory, matching the identification information with the data in the recycle bin, and obtaining the matching result, the process further includes: If the matching result indicates a failure, the backup attribute information is obtained from the backup set; Based on the backup attribute information, the target object is reconstructed to obtain the restored object.

3. The method according to claim 1, characterized in that, The method further includes: Construct a directory tree for the Active Directory based on the objects in the Active Directory; Based on the number of child nodes of each node in the directory tree, determine the task information of each node; Based on the task information of each node, the nodes are backed up to obtain the attribute information of each object; The backup set is constructed based on the attribute information of each object.

4. The method according to claim 3, characterized in that, The step of determining the task information of each node based on the number of child nodes of each node in the directory tree includes: Based on the number of child nodes of each node, the nodes are classified into batch processing nodes and single-node processing nodes. The task information of each node includes the batch acquisition task corresponding to the batch processing node and the single acquisition task corresponding to the single processing node.

5. The method according to claim 4, characterized in that, The step of backing up each node based on its task information to obtain the attribute information of each object includes: The first type of thread performs backup processing on the batch processing node according to the batch acquisition task to obtain the attribute information of the first object; The second type of thread performs backup processing on the single-entity processing node based on the single-entity acquisition task to obtain the attribute information of the second object. The attribute information of each object is determined based on the attribute information of the first object and the attribute information of the second object.

6. The method according to claim 3, characterized in that, The step of constructing the directory tree of the Active Directory based on each object in the Active Directory includes: Obtain the identification information of each object in the Active Directory; Based on the identification information of each object, construct the directory tree of the active directory.

7. A fine-grained recovery device for Active Directory, characterized in that, The device includes: The information receiving module is used to receive the identification information of the target object to be restored in Active Directory; The data acquisition module is used to acquire data from the recycle bin of the Active Directory, and to match the identification information with the data from the recycle bin to obtain a matching result; An object recovery module is used to recover the target object from the recycle bin if the matching result indicates a successful match. The information processing module is used to compare the attribute information of the target object with the backup attribute information corresponding to the target object in the backup set of the Active Directory, and obtain the comparison result. The object processing module is used to update the target object according to the backup attribute information when the comparison result indicates a difference, so as to obtain the recovery object of the Active Directory.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images