The Ntdsutil authoritative restore operation is not successful if the distinguished name path contains extended characters in Windows Server 2003 and in Windows 2000

When you use the Ntdsutil.exe command-line utility to perform an authoritative restore on a distinguished name (also known as DN) path, the operation is not successful. This problem occurs if the distinguished name path contains one or more extended characters. Ntdsutil cannot locate that path in the database of the Active Directory directory service. Therefore, the version numbers are not incremented on the appropriate objects by Ntdsutil. This problem occurs when you use Ntdsutil in Microsoft Windows Server 2003 or in Microsoft Windows 2000.

Moreover, regardless of whether the correct syntax is used to authoritatively restore distinguished name paths that contain extended characters, the Ntdsutil output echoes different characters in the distinguished name path in the message that it returns. For example, if you try to perform an authoritative restore against a distinguished name path that contains the letter "u" with an umlaut, Ntdsutil may return a message where the "u" with an umlaut is shown as an "e" with an acute accent. The following sample output from Ntdsutil illustrates the problem.

Note In this sample output, the extended characters are described in italic following the extended characters, instead of shown as they appear in the output.In this sample output, the administrator requested that Ntdsutil perform an authoritative restore on the distinguished name path “OU=testContu,DC=contoso,DC=com,” where the "u" in "Contu" contains an umlaut. However, Ntdsutil tried to authoritatively restore a different distinguished name path, "OU=testConte,DC=contoso,DC=com,” where the trailing "e" in "testConte" contains an acute accent.

This problem may occur if the Ntdsutil Authoritative Restore command does not correctly convert extended characters in distinguished name paths to the equivalent Unicode characters. In these cases, Ntdsutil tries to authoritatively restore a distinguished name path that is different from the one that you typed. Typically, this alternative path does not exist. Therefore, the authoritative restore operation fails.

The incorrect conversion of extended characters in Ntdsutil applies not only to diacritical marks (accent marks) but also to whole character sets in the Greek, Korean, Cyrillian, and Asian writing systems.

To work around this problem, wrap distinguished name paths that contain extended characters and spaces with backslash-double-quotation-mark escape sequences. For example, the following output shows the Ntdsutil Authoritative Restore command and the messages that the operation returns:Notes

• Ntdsutil will not correctly echo the extended characters in the distinguished name path that you are trying to authoritatively restore, even when the Authoritative Restore command contains the escape sequences. However, the authoritative restore operation will succeed.
• The problem that this article describes only occurs when you manually type each command at the Ntdsutil command prompt. If you batch Ntdsutil command-line arguments together as a single command string, the authoritative restore operation will work without an escape sequence because Ntdsutil uses a different, Unicode-aware parser.
• In Windows 2000, Ntdsutil does not have the restore object command. To restore both the container and the leaf objects, use the restore subtree command.

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft has confirmed that this is a bug in the Microsoft products that are listed in the "Applies to" section.

For additional information about diacritical marks, click the following article number to view the article in the Microsoft Knowledge Base: