Domains
The Domains screen lists every domain the forest defines and says whether each one could be recovered. A domain is recovered by restoring a writable domain controller from a full system backup taken inside the tombstone lifetime. The coverage verdict therefore asks whether such a backup exists, how fresh it is, and whether there is a second one to fall back on. The other domain controllers in the domain are rebuilt by promotion; see Backup Targets and Rebuilt Domain Controllers.
To open it, select Active Directory > Domains, or select a forest's domain count on the Forests screen. The health chip in the top bar also opens it when a domain's verdict set the chip's color. Every role can see the screen. Only a Backup Operator (or the break-glass account) sees the row actions menu, which holds the exclusion action.
Scope and notices
When you open the screen from a forest, it is scoped: a Scoped notice names the forest, and every count and finding describes that forest alone. Select Clear filter to see every domain.
| Notice | Meaning |
|---|---|
| Not verified against the forest | No DC agent has reported a forest enumeration yet. The domains listed are the ones machines claim membership of; domains with nothing protected in them are missing, and directory facts such as the built-in administrator and operations masters are not collected yet. |
| n unplaced | Domain controllers that could not be placed in any domain. They count toward no coverage figure and are listed on the Domain Controllers screen. Excluded domain controllers and those removed from the directory are not counted here; the notice says how many more are excluded. |
| n domains removed from the directory | Shown at the bottom of the screen. Domains recorded as removed from the directory. They are left out of every figure; expand the section to see their names. If the directory names one again, it returns on its own. |
Findings
Findings appear in the Recovery readiness panel at the top of the screen, under a headline that sums up the domains' state, and cover domains that are not excluded. Each finding is marked Blocked (critical) or Review (warning).
| Finding | Severity | What to do |
|---|---|---|
| Domains cannot be recovered | Critical | Each needs a full system backup of a writable domain controller. Install the DC agent on one and give it a full system policy. Read-only domain controllers cannot start a recovery. |
| Domains past the tombstone lifetime | Critical | Restoring from these backups is blocked. Take a fresh backup of a writable domain controller in each domain, then find out why backups stopped. |
| Domains replicate SYSVOL by FRS | Critical | Restore preflight refuses FRS. Migrate SYSVOL replication to DFSR, then take a fresh backup. Backups taken before the migration remain unusable. |
| Domains with no full system recovery option | Warning | Change the backup policy on a writable domain controller in each domain to Full system. A DC state backup cannot restore a machine whose operating system is gone. |
| Domains with nothing scheduled | Warning | Add or enable a backup policy on a writable domain controller, or the existing recovery point ages past the tombstone lifetime. |
| Domains whose recovery point is stale | Warning | Check the Backup Jobs screen for failures, then run a backup. |
| Domains resting on one recovery option | Warning | Give a second writable domain controller a full system policy. The coverage rule is two per domain. |
| Domains with only one domain controller | Warning | No backup setting can clear this. Promote a second domain controller in the domain. |
| Domains with no recorded built-in administrator | Warning | Recovery asks for the password of the domain's built-in administrator account (RID 500), whose name is often not Administrator. Confirm the account exists and is enabled. |
| Domains had an FSMO role move after the recovery point | Warning | Confirm each move was a transfer, not a seizure. A domain controller whose roles were seized elsewhere after its backup must be rebuilt, not restored. |
| Domains whose partition could not be read | Warning | The forest lists the domain but its naming context did not answer. Confirm the domain still exists; orphaned metadata from an unclean removal looks the same and disrupts a recovery plan. |
Domain inventory
The Domain inventory card has filter chips for each verdict, a search box, and one row per domain.
| Coverage | Severity | Meaning |
|---|---|---|
| Covered | Good | Two or more writable domain controllers hold full system backups, the newest inside the freshness window and well inside the tombstone lifetime. |
| Single recovery option | Warning | Only one writable domain controller holds a full system backup. Recovery would succeed today, with nothing to fall back to if that backup fails verification or turns out to be compromised. |
| Only one domain controller | Warning | The domain has a single domain controller, so the two-per-domain rule cannot be met. Promote a second domain controller. |
| Recovery point stale | Warning | The newest restorable backup of a writable domain controller is older than the freshness window (twice the shortest backup interval among the domain's candidates). |
| No full system recovery | Warning | Every restorable backup of a writable domain controller is DC state only. DC state recovery works; full system recovery of a lost or encrypted machine does not. Chip: DC state only. |
| No schedule | Warning | A recovery point exists, but no enabled policy covers a writable domain controller, so nothing replaces it. |
| Past tombstone lifetime | Critical | The newest restorable backup of a writable domain controller is older than the tombstone lifetime. Restoring it would reintroduce long-deleted objects, so it is blocked. |
| FRS SYSVOL — unsupported | Critical | The newest backup reports SYSVOL replicated by FRS. No backup in the domain can be used until it is migrated to DFSR. |
| Unrecoverable | Critical | No domain controller holds a restorable backup, or every one that does is read-only. A read-only domain controller must be rebuilt, not restored, so it cannot start a recovery. |
| Recoverability unconfirmed | Unknown | Domain controllers hold restorable backups, but whether they are read-only has not been collected yet. A forest enumeration answers it. |
| No domain controllers found | Unknown | No source has found a domain controller in this domain: its metadata may have outlived its domain controllers, or no enumeration has reached them yet. |
Two further chips filter the table: FRS SYSVOL and excluded.
Columns
| Column | Description |
|---|---|
| Domain | The domain name and NetBIOS name. Root marks the forest root domain, which is recovered first. An icon marks a domain the forest does not name, or one whose partition could not be read. Select the name to open the detail sheet. |
| Coverage | The coverage verdict and any exclusion. Hover for the reasoning. |
| Recovery point | The age of the newest restorable backup of a writable domain controller, when it becomes stale, and how many days remain before the tombstone lifetime. Nearing tombstone lifetime appears when less than a quarter of the lifetime remains. None means no writable domain controller has a restorable backup. |
| Controllers | The number of domain controllers, with counts of protected, need a backup policy, rebuilt on recovery, unprotected, without an agent, and excluded. Domain controllers rebuilt on recovery are not backup targets and are not a shortfall in protection, except those the domain needs backed up because it has too few backup targets, which are counted as need a backup policy. Opens the Domain Controllers screen scoped to the domain. |
| SYSVOL | The SYSVOL replication engine recorded by the newest backup: DFSR, or FRS as a critical chip. |
The tombstone lifetime is read from each domain. Until it has been collected, the screen assumes the Active Directory default and says so.
Row actions
The actions menu (⋮), shown to Backup Operators, has Exclude from alarms… or Edit exclusion…, and Domain controllers, which opens the Domain Controllers screen scoped to the domain. See Excluding and Retiring Objects.
Domain detail sheet
| Section | Contents |
|---|---|
| Coverage | The verdict, its reasoning, and the exclusion if any. |
| Recovery point | Newest restorable and Measured against: the freshness window and tombstone lifetime the recovery point is judged by. |
| SYSVOL | The replication engine and what it means for restore preflight. |
| Recovery options | Full system recovery options (writable domain controllers whose restorable backup is full system), Restorable versions across the domain, and Controllers. |
| Objects | Users, computers, and groups, as counted by an agent in the domain. |
| In the directory | Built-in administrator (the RID 500 account whose password recovery asks for), Operations masters and the last role move, Functional level, Forest root, Seen in forest, and Known from. |
| Identity | NetBIOS name, forest, domain SID, and naming context. |
