What Recovery Does Not Cover
Cygna Forest Recovery recovers Active Directory Domain Services: the directory, SYSVOL, DNS as it runs on domain controllers, and the domain controllers themselves. Some services that commonly run on or depend on domain controllers are outside that scope. A recovery restores the machine they ran on, but does not make them work again. Plan for each of these before an incident, with whoever owns them.
What is not recovered
| Item | Why it needs attention | What to do |
|---|---|---|
| Active Directory Certificate Services on a domain controller | A certification authority running on a domain controller is not recovered as a service. After a forest or domain recovery, its state may not match the directory, and after a rebuild the role is reinstalled empty, without its keys or database. | Recover the certification authority with its own procedure, from its own backup of the CA database and key. Better, move it off domain controllers before you need to recover. |
| DHCP Server on a domain controller | Scopes, leases, and authorization are not recovered as a service. | Restore the DHCP configuration from an export or backup made with the DHCP tools, and re-authorize the server in the directory if needed. |
| Directory synchronization services | Services that synchronize the directory with another identity system depend on accounts and passwords that a recovery resets, including the krbtgt and machine account resets and, with the breach flag, administrative and service accounts. |
After the recovery, re-establish each synchronization service's credentials and service accounts, then confirm synchronization with the vendor's procedure. |
| External and outgoing trusts | Trusts to domains outside the forest are not restored from backup. Trusts inside the forest come back with the forest: in a forest recovery, each side keeps the trust password its own restore point holds, and the recovery resets them only when the security breach flag is set. A domain recovery always resets the domain's trusts. | Re-create each external and outgoing trust after the recovery, with the partner's administrator. A trust password reset has to be mirrored on a live domain controller of the partner domain; where no DC agent sits there, it is a manual step for the partner's administrator. After a forest recovery without the security breach flag, check that each trust inside the forest authenticates if its two sides were restored from points 30 days or more apart. |
Anything else that reaches a domain controller by a specific address, such as DNS forwarders on other servers, firewall rules, DHCP options, and applications, needs updating if a recovered domain controller comes back on a different address.
How the console warns you
The console points these out before a recovery:
- In preflight—When a backup records other server roles on the domain controller, a restore of it shows the advisory finding Colocated roles are not recovered by this product, naming the roles. A domain or forest plan lists each external trust whose far side is a manual step, and each trust reset with no agent on the live side.
- On the plan's page—For each rebuilt domain controller, the Plan as built card says which roles and features are reinstalled, which roles come back without their configuration, and how many installed programs are not reinstalled.
- On the Forests screen—The Trusts card has an At recovery column. A trust inside the forest shows Restored with the forest. Every other trust shows that it must be re-created, and whether its password reset can be driven through a DC agent in the partner domain or is a manual reset.
Agree the manual steps with the owners of partner domains and colocated services before a recovery needs them.
The recovery report
The last step of every domain and forest plan produces the recovery report and emails it to the plan's notification addresses. Its manual follow-ups list the work the recovery leaves open, including:
- External and outgoing trusts to re-create.
- Colocated roles to recover: on a restored domain controller, services to check; on a rebuilt one, roles that were reinstalled without their configuration and data, programs that were not reinstalled, and insecure features that were left out.
- Directory synchronization services to resynchronize after the krbtgt resets.
- Final DNS client configuration and operations master placement, which the recovery leaves as it needed them rather than as your design has them.
For everything the report contains, see After a Recovery.
After any recovery
Take a fresh backup of every recovered and rebuilt domain controller after the recovery. Older restore points describe the directory as it was before the recovery and are not suitable to restore the recovered estate. Forest and domain plans take a backup checkpoint of each restored domain controller before redeployment; rebuilt domain controllers are backed up by their backup policies. For the full checklist, see After a Recovery.
