Inventory Commands

The dc, domain, forest, and site commands list your directory as the Manager knows it, with the verdict the Manager has reached for each object—the same verdicts the console shows. They list what the directory defines, including objects nothing is protecting yet, which is how you find the gaps. The dc rebuild command builds a virtual machine shaped like a domain controller's backup.

The list commands only read. To change what is counted, use exclusions (Configuration and Exclusion Commands); to record that an object has been removed from the directory, use Directory Cleanup Commands.

Every filter that takes a verdict code checks it. If you enter a code that does not exist, the command is refused and lists the accepted codes, rather than returning an empty list that looks like a healthy result.

For how to run cdr and the global options, see Command-Line Reference.

dc list

Lists the domain controllers the directory defines, with each one's protection verdict. A summary of how many domain controllers have each verdict follows the table.

Requirements: The environment.view capability (every role).

Syntax

cdr dc list [options]

Options

Option	Description
`-p, --protection <CODE>`	Only domain controllers with this verdict: `protected`, `stale` (the last good backup is older than twice the schedule interval), `failing` (the last backup failed; a backup refused before the machine's current agent enrolled does not count), `unscheduled` (no backup schedule), `unprotected` (a backup target with nothing to restore from), or `rebuild` (not a backup target: no enabled policy and nothing in the vault, so recovery rebuilds it).
`-d, --domain <FQDN>`	Only domain controllers in this domain.
`--site <NAME>`	Only domain controllers in this site.
`--reach <CODE>`	Only domain controllers whose reachability from the agents is `reachable`, `partial`, `unreachable`, `identity-mismatch`, or `not-probed`.
`--wide`	Add the operations master (FSMO), global catalog and read-only, and topology corroboration columns.
`--retired`	Include domain controllers recorded as removed from the directory. Default: they are left out.

Examples

cdr dc list --protection unprotected
cdr dc list --protection rebuild
cdr dc list --domain corp.example.com --wide

dc rebuild

Creates a virtual machine shaped like a domain controller's backup: the same firmware type and generation, disks of the right number and size, adapters, memory, and processors, as recorded in the backup's manifest. Use it to prepare a replacement machine—for example a candidate for a full system recovery, or a machine to receive a DC state recovery. With --restore-run, it builds the new VM for a full system recovery onto a new VM and attaches that run's recovery ISO. The machine is created empty. cdr does not install an operating system, restore anything, or promote a domain controller. It reports the original's network addressing for you to apply, but does not apply it.

By default the build uses the domain controller's newest manifest, and looks up matching Windows Server installation media in the OS media library to attach to the machine.

Hyper-V—cdr builds the machine on the Hyper-V host where you run it. Run it in an elevated command prompt. To build on another Hyper-V host, write the build script with --script and run that script in an elevated PowerShell session on the host.
VMware ESXi—cdr never builds the machine itself, because that would mean holding credentials for your vCenter. With --hypervisor esxi you must give --script (to write a PowerCLI script) or --plan (to see the shape). Run the script in your own PowerCLI session; it takes -Server and -Credential and prompts for what it is not given.

Options that belong to the other hypervisor are refused rather than ignored—for example --path with an ESXi build, or --datastore with a Hyper-V build.

Exit codes: 4 when the manifest does not record enough to build a matching machine, or no manifest exists for the domain controller; 6 when the build or the script write fails. If a Hyper-V build fails or is cancelled partway, the virtual machine may be partly created; cdr says so.

Requirements: The backup.view capability (every role). For a Hyper-V build, an elevated session on a Windows Hyper-V host.

Syntax

cdr dc rebuild <FQDN> [options]

Arguments

Argument	Description
`<FQDN>`	Required. The domain controller whose manifest the new machine is shaped from.

Options

Option	Description
`--hypervisor <KIND>`	`hyper-v` or `esxi`. An ESXi build is only written with `--script`, never run by `cdr`. Default: `hyper-v`.
`--name <NAME>`	Name for the new virtual machine. Default: the domain controller's NetBIOS name followed by `-rebuild`.
`--switch <NAME>`	The Hyper-V virtual switch, or the ESXi port group, to connect the adapters to. The `<SWITCH>` placeholder in the command the Manager prints for a run is refused: replace it with a switch name. `Get-VMSwitch` lists them.
`--path <DIR>`	Hyper-V only. Where the virtual machine and its disks are created. Default: the Hyper-V host's own default path.
`--datastore <NAME>`	ESXi only, and required for ESXi. The datastore the virtual machine and its disks are created on.
`--vmhost <NAME>`	ESXi only, and required for ESXi. The ESXi host to place the machine on, as vCenter names it.
`--vcenter <ADDRESS>`	ESXi only. The vCenter the script connects to by default. Never a credential.
`--guest-id <ID>`	ESXi only. The VMware guest operating system identifier. Default: the generic Windows Server identifier.
`--iso <PATH>`	Installation media to attach, instead of looking it up in the OS media library.
`--no-iso`	Do not attach installation media, and do not look any up. Cannot be combined with `--iso`.
`--mac`	Give each adapter the MAC address the manifest recorded, instead of one the host allocates. Use this only when the original machine is off the network: two identical MAC addresses on one network segment conflict. It is useful when DHCP reservations or licensing depend on the MAC address.
`--memory <SIZE>`	Use this much memory instead of the manifest's, for example `8GB`.
`--processors <N>`	Use this many logical processors instead of the manifest's. Minimum: 1.
`--restore-disk [SIZE]`	Add a data disk for a DC state recovery to stage the backup onto. Without a size, the disk is sized from this machine's largest backup.
`--generation <N>`	State the machine's shape when the manifest could not establish it: `1` is BIOS with MBR disks, `2` is UEFI with GPT disks.
`--manifest <ID>`	Build from this manifest instead of the domain controller's newest. `cdr backup list` prints manifest IDs.
`--restore-run <RUN>`	Build the VM for a full system recovery onto a new VM: shape it from that run's restore point, copy the run's recovery ISO to this host, and attach it with the disk first in the boot order. No operating system is installed; start the VM (`--start`) and the restore runs unattended. Hyper-V only, and run on Windows. Cannot be combined with `--iso` or `--no-iso`. Fetching the media needs the `plan.execute` capability. The local copy of the ISO holds the run's enrollment token until the run ends; delete it afterwards.
`--media-dir <DIR>`	With `--restore-run`: where the recovery ISO is copied to. Default: `%ProgramData%\CygnaDR\RecoveryMedia`.
`--plan`	Show what would be built, and stop. Nothing is created.
`--script <PATH>`	Write the build script to this file, and stop. Nothing is created. The folder must already exist.
`--start`	Start the virtual machine once it is built.

Examples

See what would be built, then build it on this Hyper-V host with a staging disk for a DC state recovery:

cdr dc rebuild dc04.corp.example.com --plan
cdr dc rebuild dc04.corp.example.com --switch Recovery --restore-disk --start

Build and start the VM for a full system recovery onto a new VM, once the restore run has executed and its recovery ISO is built:

cdr dc rebuild dc04.corp.example.com --restore-run <RUN> --switch Recovery --start

For the procedure, see Full System Recovery onto a New VM.

Write a PowerCLI script for an ESXi build:

cdr dc rebuild dc04.corp.example.com --hypervisor esxi --vmhost esx03.corp.example.com --datastore vsanDatastore --switch "VM Network" --script build-dc04.ps1

domain list

Lists every domain that the directory defines or that a domain controller claims, with its coverage verdict: whether the domain could be recovered by restoring one writable domain controller and promoting the rest.

Requirements: The environment.view capability (every role).

Syntax

cdr domain list [options]

Options

Option	Description
`-c, --coverage <CODE>`	Only domains with this verdict, for example `covered`, `single-point`, `unrecoverable`, or `beyond-tombstone`. An unknown code is refused, and the accepted codes are listed.
`-f, --forest <FQDN>`	Only domains in this forest.
`--wide`	Add the NetBIOS name, functional level, SYSVOL replication, operations master, built-in Administrator account, and recovery depth columns.
`--retired`	Also list domains recorded as removed from the directory. Default: they are left out.

Examples

cdr domain list --coverage single-point
cdr domain list --forest corp.example.com --wide

The PROTECTED column gives the protected domain controllers out of the domain's backup targets. Domain controllers rebuilt on recovery, excluded ones, and ones removed from the directory are named beside the figure, for example 2/2 (4 rebuilt on recovery, 1 excluded). A domain with too few backup targets keeps the domain controllers it needs backed up in the figure and names them first, for example 0/2 (2 need a backup policy, 1 rebuilt on recovery). See Backup Targets and Rebuilt Domain Controllers. Excluded domain controllers stay in the domain's figures, so they reconcile with cdr dc list.

Excluded domain controllers that no source places in a domain are not counted, and a hint below the table says how many.

forest list

Lists every forest known from the directory, a domain, a domain controller, or a trust, with its readiness verdict and how fresh its topology is. With --trusts, it lists the trust inventory instead.

Domains you have excluded, other than the forest root, are left out of the forest's readiness and its domain and domain controller counts; the counts say how many with (n excluded). The PROTECTED column gives the protected domain controllers out of the backup targets in scope, and says what the others are, for example 1/4 (2 last backup failed, 1 too old, 6 rebuilt on recovery, 1 excluded). Domain controllers rebuilt on recovery are not backup targets, so they are named rather than counted as a shortfall. Those a domain needs backed up because it has too few backup targets stay in the figure and are named first, as need a backup policy. Excluded domain controllers with no forest are not counted, and a hint below the table says how many. See Coverage and Readiness.

Requirements: The environment.view capability (every role).

Syntax

cdr forest list [options]

Options

Option	Description
`-r, --readiness <CODE>`	Only forests with this verdict, for example `ready`, `root-at-risk`, or `unmanaged`. An unknown code is refused, and the accepted codes are listed. Cannot be combined with `--trusts`.
`--wide`	Add the schema, functional level, forest operations masters, global catalog, site, trust, and reporting agent columns.
`--trusts`	List the trust inventory instead: each trust's type and direction, and whether its password reset can be mirrored during a recovery.
`--retired`	With `--trusts`, include trusts recorded as removed from the directory. Default: they are left out.

Examples

cdr forest list --readiness root-at-risk
cdr forest list --trusts --retired --json

site list

Lists every site the directory defines or a domain controller names, with its coverage verdict: what could be restored back into each location. With --subnets or --links, it lists the subnet map or the site links instead.

Requirements: The environment.view capability (every role).

Syntax

cdr site list [options]

Options

Option	Description
`-c, --coverage <CODE>`	Only sites with this verdict, for example `covered`, `partial`, `rebuild` (domain controllers and no backup target among them), or `empty`. An unknown code is refused, and the accepted codes are listed. Applies to the site list only.
`-f, --forest <FQDN>`	Only sites, subnets, or site links in this forest.
`--wide`	Add the location, domain, operations master, concentration, and site link columns. Applies to the site list only.
`--subnets`	List the subnet map instead, including subnets assigned to no site.
`--links`	List the site links instead, with their cost, replication interval, and member sites. Cannot be combined with `--subnets`.

Examples

cdr site list --coverage partial
cdr site list --forest corp.example.com --subnets

The PROTECTED column gives the protected domain controllers out of the site's backup targets, with those rebuilt on recovery and excluded ones named beside it, for example 1/1 (3 rebuilt on recovery). A site with domain controllers and no backup target reads no backup targets.

Excluded domain controllers placed in no site are not counted, and a hint below the table says how many.