Choosing a Recovery Approach
The right recovery depends on how much of the directory you can still trust and what state the machines are in. Start from the widest damage: if you cannot trust the forest, recovering one domain controller does not help, however healthy the backup.
Decide the scope first
- The rest of the domain is healthy and trustworthy—Recover the single domain controller.
- One domain is damaged or compromised, and the other domains are healthy—Recover the domain. This is not available for the forest root domain or for a forest with only one domain; use forest recovery for those.
- The forest as a whole cannot be trusted—Recover the forest. This includes any compromise of the forest root, a compromise whose reach you do not know, and ransomware that has reached domain controllers.
Situations
| Situation | Approach |
|---|---|
| Changes to accounts, groups, or other objects have replicated across a healthy domain and must be undone, for example a mass password reset | Single-DC recovery by DC state recovery of one domain controller, naming the subtrees and objects to roll back. The backup must match the machine's current Windows build and revision. If you roll back CN=Users, choose the krbtgt reset. |
| One domain controller's operating system or directory is damaged, but Windows still starts, and the rest of the domain is healthy | Single-DC recovery by full system recovery in place, from a full system backup taken since any change to the machine's disks. Alternatively, rebuild it. |
| One domain controller will not start | Single-DC recovery by full system recovery onto a candidate: a new physical or virtual machine with the DC agent enrolled. Power off or isolate the original first. Alternatively, rebuild it. |
| One domain controller's hardware is lost | Full system recovery onto a candidate with matching firmware and disks at least as large as the backup's. cdr dc rebuild can create a suitable virtual machine. Alternatively, rebuild it. |
| The domain controller is read-only, or its roles were seized elsewhere after its backup | Rebuild. Restoring is refused. |
| Every backup of the domain controller is stale, past the tombstone lifetime, or suspect, and the domain is healthy | Rebuild. A rebuild needs no backup. |
| One domain (not the forest root) is corrupted or compromised; the other domains are healthy | Domain recovery. If it is a security incident, set the security breach flag and choose restore points from before the compromise. |
| The forest root domain is corrupted or compromised, or the forest has only one domain | Forest recovery. Domain recovery is refused for these. |
| The whole forest is compromised, or ransomware has reached domain controllers | Forest recovery with the security breach flag set, from restore points taken before the compromise, aligned to one backup window across domains. |
Restore or rebuild
Within a recovery, each domain controller is either restored or rebuilt. Restoring is faster where the directory is large and replicating it again over the network would be slow. Rebuilding avoids every constraint a restore has: no backup is needed, the hardware does not have to match, and the Windows build can be newer. When the rest of the domain is healthy, rebuilding a single domain controller is often the simpler choice.
In domain and forest recovery, a plan restores exactly one domain controller per domain and rebuilds the rest; a plan that restores more cannot be approved. A rebuilt domain controller brings the whole directory back by replication from the restored one, so users, groups, memberships, and permissions lose nothing. What a rebuild does not bring back is what was on the machine itself: its Windows roles and features are reinstalled from its last backup's record, but their configuration and its installed programs are not. If a domain controller runs a role whose configuration you cannot rebuild by other means, choose it as the domain's restored domain controller.
The security breach flag
Set the Security breach option in a domain or forest plan when you are recovering from an attack rather than from an accident. The flag must be set before the plan is approved, because it changes what the plan contains:
- Breach resets are added on every restored domain controller, before any other domain controller is promoted.
- In a forest recovery, every trust is reset, including trusts that leave the forest. Without the flag, a forest recovery resets no trust: each side keeps the trust password its own restore point holds. A domain recovery resets the domain's trusts either way.
- In a domain recovery, the domain's group managed service accounts are re-created under a new KDS root key.
The breach flag does not choose your restore points. Pick restore points from before the compromise, allowing for the time an attacker may have been present before being detected, and verify the restored data when the plan asks you to. If the restored data is not clean, reject that step and plan again with an older restore point. To keep older restore points available, see Retention.
