Coverage and Readiness
Cygna Forest Recovery continuously judges whether your estate could be recovered with the backups you have now. It gives a verdict for each domain controller, each domain, and each forest, and the dashboard rolls them up. This topic explains how each verdict is reached, so that you can tell what a verdict means and what clears it.
How verdicts are read
Every verdict has one of five states, each shown with its own icon as well as a color:
- OK—Verified good.
- Warning—A known, bounded problem. Recoverable today, but with a reason it may not be tomorrow. Shown as "at risk" for domains and forests.
- Critical—Verified bad. Recovery capability is impaired now.
- Unknown—Something could not be found out. An unknown is never reported as good or as gone. When figures are rolled up, unknown ranks above warning, because a risk of unmeasured size can be worse than one that has been measured.
- Info—A neutral notice with no action implied.
Domain controllers
Each domain controller has a protection verdict, shown on the Domain Controllers screen. It answers one question: is there a restorable backup of this machine, and is it being kept current? The freshness window is twice the machine's backup policy interval.
| Verdict | Meaning |
|---|---|
| Protected | A restorable backup exists within the freshness window, and the last attempt succeeded. |
| Last backup failed | The newest restorable backup is within the window, but the most recent attempt failed. A backup refused because the machine had no agent, made before its current agent enrolled, does not count as a failed attempt. |
| Backup stale | The newest restorable backup is older than the window. |
| No schedule | A restorable backup exists, but no enabled policy covers the machine, so nothing will replace it. |
| Unprotected | A backup target with no restorable backup: an enabled policy covers the machine, but it has no agent, has never been backed up, or every version has been pruned or never committed. A warning; whether it costs the domain its recovery is the domain's verdict. |
| Rebuilt on recovery | Not a backup target: no enabled policy covers the machine and nothing of it is in the vault. A recovery rebuilds it by promotion. Info, not a finding. |
No domain controller verdict is critical. Critical belongs to a domain or forest that could not be recovered. For how backup targets are decided, see Backup Targets and Rebuilt Domain Controllers.
Site verdicts on the Sites screen are a roll-up of these per-machine verdicts over the site's backup targets, and none is critical. Domain and forest verdicts are not a roll-up, because recovering a domain depends on which domain controllers can start the recovery, not on how many are protected.
Domains
A domain is recovered by restoring one writable domain controller from backup and rebuilding the rest. Its verdict on the Domains screen therefore asks first whether any writable domain controller has a restorable backup, and then how good that starting point is: whether it is inside the tombstone lifetime, scheduled, a full system backup, and fresh, and whether a second writable domain controller could take its place. Read-only domain controllers never count, because they are never restored. A domain is Covered when two or more writable domain controllers hold full system backups, an enabled policy covers at least one of them, and the newest backup is inside the freshness window and the tombstone lifetime. The freshness window for a domain is twice the tightest backup interval among its writable domain controllers.
| Verdict | State | Meaning |
|---|---|---|
| Covered | OK | Two or more writable domain controllers with full system backups, and the newest backup is fresh and inside the tombstone lifetime. |
| Single recovery option | Warning | Only one writable domain controller holds a full system backup. Recovery would succeed today, with nothing to fall back to if that backup fails verification or turns out to be post-compromise. |
| Only one domain controller | Warning | The domain has a single domain controller, so the two-per-domain rule cannot be met by backup configuration. Promote a second domain controller. |
| Recovery point stale | Warning | The newest restorable backup of a writable domain controller is older than the freshness window. |
| No full system recovery | Warning | Every restorable backup of a writable domain controller is DC state only. DC state recovery is possible; a lost or encrypted machine cannot be recovered. |
| No schedule | Warning | A recovery point exists, but no enabled policy covers any writable domain controller, so it only grows older. |
| Past tombstone lifetime | Critical | The newest restorable backup of a writable domain controller is older than the tombstone lifetime. Restoring it is refused. |
| FRS SYSVOL — unsupported | Critical | The newest backup reports SYSVOL replicated by FRS. Recovery requires DFSR. Migrate the domain to DFSR, then take fresh backups; backups from before the migration stay unusable. |
| Unrecoverable | Critical | No writable domain controller holds a restorable backup, so there is nothing to start the domain's recovery from. |
| Recoverability unconfirmed | Unknown | Restorable backups exist, but whether their domain controllers are writable has not been collected yet. A forest enumeration answers it. |
| No domain controllers found | Unknown | No source has found a domain controller in this domain. This is often leftover metadata from a domain that was not removed cleanly. |
A domain with a warning verdict could still be recovered today. The console counts it as recoverable, at risk. A domain with a critical verdict could not.
Forests
A forest recovery restores the forest root domain first and every other domain after it, parent before child. A forest's readiness on the Forests screen is therefore a roll-up of its domain verdicts, with the root weighted separately.
Domains you have excluded are left out of the roll-up and its domain and domain controller counts, and the Forests screen says how many are not counted. The forest root domain is the exception: it always counts, even when it is excluded, because a forest recovery cannot start without it. Excluding a domain does not change that domain's own verdict on the Domains screen.
| Readiness | Meaning |
|---|---|
| Ready | Every domain is Covered. |
| Root domain unrecoverable | The forest root cannot be recovered, so a forest recovery cannot start. Nothing below the root can proceed until this is fixed. |
| Domains unrecoverable | The root could be recovered, but at least one other domain could not. A recovery would start and stop partway. |
| Root domain at risk | The root could be recovered today, with a warning against it. A finding on the root decides how the whole recovery begins. |
| Domains at risk | Other domains carry warnings, and each would still recover today. |
| Root domain unidentified | The root domain is not known, or cannot yet be judged. |
| Recoverability unconfirmed | Every domain that can be judged is recoverable, and some are not judged yet. Normal on a new installation until the first topology enumeration arrives. |
| No domains found | An enumeration reached the forest and returned no domains. Check the DC agent's last topology report. |
| No agent in this forest | The forest is known only because a trust names it. Nothing in it is protected by this installation. |
The dashboard's Recovery readiness section states each forest's verdict in a word: Fully recoverable, At risk, Not recoverable, Not confirmed, or Not covered, with the exact readiness beneath it. Each forest's card also shows the Root recovery point—the age of the root domain's newest recovery point—and the Last successful restore in this forest.
Tombstone lifetime
The tombstone lifetime is how long Active Directory keeps a record of a deleted object before removing it for good. A backup older than the tombstone lifetime still contains objects that every other domain controller has since forgotten were deleted. Restoring it brings them back as lingering objects. For that reason preflight refuses any restore point older than the tombstone lifetime, and coverage treats such a backup as unusable.
The tombstone lifetime is read from each domain. Until it has been collected, Cygna Forest Recovery assumes the Active Directory default of 180 days, and the console says it is assumed. The Domains screen shows how many days of headroom each domain's recovery point has left, and shows Nearing tombstone lifetime when less than a quarter of the lifetime remains.
Retired and excluded objects
Two kinds of operator decision change what is counted. Neither hides anything: retired and excluded objects stay listed on their screens, with the reason and who recorded it.
- Retired (removed from the directory)—An object the directory no longer defines, such as a domain controller that has been demoted or cleaned up. A domain controller, domain, or trust is recorded as removed by discovery, by the
cdr cleanupcommands, or by an operator with Mark as removed from the directory…. Retired objects leave every count and alert. Nothing in Active Directory changes. If the directory names the object again, the record is withdrawn automatically. - Excluded from alerts—An object you have decided is out of scope, such as a forest reached across a trust that this installation is not meant to protect. A domain controller you do not back up needs no exclusion: it is rebuilt on recovery and raises no alert. You record a reason and, optionally, a review date. The object stays listed and judged, but is left out of every count and alert. After its review date it counts again and shows Exclusion due for review. If the object changes, the exclusion is void. An exclusion on a forest, domain, or site applies to everything in it. The one exception is the forest root domain, which always counts toward its forest's readiness, even when excluded.
Excluding and retiring objects requires the backup.manage capability. See Excluding and Retiring Objects.
How alerts relate to verdicts
Alerts are raised from the same verdicts the inventory screens show, so the two never disagree. For example, a domain with the Unrecoverable verdict raises the Domains that could not be recovered alert, and a domain controller with the Unprotected verdict raises Backup targets with nothing to restore from. A domain controller that is rebuilt on recovery raises no alert. Each inventory screen lists its own alerts as findings in the summary panel at the top, and the Alerts screen lists everything currently raised, grouped by severity, with a link to where you act on it. Excluded and retired objects raise no alerts.
Test restore results do not change these verdicts. They raise their own alerts, Domain controllers whose latest test restore failed and Domain controllers with no recent verified backup, which appear on the Alerts screen. See Test Restores.
For every alert, its severity, and what to do, see Alerts Reference.
