Recovery Requirements

This topic lists what each restore method and recovery scope needs at recovery time. Preflight checks almost all of it and tells you what is missing, but most of these needs are cheaper to meet before an incident than during one. For the requirements of the product itself, see System Requirements.

Requirements for every restore

A usable restore point—Still in the vault, younger than the domain's tombstone lifetime, with a captured version identifier, taken by the DC agent (so it has a manifest), and with SYSVOL replicated by DFSR. Domains that still use FRS for SYSVOL must migrate to DFSR and take fresh backups first.
A writable domain controller—Read-only domain controllers are rebuilt, never restored. A domain controller whose operations master roles were seized elsewhere after its backup must also be rebuilt.
No backup running on the machine—A restore restarts the machine, which would abandon the backup. Let it finish or cancel it.
A connected agent on the machine that carries out the restore—The domain controller's own DC agent, or the candidate's.
A verifiable backup—The backup must still match the hash recorded when it was committed.
The storage machine and Manager reachable—From the machine being restored: SMB (TCP 445) to the storage machine, and TCP 5211 to the Manager. See Ports and Protocols.
The Restore Operator role—Approval needs plan.approve and execution needs plan.execute. Both belong to the Restore Operator role and to no other role.

DC state recovery

Windows on the domain controller still starts, and its DC agent is connected.
The restore point was taken on the same Windows build and update revision the machine runs now. A backup taken before the machine was last patched cannot be restored onto it this way. A backup from a different Windows release never can.
Free space on the domain controller for a local copy of the backup. Before the domain controller restarts into Directory Services Restore Mode, the DC agent copies the backup from storage to the domain controller's own disk, and the restore then runs from that copy. The copy needs about 1.15 times the backup's size, on a fixed volume other than the system volume. The DC agent setting Restore staging volume chooses the volume; by default it uses the fixed, non-system volume with the most free space.
Either backup type.
A DC agent as current as the Manager and running as its Windows service, so that it can hold back the restart wbadmin starts and mark the named subtrees and objects authoritative.
The distinguished names of the subtrees and objects to roll back. To roll back CN=Users with the krbtgt reset, a domain administrator's user name and password at approval.

Full system recovery

Full system recovery, in place or onto a candidate, needs everything below. The candidate column notes where the two differ.

Requirement	Details	Onto a candidate
Backup type	A full system backup. DC state backups cannot do a full system recovery.	Same.
Recovery image	A recovery image for the backup's operating system that has not failed. This needs the storage agent's Recovery image folder set and a matching Windows Server ISO in its media folder. See Recovery Images.	Same.
Target machine	The domain controller's own Windows starts one last time, with its DC agent connected, so the agent can stage the recovery image.	A machine that is not a domain controller, with the DC agent installed and enrolled. The original domain controller must be powered off or isolated.
Disks	The disk layout is unchanged since the backup. An in-place recovery cannot repartition, so disks that were added, resized, replaced, or converted need a newer backup.	At least as many disks as the backup, each the same size or larger.
Firmware	Unchanged since the backup.	The same firmware type as the backup: UEFI with GPT, or BIOS with MBR. Both are supported. On Hyper-V, a generation 2 virtual machine is UEFI and generation 1 is BIOS.
Memory	Enough to load the whole recovery image into a RAM disk: the image size plus about 1 GB.	Same. Less memory than the original works, but the domain controller may run slowly.
Staging space	Free space on the system volume for the recovery image: about 1.1 times the image's size.	Same.
Name resolution	None, by default. The recovery environment reaches the vault at the storage agent's advertised address, which is the storage machine's IP address unless the storage machine has more than one address or its advertised host is set to a name. It reaches the Manager at the address the machine's DC agent uses, resolved to an IPv4 address before the restore starts. When the vault is reached by name, the recovery environment can resolve it through DNS only; a hosts file, LLMNR, or NetBIOS is not enough. The restored domain controller's DC agent dials the Manager address it was installed with.	Same.
Network address	The recovery environment takes its address from DHCP unless the plan gives it the machine's own static address or another one. With no DHCP server on the network and no planned address, it refuses before writing and restarts back into Windows. The recovery environment needs a driver for the machine's network adapter. Add any driver it lacks to the storage agent's Driver folder, so that it is built into the recovery image.	Same.
Clock	Within five minutes of the Manager's. A restored domain controller trusts its own clock until it synchronizes, and Kerberos refuses beyond five minutes. On a virtual machine, correct the host's time.	Same.
BitLocker	If the backed-up volumes were BitLocker-protected, have their recovery keys at hand.	Same. A TPM protector belongs to the original machine's TPM, so the restored volumes are likely to ask for the keys.
Storage controller	Unchanged.	The restored Windows needs a driver for the candidate's boot controller, or it stops with `INACCESSIBLE_BOOT_DEVICE`. If the candidate's boot controller differs from the original's, install its driver on the original domain controller before the backup. Built-in drivers cover common virtual controllers.

Windows binds a static address to the adapter it was set on, so the original's address does not follow it onto a different adapter by itself. Unless you choose otherwise, the Manager puts the backup's own static address back on the restored system: onto a candidate, and in place when the machine's latest description says which adapter to use. This needs a backup that recorded exactly one static address. Otherwise, set the address by hand afterward.

The restored domain controller comes back running the DC agent its backup held. The recovery environment replaces it with the agent build that staged the restore, when the recovery image can do so. A plan step is not sent to an agent older than the Manager's agent package; update such an agent with cdr agent update or from the Agents screen, and retry the step. See Maintaining Agents.

Rebuild

No backup of the domain controller is needed to rebuild it.
In a domain or forest plan, a machine with Windows Server and the DC agent enrolled: either a candidate bound to the domain controller in the plan, which the plan renames, or the domain controller's own machine reinstalled under its name. The rebuild waits until it connects. Each machine can be bound to only one domain controller.
The domain controller the rebuild takes its DNS from must have a known address: an isolated address in the plan, or the static address recorded in its chosen backup.
To have its Windows roles and features reinstalled before promotion, the domain controller needs a backup taken by a current DC agent, which records them. Their configuration and data, and installed programs, are not carried; the plan names them for each rebuilt domain controller.

A domain or forest plan restores exactly one domain controller per domain and rebuilds the others. A plan that restores two in one domain cannot be approved.

Credentials at recovery time

Cygna Forest Recovery stores no directory credential. Have these available, stored offline, before you need them:

Credential	When it is needed
Your Cygna Forest Recovery operator account with the Restore Operator role	Every recovery. Operator accounts do not depend on Active Directory. Keep the break-glass credential offline as a fallback.
An Enterprise Admin and Schema Admin account of the forest root	Forest recovery, supplied to the plan for the forest root.
A Domain Admin account of each other domain in scope	Domain and forest recovery, supplied to the plan per domain.
The password of each domain's built-in Administrator account (RID 500), as it was at the restore point	Signing in to a restored domain controller to check the restored data, and, in a domain recovery, confirming that every domain's default administrator can sign in while the global catalogs are reconciled. The account is often not named Administrator; the Domains screen shows its name.
A new Directory Services Restore Mode (DSRM) administrator password	Domain and forest recovery. You choose it, and the plan sets it on every domain controller it restores or rebuilds. It must meet the domain's password policy. Store it as your password policy requires:Cygna Forest Recovery never shows it again.

A plan holds the credentials and the DSRM password you supply in memory only, for that plan, and drops them when the plan ends or the Manager restarts. A step that cannot run without one waits until it is supplied. A single-DC restore does not ask for a directory credential.

Network and isolation

Domain and forest recovery restore domain controllers on isolated targets before they rejoin production. Plan the isolation in advance:

No domain controller, member, or client of the directory being recovered, and no other production machine, can reach the restore targets, and they have no route out.
Their only links are two firewalled paths: to the Manager's agent port and to the storage machine's SMB, enforced outside the targets. Isolated does not mean unplugged.
For a forest recovery, the root PDC emulator needs to reach at least one external time source (NTP), and the restored domain controllers of different domains must reach each other.
Restored domain controllers keep their original addresses unless the plan gives them others, so every original must be powered off or isolated.

For the paths, layouts, and a checklist, see Isolating Recovery Targets.

Tombstone lifetime

Every restore point must be younger than its domain's tombstone lifetime, 180 days by default. Keep backups current well inside it: the Domains screen shows the headroom left for each domain. Keep the retention floor at or above the tombstone lifetime so that older clean backups survive a full vault. See Coverage and Readiness and Retention.