Restore Methods

Each domain controller in a recovery is brought back by one of five methods. The method depends on whether the domain controller's Windows still starts, whether its hardware is still there, and what kind of backup you have.

DC state recovery

Use DC state recovery when the domain controller's Windows still starts and only its directory needs to go back. It is a supported restore through Directory Services Restore Mode, not a virtual machine snapshot revert, so it does not cause USN rollback.

When you plan a DC state recovery of one domain controller, you name the subtrees and objects to roll back, and they are restored authoritatively: their changes since the backup are undone on every domain controller of the domain. When a domain or forest recovery plan restores a domain controller by DC state recovery, nothing is marked; the restore is non-authoritative.

The DC agent copies the chosen backup from the vault to a local volume on the domain controller and verifies it there. The vault read lease is released before the machine restarts, so the restore does not depend on networking in Directory Services Restore Mode.
The DC agent sets the machine to start in Directory Services Restore Mode for the next start only, and restarts it. The machine's normal boot entry is never changed, so a power loss or failure at this point ends in a normal start.
In Directory Services Restore Mode, the DC agent runs a wbadmin system state recovery.
For a single-DC recovery, still in Directory Services Restore Mode, the DC agent marks each named subtree and object authoritative with ntdsutil.
The machine restarts normally, and the DC agent reconnects and validates the result. For a single-DC recovery, it first imports the back-links ntdsutil wrote, so that group memberships come back, and reads the marked objects' replication metadata to confirm the marks.

DC state recovery works from either backup type. It needs:

A connected DC agent on the machine, because the agent drives the restore.
The backup's Windows build and revision to match the machine as it runs now. DC state cannot be put back across a Windows Update, so after patching, older backups cannot be restored onto the machine this way until a new backup is taken.
Free space on a local volume of about 1.15 times the backup's size, because the agent copies the backup to the machine first and restores from that copy.

DC state recovery always restores onto the same machine. It cannot restore onto another one.

Full system recovery in place

Use full system recovery in place when the domain controller's operating system itself must go back, for example because it is damaged or encrypted, but Windows still starts one last time. The whole server, operating system and directory, is restored from a full system backup onto the same machine's existing disks.

The DC agent fetches the recovery image for the backup's operating system and stages it on the system volume.
The machine restarts once into the recovery image, from a RAM disk.
The recovery agent restores every critical volume from the vault onto the existing disks.
When the Manager has recorded success, the machine restarts into the restored system, and the restored DC agent reconnects.

An in-place recovery restores onto the existing disk layout and cannot repartition. If disks were added, resized, replaced, or converted between partition styles since the backup, choose a backup taken after the change. For how the recovery image works, see Recovery Images.

Full system recovery onto a candidate

Use full system recovery onto a candidate when the domain controller's Windows will not start, or its hardware is gone. A candidate is a machine that is not a domain controller, with the DC agent installed and enrolled, that receives the restored server. The candidate's own agent stages the recovery image, and the candidate comes up as the original domain controller: same name, same security identifier, same configuration.

Because of that, the original domain controller must be powered off or isolated before you execute. Two machines with one domain controller's identity damage a domain rather than recover it. Preflight asks the candidate to check every address the original used, and refuses approval while the original still answers.

A candidate needs at least as many disks as the backup, each the same size or larger, and the same firmware type (UEFI or BIOS) as the original. For virtual machines, the cdr dc rebuild command can create a Hyper-V virtual machine, or write a VMware ESXi script, shaped like the backup, ready for you to install Windows Server and the DC agent onto. To skip installing anything, recover onto a new VM instead, described below.

The restored system starts with the network settings in the backup. On different hardware, Windows puts the old static address on an adapter that no longer exists, so the restored domain controller would start on DHCP. To prevent that, the Manager by default plans the backup's own static address for the restored system, and the restored DC agent applies it to the new adapter at first start. This needs a backup that recorded exactly one static address. For a single-DC full system recovery you can also choose the restored system's address yourself.

After any full system recovery, the restored domain controller's DC agent reconnects to the Manager and checks that the domain controller works: AD DS running, SYSVOL ready, replication converging, and dcdiag clean. The run completes or fails on its answer.

Full system recovery onto a new VM

Use full system recovery onto a new VM in the same situations as a candidate, when you would rather not prepare a machine first. The target is an empty virtual machine: nothing is installed on it, not even Windows.

When you execute the recovery, the storage agent builds a recovery ISO for this run only, from the installation media's boot files and the recovery image. The ISO carries only the run's single-use enrollment token, the Manager's address, and the Manager's CA fingerprint.
On Hyper-V, cdr dc rebuild --restore-run builds the VM shaped from the run's restore point, attaches the ISO, and starts it. On another hypervisor, you build the VM and attach the ISO yourself.
The VM boots the ISO, and the recovery agent enrolls with the Manager, which then hands it the vault credential. Before anything is written, the recovery agent checks the VM's firmware and disks against the backup, and stops with nothing written if they do not fit.
The recovery agent restores every critical volume from the vault, and the VM restarts into the restored domain controller, as after a recovery onto a candidate.

A recovery onto a new VM needs:

A full system backup.
The original domain controller powered off. While its agent is connected to the Manager, preflight blocks approval and execution is refused.
The installation ISO for the backup's operating system in the OS media library.
A recovery image for the backup's operating system.
Hyper-V for the automated VM build.

The restored system's address is planned as for a candidate. Recovery onto a new VM is a single-DC recovery; domain and forest recovery plans do not offer it. A test restore uses the same path on an Isolated Recovery Host, and then isolates and checks the restored copy instead of putting it into production; see Test Restores. For the procedure, see Full System Recovery onto a New VM.

Rebuild

A rebuild does not restore the domain controller at all. Its metadata is removed from the directory, and a fresh domain controller is promoted in its place, which then replicates the directory from the domain's other domain controllers. A rebuild needs no backup of that machine, so it is the path when its backups are stale, past the tombstone lifetime, or suspect.

A rebuild is required for:

Read-only domain controllers, which are never restored.
A domain controller whose operations master roles were seized by another domain controller after its backup.

In a domain or forest plan, rebuild is a disposition you set per domain controller, and the plan carries it out after the domain is back. It promotes either a candidate machine you bind to the domain controller in the plan, which is renamed to match, or the domain controller's own machine, reinstalled and connecting with the DC agent under its own name. Before promoting it, the plan reinstalls the Windows roles and features the domain controller's last backup recorded, and names any that would not install. The roles come back without their configuration or data, and installed programs are not reinstalled; insecure legacy features such as SMB 1.0 are left out. The plan names all of these for each rebuilt domain controller, and the recovery report lists them as follow-ups. To rebuild a single domain controller outside a plan, remove its metadata with cdr cleanup dc and promote a replacement with your usual tools.

Authoritative and non-authoritative restores

A restore is non-authoritative for Active Directory unless you name what to roll back: the restored domain controller accepts changes from its replication partners rather than overwriting them.

In a DC state recovery of a single domain controller, the subtrees and objects you name are marked authoritative, so they replicate out to every domain controller of the domain as they were at the backup. Everything else, including SYSVOL, converges from the domain's healthy domain controllers. Group Policy objects roll back in the directory, but their SYSVOL files do not. See Restoring a DC with DC State Recovery.
In a single-DC full system recovery, both Active Directory and SYSVOL converge from the domain's healthy domain controllers.
In a domain or forest recovery, the first restored domain controller in each domain has its SYSVOL made authoritative, because there are no healthy partners to converge from. This happens on exactly one domain controller per domain.
In a test restore, the restored copy is started on a private network as the first domain controller of its domain, so its SYSVOL is made authoritative. This affects only the isolated copy, which is deleted afterward.

A DC state recovery never marks a whole partition, the schema, a krbtgt account on its own, the domain controllers, or CN=System and the objects directly in it. To recover individual objects and attributes without restoring a domain controller, use the Recovery for Active Directory module of Cygna Auditor; see Related Cygna Products.

Comparing the methods

Method	Machine state	Backup type	Target
DC state recovery	Windows starts; same build and revision as the backup	Full system or DC state	Same machine
Full system recovery in place	Windows starts one last time; disk layout unchanged	Full system	Same machine
Full system recovery onto a candidate	Original will not start or is gone; must be off or isolated	Full system	Candidate machine with the DC agent
Full system recovery onto a new VM	Original will not start or is gone; must be powered off	Full system	Empty VM booted from the run's recovery ISO
Rebuild	Any	None needed	A machine promoted fresh

For everything each method needs at recovery time, see Recovery Requirements.