Restore Points
A restore point is one committed backup of one domain controller, together with the record of what that backup captured. Every backup that reaches the vault becomes a restore point. Recovery plans are built from restore points: you choose one for each domain controller you restore, and preflight checks it against the machine it will be restored onto.
The manifest
The record that travels with each backup is its manifest. The DC agent collects it while the backup runs, and the storage agent stores it beside the backup in the vault. The Manager keeps a copy in its database. The manifest is covered by the backup's hash, so a manifest that has been changed is detectable.
The manifest describes the machine as it was at backup time, which is what a restore would put back:
| Group | What it records | Used for |
|---|---|---|
| Identity | FQDN, NetBIOS name, domain, forest, site, domain SID, DC object GUID | Matching the backup to its machine, domain, and forest |
| Operating system | Version, build, update build revision (UBR), edition, install type (Desktop Experience or Server Core), language, install volume | The build check for DC state recovery; choosing the recovery image and installation media |
| Active Directory role | Global catalog, read-only flag, SYSVOL replication engine (DFSR or FRS), operations master roles held | Deciding whether the DC can be restored and in what order |
| Backup | Version identifier, backup type, vault path, committed size, content SHA-256, DC agent version, start and completion times | Addressing the restore and proving the content is unchanged |
| Hardware | Platform and model, firmware (UEFI or BIOS), Secure Boot, TPM, memory, processors, each disk's size and partition style, volumes and their BitLocker status | Full system recovery checks against the target machine; shaping a replacement machine |
| Network | Each adapter's MAC address, DHCP or static addresses, gateways, DNS servers in order; persistent routes; primary DNS suffix | Putting the original address back after a full system recovery; isolation planning |
| Roles, features and programs | The Windows roles and features installed, and the installed programs with their versions and publishers | Reinstalling a rebuilt domain controller's roles and features before it is promoted; listing in the recovery report what a rebuild does not bring back: the roles' configuration and the programs |
Manifests also record other facts that preflight relies on, such as server roles running beside Active Directory on the domain controller.
The version identifier
Windows Server Backup gives each backup a version identifier, and a restore is addressed by it. The identifier is written in the format of the domain controller's own locale. For example, a backup taken at the same moment reads 09/02/2026-23:00 on a US English domain controller and 02.09.2026-23:00 on a German one.
Cygna Forest Recovery reads the identifier from wbadmin after each backup, confirms it by asking wbadmin to accept it, and stores and shows it exactly as wbadmin wrote it. It is never reformatted, so do not read it as a date in your own locale. The console uses the backup's recorded UTC times for ordering and age.
If the identifier could not be captured, the backup is still committed and kept, but preflight refuses to restore from it. Choose another restore point.
Restore points that cannot be used
A restore point's record is kept when it can no longer be restored, so that the record of what was backed up is not lost. The console says why it cannot be used:
- Pruned—Retention has deleted the backup content. The manifest is kept as a record and the restore point detail shows Backup pruned, but there is nothing left to restore. Because a pruned backup is not a restore point, the Restore Points screen and
cdr backup listhide pruned backups and count them; you can show them as history. How long these records are kept is set by the Manifests database retention setting, which keeps them indefinitely by default. - Older than the tombstone lifetime—Restoring it would reintroduce deleted objects. Preflight refuses it.
- Blocked for the chosen method—For example, a DC state backup cannot be used for a full system recovery, and a backup taken before the machine was last patched cannot be used for a DC state recovery. The restore point picker shows these points, but they cannot be selected, and the reason is shown beside each.
A backup taken while a recovery of its forest was under way can be restored, but it holds the directory part-way through that recovery: operations master roles just seized, domain controllers removed and not yet rebuilt, and initial synchronization turned off. The console tags it During recovery, cdr backup list marks it during recovery, and restore preflight raises an advisory gate that names the plan and the step it had reached. Restore it only if that is the state you mean to return to.
The Restore Points screen lists the newest restore points across the estate. To see the full history of one domain controller, open its restore points from the machine's cross-links or filter the screen to that machine.
Verified restore points
A full system restore point can be proven by a test restore on an Isolated Recovery Host, which restores it onto an isolated virtual machine and checks it as a working domain controller. The result is recorded against that one version: verified or failed. A version that was never tested, or whose test ended without a verdict (inconclusive), is unverified. A newer backup of the same domain controller starts unverified.
The result is shown in the Test restore column of the Restore Points Screen screen and on each restore point's page, next to each restore point when you plan a single-DC restore, and in cdr backup list. For more information, see Test Restores.
Backups taken before a CA re-key
Each backup records which Manager certificate authority its DC agent trusted at the time. If you later re-key the Manager CA, a restore of an older backup brings back a DC agent that still trusts the old CA and refuses to connect to the Manager until it is re-pointed.
Preflight detects this. When a restore would bring back an agent that trusts a different CA, the plan shows it as a finding. It blocks approval if the plan includes network settings for the restored system, because the restored agent would refuse the Manager's signed instructions. Otherwise it is advisory: the directory is restored, and you re-point the agent as soon as the machine is up. Take fresh backups of every domain controller you back up after a re-key. For the re-key procedure, see Re-Keying the Manager CA.
