Glossary

This glossary defines the terms this guide uses with a specific meaning in Cygna Forest Recovery.

A

abandon—To close a restore run that cannot be cancelled because its machine is gone or will be rebuilt. A reason is required and is recorded in the audit trail. See Recovery Lifecycle.
abort—To end a running recovery plan for good. An aborted plan cannot be resumed; the recovery is planned again instead. See Recovery Lifecycle.
abort class—What stopping a recovery step would leave behind: safe to stop (nothing was changed), stopping needs cleanup (the machine was changed), or point of no return. A restore run's In progress card shows it, and a recovery plan's abort dialog says what aborting at that point leaves.
advisory gate—A preflight check result that you should read before you approve a restore or recovery plan, but that does not block approval. See gate.
agent ID—The identifier the Manager gives an enrolled agent. Commands that act on one agent, such as recovering onto a candidate machine, take it.
approve—To authorize a planned restore or recovery plan once its hard gates are clear. Approving needs a different capability from executing, so one person can approve and another run. See Recovery Lifecycle.
at risk—A coverage verdict for a domain or forest that could be recovered today, but with a weakness that needs attention—for example, a domain whose recovery depends on a single domain controller. See Coverage and Readiness.
attestation—An operator's recorded confirmation that a recovery step performed or checked outside Cygna Forest Recovery is done—for example, that the recovered domain controllers are isolated. Rejecting the step instead fails it and halts the plan.
authoritative restore—A restore in which chosen objects are marked so that they replicate out to the other domain controllers instead of being overwritten by them. A DC state recovery of one domain controller restores the subtrees and objects you name authoritatively. See Restore Methods.

B

backup target—A domain controller with an enabled backup policy. Protection verdicts and alerts about missing backups apply to backup targets; a domain controller that is not one is rebuilt on recovery. See Backup Targets and Rebuilt Domain Controllers.
breach flag—A recovery plan option for recovering from a security breach. It adds the breach-response resets on every restored domain controller, and in a forest recovery it resets every trust. Without it, a forest recovery resets no trust. See Recovering a Forest.
break-glass account—The operator account created at the first console sign-in. It holds every capability, its password is shown once, and no administrator can change it. Use it when no named account is available, and store its credential offline. See Signing In for the First Time.

C

CA fingerprint—The SHA-256 hash of the Manager's certificate authority, shown as 16 groups of four hexadecimal digits. Agents and the cdr tool use it to recognize the Manager. It is public, not secret. See Certificates and Trust.
cancel—To stop a backup job, or a restore before it starts writing to the machine. A test restore can be cancelled at any point. See also discard and abandon.
candidate machine—A bare machine, not a domain controller, with the DC agent enrolled, other than the storage machine or an Isolated Recovery Host, that can receive a full system recovery when the original domain controller will not start. It is listed on the Agents screen, not the Domain Controllers screen. See Full System Recovery onto a Candidate.
capability—A single permission, such as starting backups or approving restores. Roles grant capabilities, and the Manager checks them on every request. See Managing Operators and Roles.
cdr—The command-line tool installed with the Manager, for scripting, monitoring, and tasks the console does not perform. See Command-Line Reference.
change journal—The record an NTFS or ReFS volume keeps of every change to its files. The storage agent reads the vault volume's change journal to detect changes to committed backups that retention did not make. See Detecting changes to committed backups.
configuration backup—An encrypted copy of the Manager's database, enrollment token, and secret settings that the Manager sends to the storage machine on a schedule, daily by default. Only the recovery passphrase that was current when it was written opens it. See Manager Configuration Backups.
confirm gate—A preflight check result on a restore run that blocks approval until the approver accepts it by its code, or the run is cancelled. It reports something that failed from where the Manager looked but may not fail from where the recovery environment runs. See Preflight Check Reference.
console—The web application the Manager serves, where operators monitor protection and run backups and recoveries. See Using the Console.
covered—The best domain coverage verdict: two or more writable domain controllers hold full system backups, and the newest backup is fresh and inside the tombstone lifetime. A domain with a warning verdict can also be recovered today, but is at risk. See Coverage and Readiness.

D

DC agent—The service installed on every domain controller, and on candidate machines. It reports topology, runs backups, and carries out restores and recovery steps. It only connects out to the Manager and listens on nothing. See Components and Architecture.
DC state backup—A smaller, faster backup that captures Active Directory and the domain controller's Windows system state, including the registry. It supports DC state recovery on a domain controller that still boots, but not full system recovery. See Backup Types.
DC state recovery—A restore of a domain controller whose Windows installation still starts. The DC agent restores DC state from a backup in Directory Services Restore Mode, then restarts normally. Planned for one domain controller, it marks the subtrees and objects you name authoritative, so they go back to the backup on every domain controller of the domain; in a domain or forest plan it is non-authoritative. It works from either backup type. See Restoring a DC with DC State Recovery.
discard—To remove a planned or approved restore that was never executed, such as one whose preflight failed.
domain recovery—Recovery of one domain while the rest of the forest stays live. See Recovering a Domain.
DSRM password—The Directory Services Restore Mode administrator password of a domain controller. A domain or forest recovery sets a new one, which you supply, on every domain controller it recovers. The Manager holds it in memory only and never shows it again.

E

enrollment token—The shared secret an agent presents to enroll with the Manager. A valid token enrolls an agent immediately, with no approval step, so keep it secret. See Certificates and Trust.
exclude (recovery plan)—In a domain or forest recovery plan, to neither restore nor rebuild a domain controller. Its metadata is removed from the directory along with the domain's other domain controllers, and it is not brought back; keep the machine off the network. Not the same as an exclusion.
exclusion—An operator's decision to put an object out of scope, with a mandatory reason and an optional review date. An excluded object stops counting toward alerts but is still discovered and shown: an exclusion changes what is counted, never what is shown. See Excluding and Retiring Objects.
execute—To start an approved restore or recovery plan. Executing needs its own capability, separate from approving.

F

forest recovery—Recovery of a whole forest following the Microsoft forest recovery procedure: the forest root domain first, then each child domain after its parent. See Recovering a Forest.
full system backup—A backup of every critical volume a domain controller needs to start (wbadmin -allCritical), including Windows, applications, and DC state. It supports both DC state recovery and full system recovery, and is the default backup type. See Backup Types.
full system recovery—A restore of a whole server from a full system backup through the recovery image, in place, onto a candidate machine, or onto a new virtual machine booted from a recovery ISO. Use it when the operating system must be restored as well as the directory, or the hardware is replaced. A recovery in place needs the domain controller's Windows to start once; when it will not start, recover onto a candidate machine or a new virtual machine. See Restore Methods.

G

gate—The result of one preflight check on a restore or recovery plan. A hard gate blocks approval until it is cleared; a confirm gate blocks approval of a restore run until you accept it; an advisory gate is for you to read. See Preflight Check Reference.

H

hard gate—A preflight check result that blocks approval of a restore or recovery plan until it is cleared. See gate.
hash verification—The storage agent's scheduled, read-only re-check that each stored backup still matches the content hash taken when it was committed. Restores also verify the hash before they read a backup. See Vault Protection and Integrity.

I

in place—A full system recovery onto the domain controller's own hardware. Its Windows installation must start once so that its agent can stage the recovery image. See Full System Recovery in Place.
Isolated Recovery Host—An optional Hyper-V host, not joined to any domain, on which test restores run. It runs the Isolated Recovery Host agent, which builds the test restore virtual machines and isolates them. A host is given test restores only once an operator approves it. See Setting Up an Isolated Recovery Host.
isolation—Cutting the domain controllers being recovered off from the production network, so that recovered and damaged copies of the directory cannot replicate with each other. The targets keep only firewalled paths to the Manager and the storage machine. An operator attests it during a domain or forest recovery. A test restore is isolated differently: the restored system runs on a private switch on the Isolated Recovery Host that reaches nothing. See Isolating Recovery Targets.

L

license—The Cygna license key that entitles an installation to back up and recover. Its count of people is shown beside the enabled user accounts. After its end date and a 14-day grace period (none for a trial), or with no key installed, the Manager refuses new backups, restores, recovery plans, and test restores. See Licensing.

M

Manager—The central service, on a machine that is not joined to the domain. It holds the database, its own certificate authority, the scheduler, inventory, recovery plans, settings, operator accounts, and the audit trail, and serves the console. See Components and Architecture.
manifest—The document stored with each backup that describes the machine at the time: identity, operating system, hardware, network, directory roles, and backup details. It is covered by the backup's content hash, and full system recovery is planned from it. See Restore Points.
multi-factor authentication (MFA)—An optional second sign-in step that each operator turns on for their own account: after the password, a 6-digit code from an authenticator app on their phone. See Multi-Factor Authentication.

N

newest—The default retention mode, which keeps the most recent versions of each domain controller's backups. See Retention.
notification addresses—The email addresses a recovery plan tells when it halts, is aborted, or waits for a person, and sends its recovery report to when it completes.

O

operator—A person who signs in to the console or the cdr tool with an account the Manager holds. Operator accounts are not Windows or Active Directory accounts, so they work while the directory is down. See Managing Operators and Roles.
OS media—The Windows Server installation ISO files you supply, from which the storage agent builds recovery images. See Setting Up OS Media and Recovery Images.

P

point of no return—A recovery step that cannot be undone, such as seizing operations master roles or cleaning up metadata. A plan stops before each one and runs it only after an operator acknowledges it by typing the step's code. Every acknowledgment is audited.
post-recovery directive—A signed instruction that a restored domain controller's agent applies at its first start, such as the network settings chosen for the restored system.
preflight—The checks the Manager makes on a restore or recovery plan to confirm that the chosen backup and target can succeed: when it is planned, and again before it is approved. A restore is checked once more when it executes. Each check produces a gate. See Preflight Check Reference.

R

rebuild—In a recovery plan, to clean up a domain controller's metadata and promote a new domain controller in its place, with no backup restored. The plan reinstalls the Windows roles and features the domain controller's last backup recorded before promoting it.
rebuilt on recovery—The protection verdict of a domain controller that is not a backup target: no enabled policy covers it and nothing of it is in the vault. A recovery rebuilds it by promotion, so the verdict is information and raises no alert. See Backup Targets and Rebuilt Domain Controllers.
recovery agent—The program that runs inside the recovery image. It reads the backup from the vault, restores the whole server, and reports progress to the Manager. It is not installed or enrolled separately. See Recovery Images.
recovery code—One of ten one-time codes issued when an operator turns on multi-factor authentication. Each signs in once in place of an authenticator code, for when the phone is not at hand. See Multi-Factor Authentication.
recovery environment—The Windows PE system a machine runs from the recovery image during a full system recovery.
recovery ISO—A bootable ISO the storage agent builds for one restore run onto a new virtual machine. It carries the recovery image and the run's single-use enrollment token, and nothing else that grants access. See Full System Recovery onto a New VM.
recovery image—A Windows PE image built from your own Windows Server media, containing the recovery agent. One is built for each operating system variant your domain controllers run. An image is proven once a restore that started from it completes, including a test restore. See Recovery Images.
recovery network—The internal Hyper-V switch named CygnaDR Recovery, with Windows NAT behind it, that the Isolated Recovery Host agent creates. Test restore virtual machines reach the Manager and the storage machine through it while they restore, and nothing on your network can reach them.
recovery passphrase—The passphrase, set at the first sign-in, that protects an escrow copy of the Manager's CA key. It also opens the Manager's configuration backups. You need it to recover the Manager on a new machine. See Recovering the Manager.
recovery plan—An ordered, gated set of steps that recovers one domain or a whole forest. See also restore run. See How Recovery Works.
recovery report—The report a domain or forest recovery plan produces at its last step and emails to its notification addresses: what happened to each domain controller, the manual follow-ups left, and the decisions made on the way. See After a Recovery.
repository—The vault seen as storage: its capacity, how much history it holds per domain controller, retention, and hash verification coverage. The console's Repository screen shows it. See Repository.
restore point—One stored backup of one domain controller that can be restored, with its manifest. See Restore Points.
restore verified—The verdict of a test restore whose backup restored, started isolated, and passed every required check. The other verdict is restore failed, which names the step and the reason. A test restore that could not do its part leaves the backup unverified. See Test Restores.
restore run—The restore of one domain controller, planned, approved, and executed as a unit. A domain or forest recovery plan runs restore runs as some of its steps.
retention floor—An age within which no version is deleted to make room for an incoming backup. It does not limit the version-count or age ceilings; see Retention.
retention mode—How retention chooses which backups to keep: newest or thinned. See Retention.
retired—Recorded as removed from the directory, either by discovery or by an operator. Retired domain controllers are not counted in coverage. See Excluding and Retiring Objects.
role—A named set of capabilities assigned to an operator: Viewer / Auditor, Backup Operator, Restore Operator, or System Admin. An operator's capabilities are the combination of their roles. See Managing Operators and Roles.

S

staging—The folder on the storage machine that domain controllers write a backup into, through a share and with a single-use account, before the backup is verified and moved into the vault. See How Backup Works.
staging share—The SMB share over the staging folder through which domain controllers write backups, each job with its own local account. The storage agent watches it and reports any other use as an unexpected SMB connection. See Vault Protection and Integrity.
start time—The earliest time of day, in the Manager's local time, at which a backup policy's backups are due. See Managing Backup Policies.
storage agent—The service on the storage machine that owns the staging folder and the vault, commits and verifies backups, applies retention, and builds recovery images. See Components and Architecture.
storage machine—The machine, not joined to the domain, that holds the vault and runs the storage agent. An installation has one: the first storage agent to enroll. A storage agent that enrolls after it is a candidate and is given no work until the storage machine is replaced with it. A domain controller can never be the storage machine. See Setting Up the Storage Machine.
support package—One zip file with the evidence for a support case: the Manager's log, a copy of the Manager database with every credential removed, host and configuration facts, and the logs of every connected agent. It is customer confidential and cannot restore a Manager. See Logs and Diagnostics.
survey—A request to the target of a planned restore to describe itself again, so that the preflight checks reflect any change made to it since planning.

T

test restore—A restore of one backup onto a new virtual machine on an Isolated Recovery Host, started where it cannot reach your network and checked as a working domain controller, then deleted. Nothing in production changes. See Test Restores.
thinned—A retention mode that keeps each domain controller's newest and oldest versions within the retention floor and deletes from between them, so history is dense near today and sparse further back. See Retention.

U

unattended plan—A domain or forest recovery plan that does not stop for a person at points of no return, attestations, the backup checkpoint, or restore confirmations. The operator who executes it confirms this and accepts each pause in their own name. It still halts on a failed step, waits for a missing credential, and stops at every trust reset that must be done by hand. See Recovering a Forest.

V

vault—The folder on the storage machine that holds committed backups. It has no network share, and no credential that exists between a backup and a restore can reach it over the network. See Vault Protection and Integrity.
version identifier—The identifier Windows Server Backup gives a backup, shown as recorded (for example 10/05/2026-02:30, in the domain controller's date format). Restores are addressed by it.