Introduction
Cygna Forest Recovery for Active Directory backs up Active Directory and guides you through recovering it, from a single domain controller up to an entire forest. It is built for the worst case: a ransomware attack or other compromise that leaves Active Directory unusable, along with the credentials an attacker would normally use to reach your backups.
This guide describes Cygna Forest Recovery 26.1. It is part of the Cygna Disaster Recovery Suite. Its components, services, and messages carry the suite's short name, Cygna DR: for example, the Cygna DR Manager and the cdr command-line tool. Installer packages and email subjects spell it out as Cygna Disaster Recovery, for example Cygna Disaster Recovery DC Agent in Programs and Features.
Why Cygna Forest Recovery
When an attacker takes control of a directory, the backups are often the next target. They are usually reachable with the same domain credentials the attacker now holds, and restoring them depends on infrastructure that may itself be down. Cygna Forest Recovery is designed around three principles that address this:
- Backups are out of the directory's reach—Backups are kept in a vault on a machine that is not joined to the domain. No domain account has rights to the vault, and between a backup and a restore no network credential exists that can read or delete a backup.
- It works when the directory does not—The Manager, its console, and its operator accounts do not depend on Active Directory or DNS. You can sign in, review restore points, and run a recovery while every domain controller is offline.
- Recovery is a checked, audited plan—Each recovery is planned before anything changes. Preflight checks confirm that the chosen restore point and target machine can succeed, approval and execution are separate permissions, and steps that cannot be undone require typed confirmation. Every action is recorded in the audit trail.
What Cygna Forest Recovery does
- Discovers your environment—Agents on your domain controllers report the forests, domains, sites, and domain controllers they find, and the console shows which of them are protected.
- Schedules and stores backups—The Manager runs full system or DC state backups on the schedule you set for each domain controller, and the storage agent verifies each backup and moves it into the vault.
- Keeps backups usable—Stored backups are re-verified on a schedule, and retention rules decide how much history is kept for each domain controller.
- Prepares for full system recovery—From Windows Server installation media you supply, the storage agent builds the recovery images needed to restore a whole server onto the same or a replacement machine.
- Orchestrates recovery—Restore one domain controller, recover one domain in a running forest, or recover the whole forest following the Microsoft forest recovery procedure, with each step tracked in the console.
- Reports on readiness—The dashboard, alerts, and reports show whether each domain and forest can be recovered, and what to fix if it cannot.
