System Requirements
This topic lists the requirements for each machine in a Cygna Forest Recovery deployment. Requirements that apply only when you recover a server are in Recovery Requirements.
Machines at a glance
| Machine |
Operating system |
Minimum |
Recommended |
| Manager |
64-bit Windows Server 2019 or later |
2 processor cores, 4 GB of memory |
4 processor cores, 8 GB of memory |
| Storage machine |
64-bit Windows Server 2019 or later |
4 processor cores, 4 GB of memory |
4 processor cores, 8 GB of memory |
| Isolated Recovery Host (optional) |
64-bit Windows Server 2019 or later, with Hyper-V |
4 processor cores, 8 GB of memory |
8 processor cores, 32 GB of memory, on a dedicated machine |
| Candidate machines (optional) |
64-bit Windows Server 2019 or later |
Enough memory to start the recovery image: its size plus about 1 GB |
The processors and memory of the domain controller it replaces |
| Domain controllers |
Windows Server 2016 through Windows Server 2025, Server Core or Desktop Experience |
— |
— |
All components
- No .NET runtime is needed. Each component includes everything it needs to run.
- No database server is needed. The Manager uses an embedded database.
- The installers run silently from the command line, with
msiexec /qn. They have no setup wizard.
- Install the current Windows updates on the Manager, the storage machine, and the Isolated Recovery Host before you install, and keep them current. Their services need them and can fail to start on a system that is behind. The DC agent does not need them, so a domain controller rebuilt from installation media during a recovery can take its agent before it is updated.
Manager machine
| Requirement |
Details |
| Operating system |
64-bit Windows Server 2019 or later. |
| Domain membership |
Not joined to any domain. Never a domain controller. |
| IP address |
A fixed IP address: static, or a DHCP reservation that does not change. |
| Ports |
TCP 5210 (console and REST API) and TCP 5211 (agent connections) must be free. TCP 80 is used for the optional redirect to HTTPS; if another program already uses it, the Manager starts without the redirect. You can choose other ports at installation. |
| Other software |
None. IIS, SQL Server, and a .NET runtime are not required, and neither is a PDF converter: the Manager installs its own PDF renderer. |
| Disk space |
The database, its daily snapshots, and the service logs are kept under %ProgramData%\Cygna Labs\Disaster Recovery Suite Manager. Backups are not stored on the Manager machine. The program folder includes the PDF renderer and the browser engine it uses, which take more than 250 MB. |
Storage machine
| Requirement |
Details |
| Operating system |
64-bit Windows Server 2019 or later. |
| Domain membership |
Not joined to any domain. Never a domain controller. |
| IP address |
A fixed IP address: static, or a DHCP reservation that does not change. If the machine has more than one address, set the Advertised host setting to the address domain controllers should use. |
| Storage volume |
A local folder for the storage root, such as E:\CygnaDR, on an NTFS or ReFS volume large enough for your backups. The storage agent creates the staging, vault, and manager-backups folders in it. To work out the size, see Sizing Backup Storage. The storage root must be available when the service starts, or the storage agent does not start. BitLocker on this volume, with auto-unlock, is recommended. See Encrypting the vault volume. |
| Staging share |
An SMB share over the staging folder under the storage root, which you create. Never share the storage root itself, and don't use an administrative share such as E$. The storage agent checks the share's permissions and adds what it needs, but does not create the share. Success auditing for Logon, File Share, Detailed File Share, and File System on the storage machine is recommended, so that every connection to the share is seen. See Audit policy on the storage machine. |
| Inbound SMB |
TCP 445 open from your domain controllers and recovery targets, and from the Isolated Recovery Host if you have one. The storage agent installer does not create this firewall rule. |
| Installation media and recovery images |
Folders for your Windows Server installation media (ISO files) and for the recovery images built from them. Recovery images can be built only when a recovery image folder is set. |
| Service account |
The storage agent runs as LocalSystem and needs local administrator rights. Don't change it to another account. |
Domain controllers
| Requirement |
Details |
| Operating system |
Windows Server 2016 through Windows Server 2025, Server Core or Desktop Experience. |
| SYSVOL replication |
SYSVOL must replicate with DFS Replication (DFSR) in every domain you protect. A domain whose SYSVOL still replicates with FRS cannot be recovered: its coverage shows FRS SYSVOL — unsupported, and preflight refuses a restore of its backups. To check a domain, run dfsrmig /getglobalstate on one of its domain controllers; a domain on DFSR reports Eliminated. To move a domain from FRS to DFSR, follow Microsoft's Migrate SYSVOL replication from FRS to DFS Replication. |
| Windows Server Backup |
The Windows Server Backup feature must be installed. See Windows Server Backup later in this topic. |
| Network |
Outbound access to the Manager on TCP 5211 and to the storage machine on TCP 445. |
| Free disk space |
For a DC state recovery, free space on the domain controller of about 1.15 times the size of the backup being restored. For details, see Recovery Requirements. |
| Remote installation (optional) |
To install the DC agent from the console or with cdr agent deploy, the target needs the ADMIN$ share, the Remote Registry service, and either WinRM or DCOM. See Accounts and Permissions. |
Candidate machines
A candidate machine receives a recovered domain controller when the original cannot start. It must meet these requirements before a recovery can use it:
| Requirement |
Details |
| Operating system |
64-bit Windows Server 2019 or later, able to start normally. |
| DC agent |
The DC agent installed and enrolled with the Manager. |
| Role |
Not a domain controller. |
| Hardware |
At least as many disks as the backed-up domain controller, each the same size or larger, and the same firmware type (UEFI or BIOS). Enough memory and free space to start the recovery image. With Secure Boot on, firmware that trusts Microsoft's Windows UEFI CA 2023 certificate, which a domain controller with current updates boots with. A virtual machine gets this from a Hyper-V host on current Windows updates. |
| Network |
The same access as a domain controller: the Manager on TCP 5211 and the storage machine on TCP 445. |
The full hardware requirements, and the conditions that must hold at the time of recovery, are in Recovery Requirements.
Isolated Recovery Host (optional)
An Isolated Recovery Host is a Hyper-V host on which Cygna Forest Recovery runs test restores of your backups. You need one only if you want backups verified by test restores. A dedicated machine is recommended.
| Requirement |
Details |
| Operating system |
64-bit Windows Server 2019 or later, kept on current Windows updates. A host that is behind on updates can fail to start a restored domain controller that is more current than the host, so its test restores fail. See Keeping the host current. |
| Processor and memory |
See Machines at a glance at the start of this topic. Each test restore virtual machine is given the memory its backup recorded, reduced to what the host has free, and the host warns when it has less than 8 GB. |
| Virtualization |
Hyper-V. The agent installs it, with its PowerShell module, when it is missing. On a physical machine, processor virtualization (Intel VT-x or AMD-V) must be turned on in the firmware. On a virtual machine, nested virtualization must be turned on. |
| Disk space |
Room on an NTFS or ReFS drive for the disks of each domain controller you test, at the sizes its backup recorded. Each test restore checks the free space before it starts. The host warns when less than 100 GB is free where the virtual machines go. A data drive separate from the system drive is recommended. |
| Domain membership |
Not joined to any domain. Never a domain controller, and never on the same machine as one. |
| Other roles |
A machine of its own is recommended. The storage agent or the Manager may run on the same machine; this is supported, with the costs described in Planning Your Deployment. |
| Network |
On the same network as the Manager and the storage machine. Outbound access to the Manager on TCP 5211 and to the storage machine on TCP 445. DNS servers configured on the host, which test restores use. |
| Recovery network |
A private IPv4 network, from a /16 to a /29, that is used nowhere the host needs to reach. The agent creates it behind Windows NAT on the host. The default is 172.31.250.0/24. |
Operator workstation
| Requirement |
Details |
| Web browser |
A current web browser. |
| Network |
Access to the Manager on TCP 5210, and optionally TCP 80 for the redirect to HTTPS. |
| Certificate trust |
The Manager's certificate authority trusted on the workstation, so the browser does not warn about the console's certificate. See Trusting the Manager Certificate. |
| Command-line tool |
cdr.exe runs on Windows. It is installed on the Manager machine; to use it elsewhere, copy it from the Manager's program folder. |
Windows Server Backup
Cygna Forest Recovery backs up domain controllers with Windows Server Backup (wbadmin). The Windows Server Backup feature is not installed on Windows Server by default, so a backup fails on any domain controller that does not have it.
You can install the feature in either of these ways:
- Install it yourself on each domain controller, for example with the PowerShell command
Install-WindowsFeature Windows-Server-Backup, or through your usual configuration management tools.
- Let the DC agent install it when it is missing. The Install the Windows Server Backup feature setting on the Domain controller agents tab of the Configuration screen does this, and is on by default. Where adding a Windows feature to a domain controller must go through change control, turn it off and install the feature yourself. See Settings Reference.
