Pre-Deployment Checklist
Complete this checklist before you install Cygna Forest Recovery. Each section names the topic in this guide that has the details.
Machines
For details, see Planning Your Deployment and System Requirements.
Size each machine as follows:
| Machine | Operating system | Minimum | Recommended |
|---|---|---|---|
| Manager | 64-bit Windows Server 2019 or later | 2 processor cores, 4 GB of memory | 4 processor cores, 8 GB of memory |
| Storage machine | 64-bit Windows Server 2019 or later | 4 processor cores, 4 GB of memory | 4 processor cores, 8 GB of memory |
| Isolated Recovery Host (optional) | 64-bit Windows Server 2019 or later, with Hyper-V | 4 processor cores, 8 GB of memory | 8 processor cores, 32 GB of memory, on a dedicated machine |
| Candidate machines (optional) | 64-bit Windows Server 2019 or later | Enough memory to start the recovery image: its size plus about 1 GB | The processors and memory of the domain controller it replaces |
| Domain controllers | Windows Server 2016 through Windows Server 2025, Server Core or Desktop Experience | — | — |
Then check each item:
| Item | Details | Done |
|---|---|---|
| Manager machine | 64-bit Windows Server 2019 or later. Not joined to any domain, and never a domain controller. No IIS, SQL Server, or .NET runtime is needed. | |
| Storage machine | 64-bit Windows Server 2019 or later. Not joined to any domain, and never a domain controller. A separate machine from the Manager is recommended; if you share one machine, protect it as you would the vault. | |
| Fixed IP addresses | A static address, or a DHCP reservation that never changes, for both the Manager machine and the storage machine. Agents are configured with these addresses and are not updated if they change. | |
| Local administration | Both machines are managed with local accounts that are not used anywhere else, by a small number of people, with no management tool that gives domain administrators a path to them. | |
| Domain controllers | Windows Server 2016 through Windows Server 2025, Server Core or Desktop Experience. Every domain controller you protect runs the DC agent. | |
| Windows Server Backup | The Windows Server Backup feature installed on every domain controller, for example with Install-WindowsFeature Windows-Server-Backup. Alternatively, let the DC agent install it: the Install the Windows Server Backup feature setting is on by default. |
|
| DC agent installation method | From the console, with cdr agent deploy, or with your own software distribution tools. Remote installation needs the ADMIN$ share and the Remote Registry service on each target, plus WinRM (with the domain controllers in the Manager machine's WinRM TrustedHosts list) or DCOM (with the Windows Management Instrumentation (WMI-In) firewall rule group enabled). |
|
| Candidate machines (optional) | 64-bit Windows Server 2019 or later, not a domain controller, with the DC agent enrolled. At least as many disks as the domain controller it replaces, each the same size or larger, and the same firmware type (UEFI or BIOS). If a candidate's boot controller differs from the original's, install its driver on the original domain controller before the backup. Built-in drivers cover common virtual controllers. | |
| Isolated Recovery Host (optional) | Needed only for test restores of your backups. A dedicated Hyper-V host running 64-bit Windows Server 2019 or later on current Windows updates, which it must be kept on, sized as in the table above, with room on an NTFS or ReFS data drive for restored domain controller disks, and processor virtualization turned on (nested virtualization if it is a virtual machine). Not joined to any domain, never a domain controller. The agent installs Hyper-V itself. A private IPv4 network prefix that is not used elsewhere, for its recovery network. | |
| Operator workstations | A current web browser. Plan to trust the Manager's certificate authority on each workstation used to operate Cygna Forest Recovery. |
Network and firewall
Ports are the defaults; you can change the Manager ports at installation. For details, see Ports and Protocols.
| Item | Details | Done |
|---|---|---|
| Agents to the Manager | TCP 5211 from every domain controller, the storage machine, candidate machines, and the Isolated Recovery Host to the Manager. | |
| Domain controllers to the storage machine | TCP 445 (SMB) from every domain controller and recovery target, and from the Isolated Recovery Host if you use one, to the storage machine. The storage agent installer creates no firewall rule, so add one, limited to those networks. | |
| Operators to the Manager | TCP 5210 (console, REST API, and cdr) from operator workstations to the Manager, and optionally TCP 80 for the redirect to HTTPS. |
|
| Remote installation (optional) | From the Manager, or the machine that runs cdr agent deploy, to each target domain controller: TCP 445, and TCP 5985 (WinRM) or TCP 135 and the dynamic RPC ports (DCOM). |
|
| Sizing estimate | From the machine that runs cdr repository estimate to the domain controllers: TCP 5985 (WinRM), or TCP 135 and the dynamic RPC ports (DCOM). |
|
| Email notifications (optional) | From the Manager to your mail server: TCP 587 with STARTTLS (default), TCP 465 over TLS, or TCP 25, for recovery plan notifications and the recovery report. |
Accounts and credentials
Cygna Forest Recovery needs no domain service account. For details, see Accounts and Permissions and Recovery Requirements.
| Item | Details | Done |
|---|---|---|
| Remote installation account (optional) | A local administrator on each target domain controller, entered as DOMAIN\user or user@domain. It is used only for the run and never stored. Installing from the console also needs the System Admin role. |
|
| Sizing account | An administrator on the domain controllers, with the domain given by its DNS name, such as admin@corp.example.com. The estimate uses Kerberos only, so the machine's clock must be within five minutes of the domain's. |
|
| Forest root administrator | An account in both Enterprise Admins and Schema Admins of the forest root domain, for a forest recovery. | |
| Domain administrators | A Domain Admins account of each other domain in scope, for a domain or forest recovery. | |
| Built-in Administrator passwords | The password of each domain's built-in Administrator account (RID 500) as it was at the time of the backup, not the current one. The account is often not named Administrator. | |
| New DSRM password | A new Directory Services Restore Mode administrator password for domain and forest recovery. You choose it at recovery time, and the plan sets it on every domain controller it restores or rebuilds. It must meet the domain's password policy. | |
| Offline credential storage | An agreed offline location for the recovery credentials above. |
Certificates and secrets
For details, see Certificates and Trust.
| Item | Details | Done |
|---|---|---|
| Enrollment token | A long random secret that you choose and give to the Manager installer as ENROLLMENTTOKEN and to every agent installer. Treat it like a password, and keep commands that contain it out of scripts and away from command-line auditing. |
|
| CA fingerprint | Created when the Manager service first starts. Read it from the Windows Application event log on the Manager machine, and confirm it from a second source. A manual agent installation needs it as MANAGERCAFINGERPRINT. It is public, not secret. |
|
| Break-glass password and recovery passphrase | Both are set when you first sign in to the console. The recovery passphrase protects a copy of the Manager CA key, so that the Manager can be restored on another machine. | |
| Offline secret storage | An offline location for the break-glass account password, the recovery passphrase, the enrollment token, and the storage volume's BitLocker recovery key. |
Storage
For details, see Sizing Backup Storage.
| Item | Details | Done |
|---|---|---|
| Size estimate | Run cdr repository estimate from a domain-joined Windows machine, with your planned retention, and provision at least the Recommended size. |
|
| Storage root | A local folder, such as E:\CygnaDR, on an NTFS or ReFS volume that is available when the service starts. The storage agent creates the staging, vault, and manager-backups folders in it. |
|
| Staging share | An SMB share that you create over the staging folder. Never share the storage root, and don't use an administrative share such as E$. Recommended: success auditing for Logon, File Share, Detailed File Share, and File System on the storage machine, so that every staging share connection is seen and changes to backups name who made them. |
|
| Volume encryption | BitLocker on the storage volume, with auto-unlock, is recommended. | |
| Media and recovery image space | Folders for Windows Server installation media and recovery images. The estimate does not include them; allow a few gigabytes for each Windows Server version. | |
| Retention plan | How many versions to keep for each domain controller, and which domain controllers to back up. You don't have to back up every domain controller; a recovery can restore some and rebuild the rest. |
Recovery preparation
For details, see Recovery Requirements and Isolating Recovery Targets.
| Item | Details | Done |
|---|---|---|
| Installation media | Windows Server ISO files that match the build, edition, installation type, and architecture of your domain controllers. The storage agent builds recovery images from them, and full system recovery needs a recovery image. | |
| Backup type | Full system backups for any domain controller you may need to recover as a whole server. DC state backups support only DC state recovery. | |
| SYSVOL replication | SYSVOL replicated by DFSR in every domain: dfsrmig /getglobalstate on one of its domain controllers reports Eliminated. Domains that still use FRS must migrate to DFSR, following Microsoft's Migrate SYSVOL replication from FRS to DFS Replication, and take fresh backups before they can be restored. |
|
| Free space on domain controllers | For a DC state recovery, free space of about 1.15 times the backup's size on a fixed volume other than the system volume. | |
| Isolation network design | An isolated segment for restore targets, such as an isolated Hyper-V virtual switch with port ACLs, a VLAN with router ACLs, or dedicated switch ports. The only paths out are TCP 5211 to the Manager and TCP 445 to the storage machine, enforced outside the targets. | |
| Additional isolation paths | For a forest recovery, NTP (UDP 123) from the restored root PDC emulator to the external time sources you name, and Active Directory traffic among the restored domain controllers of different domains. | |
| BitLocker keys for domain controllers | If domain controller volumes are BitLocker-protected, their recovery keys available at recovery time. |
Operators
| Item | Details | Done |
|---|---|---|
| Operator accounts | Who needs a Cygna Forest Recovery operator account. | |
| Roles | Which role each person needs: Viewer / Auditor, Backup Operator, Restore Operator, or System Admin. Only the Restore Operator role can approve and execute a recovery, and the System Admin role has no backup or restore permissions. | |
| Break-glass custody | Who holds the break-glass account, which has every permission, and the recovery passphrase. |
Values to record
Record these values for the people who install the product.
| Record this | Value |
|---|---|
| Manager IP address | |
| Manager ports, if not 5210 and 5211 | |
| Storage machine IP address | |
| Storage root path | |
| Staging share name | |
| Windows Server versions and builds to collect media for |
