Preflight Check Reference

Before a restore or recovery plan can be approved, the Manager checks it against the backup, the target machine, and the directory. Each finding is a gate with a code, a title, the machine or object it is about, and what to do. This topic lists every gate by code.

Each gate is one of three kinds:

• Blocks approval—The Manager refuses approval while the gate stands. Fix the cause, or choose another restore point or target, and the gate clears.
• Needs your acceptance—The Manager refuses approval until the approver accepts the gate by its code, or the run is cancelled. These gates report something the Manager could not prove from where it looked, which the restore may still get past from where it runs: for example, a name the machine cannot resolve now that the recovery environment's network may resolve. A DC state recovery also raises two gates of this kind that are not about the environment but about what its authoritative rollback does across the domain. Accept them only if that is what you mean to do. The acceptance is recorded on the run and in the audit trail, and holds until that run is executed. In the console, select the gate's acceptance check box on the run's page before you approve. With cdr, pass --accept <GATE> to cdr restore approve. Only restore runs raise these gates. When a forest or domain plan starts a restore, the restore run raises them, and the plan waits until someone accepts them on that run or cancels it.
• Advisory—Read, not cleared. The restore is possible; the gate says what it costs or what to watch for.

Gates are evaluated when a restore is planned, and again when it is approved and executed. For a full system recovery, the Manager also asks the target machine to describe itself again at each of those points. A forest or domain plan has its own gates, listed at the end of this topic, and each restore it starts is checked again against the restore gates. For how preflight fits into a recovery, see Recovery Lifecycle.

Some checks run only at execution, and do not appear as gates: the backup's hash is checked against the vault before the read credential is issued, the version is confirmed present at the target with wbadmin get versions, the machine's boot configuration is proven settable before it is set for real, the recovery environment checks its own firmware and disks against the backup before it writes, and secure channel and replication health are checked after the restore.

Executing a restore run or a recovery plan also needs an active license. This is not a gate: you can plan and approve without one, but execution is refused with the code license-inactive, shown as No active license, until a current license key is applied. A recovery plan that is already executing is not stopped, and neither are the restores it starts. See Licensing.

Restore runs: all restore methods

Code	Kind	Meaning	What to do
rodc.restore	Blocks approval	The target is a read-only domain controller. Read-only DCs are never restored.	Rebuild the machine instead.
fsmo.seized-after-backup	Blocks approval	An operations master role this DC held at backup time has since been seized by another DC.	Rebuild the machine. A DC whose roles were seized must never be restored.
version.identifier-uncaptured	Blocks approval	The backup has no wbadmin version identifier, which is what a restore addresses.	Choose another restore point.
version.pruned	Blocks approval	Retention has already deleted this version from the vault.	Choose a version that is still in the vault.
version.no-manifest	Blocks approval	The version has no manifest, so there is nothing to check it against, and no evidence the agent was on the machine to finish the restore.	Choose a version taken by Cygna Forest Recovery.
version.beyond-tombstone	Blocks approval	The restore point is older than the domain's tombstone lifetime. Restoring it would bring back deleted objects as lingering objects.	Choose a newer version, or rebuild the machine.
version.age-unknown	Blocks approval	When the version was taken was not recorded, so the tombstone check cannot be made.	Choose a version whose time is known.
version.unknown	Blocks approval	The version the run addresses is no longer in the job history.	Plan the restore again against a version the Manager still knows.
sysvol.frs	Blocks approval	The backup records that SYSVOL replicates with FRS, which is not supported for recovery.	Migrate the domain to DFSR, then take fresh backups.
sysvol.unknown	Blocks approval	The SYSVOL replication engine was not recorded in the backup.	Take a fresh backup, so the manifest records it.
agent.not-connected	Blocks approval	No agent is connected for the machine. A DC state recovery is driven by the agent on the machine itself.	Install or reconnect the agent. If the operating system is gone, use full system recovery instead.
backup.in-flight	Blocks approval	A backup is running on the machine, and the restore would restart it mid-backup.	Let the backup finish, or cancel it, then approve the restore again.
machine-password.stale	Advisory	The machine account password has changed since the backup, so the restored DC's secure channel will fail until it is reset.	Nothing; the reset is part of the restore's validation.
colocated.manual-followup	Advisory	Other roles on the machine, such as AD CS or DHCP, are not recovered by Cygna Forest Recovery.	Plan for them separately. The recovery report lists them as manual follow-ups.
agent.ca-changed	Blocks approval when network settings for the restored system are planned, and always for a test restore; otherwise advisory	The agent in the backup trusts a different Manager CA, because the Manager was re-keyed after the backup.	Re-point the agent as soon as the machine is up; the run waits until it connects. With planned network settings, plan the restored network as unchanged and set it by hand, or restore a backup taken after the agent was re-pointed. See Re-Keying the Manager CA.
version.taken-during-recovery	Advisory	The backup was taken while a recovery of this domain controller's forest was under way. It holds the directory part-way through that recovery: operations master roles just seized, domain controllers removed and not yet rebuilt, and initial synchronization turned off. The gate names the plan and the last step it had completed.	Restore it only if that is the state you mean to return to. Otherwise choose a backup taken before the recovery began, or after it completed. Forest and domain plans raise this gate too.

Restore runs: DC state recovery

Code	Kind	Meaning	What to do
build.ubr-mismatch	Blocks approval	The machine has been patched since the backup. DC state cannot be put back across a Windows update revision change.	Take a fresh backup and restore that.
build.build-mismatch	Blocks approval	The machine runs a different Windows release from the backup.	Rebuild the machine instead.
build.no-target	Blocks approval	Nothing is running under the machine's name to compare the build against.	A DC state recovery needs the machine running. If the operating system is gone, use full system recovery.
build.manifest-uncollected	Blocks approval	The backup did not record the Windows build or revision.	Take a fresh backup, so the manifest records the build.
build.target-uncollected	Blocks approval	The machine has not reported its Windows build or revision.	Check that its agent is connected and current.
target.insufficient-space	Blocks approval	The machine does not have enough free space to stage the version locally. It needs about 1.15 times the backup's size.	Free space, or set the Restore staging volume to a volume that has it.
target.free-space-unknown	Advisory	The machine did not report its free space.	Nothing now. The agent checks again before it copies, and refuses if the copy will not fit.
authoritative.agent-too-old	Blocks approval	The domain controller's agent cannot mark the rollback authoritative: it is older than the Manager, or it is current but not running as its Windows service, which it must be to hold back the restart wbadmin starts.	Update the DC agent from the Agents screen, or check that its service is running, then approve.
authoritative.overwrites	Needs your acceptance	The rollback overwrites the named subtrees and objects on every domain controller: every change made to them since the backup is undone, including attributes, password resets, and group memberships. Objects created since the backup are left as they are.	Check the list. Accept it to roll them back, or cancel the run and plan again with different entries.
authoritative.krbtgt	Needs your acceptance	A named subtree holds krbtgt, so the domain's Kerberos keys and every user's password in it go back to the backup on every domain controller. Tickets issued since then stop working. The title says whether krbtgt is then reset twice.	Accept it to go ahead. Without the reset, reset krbtgt twice yourself afterwards, or plan again with the reset chosen.
authoritative.krbtgt-agent-too-old	Blocks approval	The rollback resets krbtgt, and the domain controller's agent cannot wait for the first reset to reach every writable domain controller before the second.	Update the DC agent from the Agents screen, then approve.
authoritative.group-policy	Advisory	The rollback reaches Group Policy objects. They roll back in the directory, but SYSVOL is restored non-authoritatively, so their files come back from the other domain controllers as they are now.	Once the rollback has replicated, restore the policies from a Group Policy backup, for example with Restore-GPO.

Restore runs: full system recovery image and backup

Code	Kind	Meaning	What to do
version.systemstate-only	Blocks approval	The version is a DC state backup, or its type was not recorded. Full system recovery restores every critical volume, which needs a full system backup.	Choose a full system version, or use DC state recovery if the operating system still starts.
image.none	Blocks approval	No recovery image is held for the backup's operating system.	Depends on the cause given; see the table below.
image.failed	Blocks approval	The only recovery image for this operating system failed a boot test.	Rebuild the image. A failed image is not staged.
image.untested	Advisory	The recovery image has never been proven by a restore. The gate clears once a full system recovery or a test restore with the image completes its restore, which marks the image proven.	Nothing. If the image does not start, the machine returns to its own Windows at the next start, because the recovery boot is one-shot, and the run reports the missed boot. Onto a new VM, the VM boots the image from the run's recovery ISO. If it does not boot, nothing enrolls and the run fails when its media expires. Nothing will have been written, and the VM can be deleted.
image.agent-cannot-apply-network	Blocks approval	The image was built with an older recovery agent that cannot apply the restore's planned network settings or post-recovery directives. The gate names the missing abilities.	Upgrade the storage agent and wait for it to rebuild its images, or plan the network as unchanged.
disks.layout-changed	Blocks approval	The machine's disks no longer match the backup's. An in-place recovery cannot repartition.	Choose a version taken since the change, or recover onto a candidate machine.
disks.layout-unknown	Advisory	Whether the disks still match the backup could not be checked.	If a disk was added, resized, or replaced since the backup, wbadmin will refuse after the machine restarts into the recovery image, without writing anything.
agent.restored-behind	Advisory	The DC agent the restored system will start is older than the DC agent package the Manager holds. A restored DC starts the agent build of the machine that stages the restore when the recovery image can put it in place, and the build in its backup otherwise. The Manager does not send recovery plan steps to an agent that is behind its package.	Update the agent on the machine that stages the restore first, with cdr agent deploy, while it is still reachable. If the gate says the recovery image cannot replace the restored DC's agent, update the storage agent so that it rebuilds its recovery images. Otherwise every plan step on the restored DC is refused until its agent is updated by hand. A standalone restore runs no plan steps and is not affected.
image.agent-cannot-boot-media	Blocks approval	The recovery image's agent cannot run from recovery media. A recovery onto a new VM, and a test restore, boot a per-run ISO whose job carries no vault credential; the recovery agent asks the Manager for it after enrolling.	Upgrade the storage agent and wait for its images to rebuild, or recover onto a candidate machine instead.

The remediation for image.none depends on why no image exists. Every variant notes that a DC state recovery needs no image if the operating system still starts.

Cause	What to do
No recovery image folder is set	Set Recovery image folder for the storage agent on the Configuration screen, and restart the storage agent. The OS Media screen shows the image as it is built.
No installation media to build from	Add a Windows Server ISO matching the backup's build to the OS media folder. The storage agent then builds the image.
Media is held, but the image is not built yet	Wait: the storage agent builds it on its next pass.
No storage agent has reported	Check that the storage agent is connected.

Restore runs: full system recovery target machine

These checks use the target machine's own description of itself, collected when the restore is planned, approved, and executed. Several have separate wording for a recovery in place and onto a candidate machine.

A recovery onto a new VM, and a test restore, have no machine to describe until the recovery ISO boots, so most of these checks are not made for them. The recovery agent checks the VM's firmware and disks against the backup before it writes. A recovery onto a new VM raises target.original-running and target.new-vm instead. A test restore raises neither, because the original keeps running. It raises the test restore gates listed below.

Forest and domain recovery plans also evaluate the firmware and disk checks for each domain controller restored onto a bound candidate machine. See Forest and domain recovery plans.

Code	Kind	Meaning	What to do
target.survey-missing	Blocks approval on a candidate; advisory in place	The machine has not described its hardware, or its description is too old.	Select Ask the machine again on the run's page. An agent older than the Manager does not answer; update it. In place, the disk check falls back to the machine's newest backup.
target.clock-skew	Advisory	The machine's clock differs from the Manager's by more than 5 minutes.	Correct the time, or on a virtual machine the host's time, before recovering. Kerberos refuses beyond five minutes.
target.firmware-mismatch	Blocks approval	The machine boots under different firmware (UEFI or BIOS) from the backup. The restored system would not start.	On a candidate, switch its firmware (on Hyper-V, generation 2 is UEFI and generation 1 is BIOS) or choose another candidate: a candidate is restored as it is. To check a backup without touching a machine, run a test restore on an Isolated Recovery Host instead, which builds a virtual machine of the backup's own generation. In place, choose a version taken since the change.
target.firmware-unknown	Advisory	Whether the firmware matches could not be checked.	If the backup recorded its firmware, the recovery environment checks it before writing. If not, nothing can check it; confirm by hand.
target.uefi-unproven	Advisory	A UEFI recovery onto a platform other than a Hyper-V generation 2 virtual machine running Windows Server 2019 or Windows Server 2022. The gate is not raised for those.	Nothing. If the image does not start, the machine returns to its own Windows at the next start, because the recovery boot is one-shot, and the run reports the missed boot. Nothing is written.
target.disks-unknown	Blocks approval on a candidate; advisory in place	Whether the machine's disks can hold the backup could not be checked, because disk sizes were not reported or the backup did not record them.	Ask the machine again, or take a fresh backup. Otherwise check by hand that each disk is at least as large as the backup's.
target.disks-too-small	Blocks approval	A disk the backup needs has no disk on the machine at least as large. wbadmin would refuse after the machine restarts.	Give a candidate larger disks, or choose another. In place, choose a version taken since the change.
target.disks-unverified	Advisory	Some of the backup's disks have no room on the machine and may be needed.	If any holds the directory database, its logs, or SYSVOL, wbadmin will refuse after the restart. A backup from a current agent records which disks are critical.
target.partition-style-changed	Blocks approval	The machine's boot disk has been converted between MBR and GPT since the backup.	Choose a version taken since the conversion.
target.memory-insufficient	Blocks approval	The machine has less memory than the recovery image needs to start from a RAM disk: the image's size plus 1 GB.	Give the machine more memory.
target.memory-unknown	Advisory	Whether the image fits in memory could not be checked.	Nothing now. The agent checks again before it arms the boot.
target.less-memory	Advisory	The candidate has less memory than the original.	The DC will run, possibly slowly. Add memory after recovery if it matters.
target.fewer-processors	Advisory	The candidate has fewer processors than the original.	Nothing.
target.staging-space	Blocks approval	Not enough free space to download and stage the recovery image on the system volume: about 1.1 times the image's size.	Free space on the system volume.
target.staging-space-unknown	Advisory	Free space for the image was not reported.	Nothing now. If the image does not fit, staging fails before anything is armed.
target.vault-unresolved	Needs your acceptance	The storage agent advertises its shares by name, and the machine cannot resolve that name. The recovery image is fetched and the vault is read through that name for the whole restore. If the image fetch cannot resolve it either, the restore refuses before anything is changed. If the recovery environment cannot, it refuses and restarts back into Windows, which costs a reboot cycle and, in place, keeps the domain controller down for its length.	Accept the gate only if you know the name will resolve to the storage machine from where the restore runs, for example through the recovery environment's own DNS server. Otherwise cancel the run. A name is also a redirection point: whatever answers for it receives the vault read credential and supplies what is restored onto the machine, so accept it only if that DNS is trustworthy. To remove the dependency, set Advertised host on the storage agent to the IP address the domain controllers reach it on, and restart the storage agent.
target.vault-unreachable	Blocks approval	The machine cannot connect over SMB to the storage machine, at the address the storage agent advertises its shares on. That is the address the recovery environment uses.	Open TCP 445 from the machine to the storage machine: firewalls, routing, and isolation rules.
target.vault-not-in-dns	Needs your acceptance	The storage agent advertises its shares by name, and that name resolves on the machine only through a hosts file, LLMNR, or NetBIOS. The recovery environment resolves names through DNS and nothing else. If its DNS cannot answer for the name, it starts, fails to find the vault, refuses, and restarts back into Windows.	Accept the gate only if you know the recovery environment's DNS will answer for the name with the storage machine's address. Otherwise cancel the run. Accept it only if that DNS is trustworthy, for the same reason as target.vault-unresolved. To remove the dependency, set Advertised host on the storage agent to its IP address, and restart the storage agent.
target.vault-by-name	Advisory	The storage agent advertises its shares by name, so the recovery depends on DNS. The name resolves through DNS from the machine now, but in a forest recovery the DNS that answers for it may be the directory being recovered.	Set Advertised host on the storage agent to the IP address the domain controllers reach it on, and restart the storage agent. A name is also a redirection point for the vault read credential.
target.vault-unchecked	Advisory	Whether the machine can reach the storage machine was not checked: no storage agent was connected, none has reported the share it advertises and no backup has been staged, or the machine ran out of time first.	Connect the storage agent, then ask the machine to describe itself again. The recovery image is fetched from the storage machine and the vault is read from it for the whole restore.
target.original-unchecked	Advisory	The candidate ran out of time before checking every address the original DC used.	Make sure the original is off or isolated, then ask the candidate again.
target.original-answering	Blocks approval	The original domain controller still answers on the network. Two machines with one identity damage a domain.	Power the original off or isolate it, then ask the candidate again.
target.original-address-in-use	Advisory	Another directory server answers at the original's address.	Resolve the address conflict before the restored DC starts.
target.storage-controller-changed	Advisory	The candidate has a different platform or boot storage controller from the original.	The restored Windows needs a driver for the new controller, or it stops at INACCESSIBLE_BOOT_DEVICE. Built-in drivers cover common virtual controllers; any other boot controller may need its driver installed on the original before the backup.
target.bitlocker	Advisory	Volumes in the backup were protected by BitLocker, whose TPM protector belongs to the original machine.	Have the recovery keys ready.
target.static-address-not-carried	Advisory	The original had static addresses, which are unlikely to follow it onto a candidate's different network adapter.	Plan the restored system's network as the backup's own static address, and its agent puts the address back at first start. When you do not choose a network for the restored system, the Manager plans this for you wherever the backup's agent can apply it and the address is unambiguous. Otherwise set the addresses by hand afterwards.
target.recovery-needs-dhcp	Advisory	Every adapter on the machine is statically addressed, and the recovery environment takes its address from DHCP unless the plan gives it one.	Give the recovery environment the machine's own address or another in the restore's network options, or make sure a DHCP scope serves the network.
target.original-running	Blocks approval	Recovery onto a new VM only: the original domain controller is still running; its agent is connected to the Manager. The new VM comes up as this machine, with the same name and the same SID. Two of them on one network damage the domain rather than recover it.	Power the original off, or disconnect it, then approve.
target.new-vm	Advisory	Recovery onto a new VM: the VM is checked by the recovery environment, not here. Nothing runs on the VM before the recovery ISO boots, so there is no description of it.	Build the VM with cdr dc rebuild --restore-run, which shapes it from this backup's manifest and attaches the ISO with the disk first in the boot order. Before wbadmin writes, the recovery agent checks the VM's firmware and disks against the backup and stops, with nothing written, if they do not fit. See Full System Recovery onto a New VM.

Restore runs: test restores

A test restore restores a version onto a new VM on an Isolated Recovery Host, isolates it, checks it, and deletes it. It raises these gates in addition to the image and backup gates above. Because the original keeps running, target.original-running is not raised. For what a test restore does, see Test Restores.

Code	Kind	Meaning	What to do
verification.host	Blocks approval	The Isolated Recovery Host cannot run this test restore. The gate names the host and what stops it. A test restore runs on a host that is connected, ready, and not running another one.	The Agents screen shows each host's state and what stops it. Wait for the other test restore to finish, or fix the host's readiness finding.
verification.vm-shape	Blocks approval	A VM cannot be shaped from this backup. The host builds the VM from the backup's manifest, as cdr dc rebuild does.	Test a backup whose manifest records the machine's firmware, disks, and processors.
verification.isolated	Advisory	Always shown: nothing in production changes. The restore is the real one, from this run's recovery ISO with the vault read under a lease. The VM is then powered off, moved to a private switch of its own, started there as the first DC of a recovered domain, checked, and deleted.	Nothing. The original keeps running throughout, and the restored copy never reaches its network.

Restore runs: recovery environment network

These gates appear when the restore plans an address for the recovery environment instead of DHCP.

Code	Kind	Meaning	What to do
network.recovery-planned	Advisory	The recovery environment takes the machine's own address, or a planned one, instead of DHCP.	Nothing. If the address cannot be applied, the run refuses before writing and the machine restarts into its own Windows. It never falls back to DHCP.
network.recovery-adapter-unverified	Advisory	Which adapter takes the address could not be checked.	Ask the machine to describe itself again, or name the adapter by its MAC address.
network.recovery-no-dns	Advisory	The planned address has no DNS server, and the storage agent advertises its shares by name, or whether it advertises a name or an address is not known. The recovery environment resolves names through DNS alone, so without a DNS server it cannot find the vault, and refuses. When the storage agent advertises an IP address, the recovery environment needs no DNS server and this gate does not appear.	Add the DNS servers for the network, or set Advertised host on the storage agent to its IP address. If the advertised address is not known, ask the machine to describe itself again.
network.recovery-original-unknown	Blocks approval	The machine has not described its adapters, so its own address is not known.	Ask the machine again, or plan the address as an override.
network.recovery-original-not-static	Blocks approval	No adapter on the machine has a static IPv4 address to carry over.	Plan the network as unchanged (DHCP), or plan an override address.
network.recovery-adapter-ambiguous	Blocks approval	The machine has several adapters and the plan does not say which one takes the address.	Name the adapter by its MAC address in the restore's network options.
network.recovery-adapter-missing	Blocks approval	The adapter the plan names is not on the machine.	Name one of the adapters the machine described, or ask it again if one was just added.
network.recovery-unresolved	Blocks approval	The recovery environment's address cannot be worked out.	Change the restore's network options.

Restore runs: restored system network

These gates appear when the restore plans the restored system's address at its first start.

Code	Kind	Meaning	What to do
network.restored-planned	Advisory	The restored system takes its backed-up address, or a planned one, at its first start.	Nothing. The restored DC's agent applies it before contacting the Manager and, if the address changes, re-registers the DC in DNS. A failure is written to POST-RECOVERY-README.txt on the machine.
network.restored-agent-unknown	Blocks approval	The backup's manifest could not be read, so whether its agent can apply network settings is not known.	Restore a backup whose manifest the Manager holds, or plan the restored network as unchanged.
network.restored-adapter-unverified	Advisory	Which adapter takes the address could not be checked. Not raised for a recovery onto a new VM, which has a single adapter.	Ask the machine to describe itself again.
network.restored-no-dns	Advisory	The planned address has no DNS server. A DC with none cannot find its partners or register itself.	Point it at itself, or at another DC on the recovery network.
network.restored-new-subnet	Advisory	The restored DC moves to a different subnet.	Afterwards, add a subnet for the new range mapped to the DC's site, remove old A records, update delegation and reverse zones, and update anything that reaches the DC by its old address, such as DNS forwarders, firewall rules, and DHCP authorization.
network.restored-original-unknown	Blocks approval	The backup did not record the address to put back.	Plan the restored network as an override, with the address it should have.
network.restored-original-not-static	Blocks approval	The backed-up DC took its address from DHCP.	Plan the network as unchanged, or plan an override address.
network.restored-original-ambiguous	Blocks approval	The backed-up DC had several statically addressed adapters, and only one is carried.	Plan the adapter that matters as an override, and set the others by hand afterwards.
network.restored-adapter-ambiguous	Blocks approval	The target has several adapters and the plan does not say which takes the address.	Name the adapter by its MAC address.
network.restored-adapter-missing	Blocks approval	The adapter the plan names is not on the target.	Name one of the adapters the machine described.
network.restored-unresolved	Blocks approval	The restored system's address cannot be worked out.	Change the restore's network options.

Forest and domain recovery plans

These gates are evaluated when a forest or domain recovery plan is built, and decide whether it can be approved.

For each domain controller the plan restores by full system recovery onto a bound candidate machine, the plan also compares the candidate's newest description of itself with the chosen backup, using the target machine checks above: target.survey-missing, target.firmware-mismatch, target.firmware-unknown, target.uefi-unproven, target.disks-unknown, target.disks-too-small, target.disks-unverified, target.partition-style-changed, target.storage-controller-changed, and target.bitlocker. They have the same kinds as on a restore run onto a candidate, except that target.survey-missing is advisory in a plan: the restore asks the machine again when its step runs, and refuses then. These checks are made again from the machines as they are when the plan is approved, and approval is refused while any that blocks stands. Domain controllers restored in place are not checked at plan level; their restore run checks them. Memory, staging space, vault reachability, and whether the original is still running are checked by the restore run, not the plan.

Code	Kind	Meaning	What to do
scope.no-root	Blocks approval	Forest plans: no domain in the plan is known to be the forest root.	Refresh the topology, so the root is known.
input.ntp	Blocks approval	Forest plans: no external time source is given for the forest root's PDC emulator.	Give at least one time server reachable from the isolated recovery network.
input.gc-designation	Blocks approval	Forest plans: the DC chosen to have the global catalog added back is not a restored forest-root DC.	Choose a restored DC in the root domain.
domain.no-restore	Blocks approval	No domain controller in a domain is marked to be restored.	Mark one writable DC with a usable version as the restore.
domain.multiple-restores	Blocks approval	More than one DC in a domain is being restored from backup. A recovery restores exactly one DC per domain.	Restore one DC and rebuild the rest. Each rebuilt DC is promoted fresh from the restored one and brings the whole directory with it, so users, groups, memberships, and permissions lose nothing. What a rebuild does not bring back is what was on the machine itself: its roles are reinstalled from its last backup's record, but their configuration and its installed programs are not. The plan names both for each DC.
restore.rodc	Blocks approval	A read-only DC is marked to be restored.	Mark it rebuild or exclude.
restore.no-version	Blocks approval	No restore point is chosen for a DC being restored.	Choose one. After ransomware, choose one from before the compromise.
restore.no-target	Blocks approval	A DC being restored has no agent, and no candidate machine is bound to receive it.	Bind a candidate machine with an enrolled agent to the DC.
target.not-candidate	Blocks approval	The machine bound to a DC is not a candidate machine.	Bind a machine with an enrolled DC agent that is not itself a domain controller. cdr recovery candidates lists them.
target.shared	Blocks approval	One machine is bound to more than one DC.	Each restored or rebuilt DC needs a machine of its own. Bind a different candidate to each.
restore.mode-a-elsewhere	Blocks approval	A DC state recovery is planned onto another machine. DC state recovery only works in place.	Use full system recovery for a candidate machine.
rebuild.no-dns-server	Blocks approval	No address is known for the restored DC that a rebuilt DC takes its DNS from. Before promoting a rebuilt machine, the plan points its DNS at the restored DC, using the static IPv4 address recorded in the restored DC's chosen backup, or the address the directory reported. The backup recorded none (the DC used DHCP), and the directory reported none.	Give the restored DC an isolated address, or choose a backup taken while it had a static address.
rebuild.no-target	Advisory	No machine is bound to be promoted as a DC being rebuilt.	The plan waits for an agent to connect under the DC's name: reinstall the machine clean under that name and enroll the agent, or bind another machine before approval.
version.spread	Advisory	The chosen restore points are more than 6 hours apart, which is a source of lingering objects.	Align them where the available versions allow.
network.duplicate-address	Blocks approval	Two DCs are planned onto the same isolated address.	Give each restored DC its own address.
input.rid-increase	Blocks approval	The RID pool increase is not positive.	Enter a positive number. The default is 100,000.
trust.external-manual	Advisory	The other side of an external trust must be reset by hand. A domain recovery always resets the domain's trusts. A forest recovery resets trusts only when it is planned as a security breach, so a forest plan shows this gate only then.	When the trust is reset, the partner's administrator resets their side with the password the console shows when the step runs.
trust.external-unreset	Advisory	Forest plans without the breach flag: an external trust is not reset, so this forest keeps the trust password its backup holds. Windows changes that password every 30 days and keeps only the current and the previous one, so if the partner forest has changed it twice since the backup, the trust does not authenticate.	After the recovery, reset both sides of the trust by hand, or plan the recovery as a security breach.
scope.domain-unknown	Blocks approval	Domain plans: the domain is not in the forest's topology.	Refresh the topology, or choose a domain it knows.
scope.single-domain-forest	Blocks approval	Domain plans: the forest has only one domain.	Plan a forest recovery instead.
scope.forest-root	Blocks approval	Domain plans: the forest root domain cannot be recovered on its own, because it holds the forest-wide roles.	Plan a forest recovery instead.
input.gc-strategy	Blocks approval	Domain plans: the global catalog strategy is not recognized.	Choose lingering-object removal (the default) or rehosting.
gc.no-agent	Blocks approval	Domain plans: a global catalog outside the domain has no agent, and the plan reconciles every global catalog through its agent.	Install the DC agent on it, or remove its global catalog role, before approving.
gc.none-outside	Advisory	Domain plans: no global catalog outside the domain is known.	If the topology may be stale, refresh it before approving.
trust.partner-manual	Advisory	Domain plans: the live side of a trust reset has no agent to run it.	An administrator of the partner domain resets it with the password the console shows.
dns.no-root-server	Advisory	Domain plans: no live forest-root DC is known to act as the restored DC's DNS server.	Set the restored DC's DNS server by hand at the DNS repair step.
scope.outside-effects	Advisory	Domain plans: always shown. The plan changes machines outside the domain: global catalogs in other domains, and trusts.	Read the list of affected machines before approving.
trust.restore-points-apart	Advisory	Forest plans not planned as a security breach: the two sides of a trust inside the forest are restored from points 30 or more days apart. Without the breach flag no trust is reset, and each side keeps the trust password its own backup holds. Windows changes it every 30 days and each side keeps only the current and the previous one, so the two may no longer match and the trust would not authenticate.	Choose closer restore points, or plan the recovery as a security breach, which resets every trust.