Recover an Active Directory forest

To recover an AD forest, you use a runbook. You can use a runbook as many times as needed. Each time you use a runbook, a new instance of the runbook appears on the Monitoring tab of the forest.

Start the Active Directory forest recovery wizard

1. From the Command Center navigation pane, go to Protect > Active Directory.

   The Overview page appears.

2. On the Forests tab, click the forest to recover.

   The forest page appears.

3. On the Runbooks tab, click the runbook.

   The runbook page appears.

4. In the upper-right area of the page, click Restore.

Recovery type page

1. Select the type of recovery to perform:

   Recovery type	Description	Use this option when	Supported recovery methods
   Recover AD forest to new domain controllers	Create new domain controller virtual machines from backup.	The original domain controller operating systems are unavailable. The original domain controller operating systems are compromised. Recovering from ransomware or a disaster. Recovering to an isolated recovery environment.	Recover AD to clean VM (database only) Recover to new VM (full System State) Provision and promote new domain controller Promote server to domain controller
   Recover AD forest in-place	Restore Active Directory on the original domain controllers.	The domain controller operating systems remain available and trusted. Recovering from schema corruption. Recovering from database corruption. Recovering from unwanted directory changes.	Recover AD in-place (same server) Demote and repromote domain controller Demote and remove domain controller from AD

   Caution

   • Recovery methods configured in the runbook must be compatible with the selected recovery type. If incompatible recovery methods are selected, the recovery cannot continue until the recovery type or domain controller recovery options are updated.

   • When recovering a forest to new domain controllers, ensure the network configuration you provide prevents the recovered domain controllers from communicating with the original DCs.

2. Click Next.

   A confirmation dialog box appears.

3. Enter the text to confirm the recovery.

4. Click Start.

Domain and domain controllers page

1. Select the domain controllers to include in the recovery.

   Important

   • When using the Recover AD forest in-place recovery type, domain controllers that are not included in the recovery continue to exist in the production environment. To prevent unrecovered domain controllers from reintroducing unwanted changes or corruption into the recovered environment, configure a recovery or rebuild option for all affected domain controllers or isolate unrecovered domain controllers from the recovered domain controllers until recovery is complete.

   • If you don't select at least one DC for a domain, then that domain is removed from the recovered forest and all its metadata is cleaned up. You must configure at least one DC from each domain to recover AD from backup using either the Recover AD to clean VM (database only) or the Recover to new VM (full System State) option.

2. Click Next.

Recovery points page

1. Select the recovery points (the backups to recover data from).

   You can select the same recovery point for all DCs, or you can select different recovery points.

2. Click Next.

Domain credentials page

If the runbook does not have credentials configured for some of the domains in the runbook, you must enter them on the Domain Credentials page. If the runbook has credentials configured for some of the domains, verify that the credentials are still valid.

Domain credentials are for user accounts that have administrative access to your AD domains. The domain credentials are used to perform runbook configuration steps, such as “Seize FSMO roles” and “Raise RID pool”, that require access to Active Directory.

For each domain, specify a separate credential — a privileged AD user account local to that domain (preferably a member of the Domain Admins group) — because cross-domain authentication is disrupted during a forest recovery.

1. Select the domains to specify the same credentials for.

2. Click Configure domain credential.

   The Active Directory credential dialog box appears.

3. For Credential, select the credential.

4. Click Submit.

5. On the Domain Credentials page, click Next.

Restore options page

1. Review and make any necessary changes to the restore options for the domain controllers in the runbook. For more information, see the following:

   • Modifying settings for the "Recover AD to clean VM database only" option for Active Directory forest recovery

   • Modifying settings for the "Recover to new VM full System State" option for Active Directory forest recovery

   • Modifying settings for the "Promote server to domain controller" option for Active Directory forest recovery

2. Click Next.

Recovery node page

1. For Recovery node, select the server you want to orchestrate the tasks in the runbook, including requesting the domain controller recovery jobs and making configuration changes to Active Directory.

2. Click Next.

Runbook steps page

1. Perform a final review of the steps in your runbook. You can skip steps as needed.

2. Click Start.

   A confirmation dialog box appears.

3. Enter the text to confirm you want to start the forest recovery process.

Summary page

1. Review the Summary page, which includes links to view the jobs or the runbook.