# Specify the recovery option for domain controllers for Active Directory forest recovery

For each domain controller you include in a runbook, specify how you want to recover the DC.

1. From the Command Center navigation pane, go to Protect > Active Directory.

   The Overview page appears.

2. On the Forests tab, click the forest.

   The forest page appears.

3. On the Runbook tab, under Runbook templates, click the runbook.

4. Beside the name of the domain controller, click the action button , and then select Configure recovery option.

   The Configure recovery option dialog box appears.

5. For Recovery option, select a recovery option:

   To recover a previous copy of the AD database, at least one domain controller in each AD domain must be recovered using a restore-from-backup recovery method. If you want more of the AD infrastructure to be available sooner, you can recover multiple domain controllers from backup.

   Recovery methods are grouped by the Active Directory forest recovery type selected when the runbook is executed. Recovery methods configured in the runbook must be compatible with the recovery type selected during recovery.

   - Out-of-place recovery methods:

   Recovery option | Description | When to use
   --- | --- | ---
   Recover AD to clean VM (database only) | Provision a new VM using a clean image provided by Commvault or one that you supply. Once the VM is provisioned and promoted to a domain controller, only the AD database is restored—eliminating the risk of recovering malware-infected files. | When you want to provision a new VM with a clean image and only restore the AD database.
   Recover to new VM (full System State) | Use VirtualizeMe technology with a full System State backup of the source domain controller to create a new VM that replicates the original DC as it was at the time of backup. Note This option is supported only for Azure, Hyper-V, or VMWare vCenter. | When you want to replicate the original DC as it was at the time of backup on a new VM.
   Provision and promote new domain controller | Automatically provision new servers from a clean image provided by Commvault or one that you provide, and promote them as domain controllers. With at least one domain controller in each AD domain restored from backup, you can complete the AD infrastructure by promoting additional domain controllers. The promoted domain controller will be writable, regardless of whether the source DC was writable or read-only. | After at least one domain controller in each AD domain has been restored from backup, to complete the AD infrastructure by promoting additional domain controllers from new servers.
   Promote server to domain controller | Promote additional domain controllers from standard Windows Servers. Requires a Windows Server that does not have the Active Directory Domain Services (AD DS) role or DNS role installed. The Active Directory Agent must be manually installed on the server so it is registered in Commvault. The promoted domain controller will be writable, regardless of whether the source DC was writable or read-only. | After at least one domain controller in each AD domain has been restored from backup, to complete the AD infrastructure by promoting additional domain controllers from existing Windows Servers.

   - In-place recovery methods:

     Important

     In-place recovery methods restore Active Directory on existing domain controllers in the production environment. Unrecovered domain controllers may reintroduce unwanted changes or corruption. To prevent this, configure a recovery or rebuild option for all affected domain controllers or isolate unrecovered domain controllers until recovery is complete.

   Recovery option | Description | When to use
   --- | --- | ---
   Recover AD in-place (same server) | Restore Active Directory on the original domain controller by recovering the Active Directory database and SYSVOL data from backup. This option does not provision a new server and instead performs the recovery on the existing domain controller. | When the domain controller operating system remains available and trusted, but Active Directory must be restored to a previous state due to schema corruption, database corruption, or unwanted directory changes.
   Demote and repromote domain controller | Demote the existing domain controller and then promote it back into the recovered domain. During promotion, the domain controller obtains a fresh copy of Active Directory through replication from a recovered partner domain controller. | To rebuild domain controllers that do not require restoration from backup but must be reintroduced into the recovered forest.
   Demote and remove domain controller from AD | Demote the domain controller and permanently remove it from the recovered Active Directory forest. | For domain controllers that should not be retained in the recovered environment, such as decommissioned servers or domain controllers that will be replaced by other recovery methods.

6. Click Submit.

×

Loading...