After the cleanroom recovery operation is complete, and you have validated the recovered resources and configurations, you can migrate the recovered resources from your cleanroom site to your production site.
Step 1: Disable automatic cleanup of resources
-
In the Command Center navigation pane, go to Security services > Cleanroom.
-
On the Recovery groups tab, click the recovery group.
-
On the Runbooks tab, click the runbook.
-
On the Configuration tab, in the Cleanup options section, disable the Clean up entities after recovery toggle key.
Step 2: Move resources to a new account, subscription, or resource group
You can move your recovered Amazon EC2 instances as follows:
You can move recovered Azure resources to a different resource group or subscription.
Step 3: Verify that your production site is clean
Before recovering workloads from the cleanroom site into your production environment, verify that the production environment is free of ransomware.
To ensure the environment is free of ransomware, best practice is to rebuild the environment from scratch. But you can also use your security tools to thoroughly remove all malicious artifacts. Choose the approach that matches the scope and nature of the attack, but ensure the production site is demonstrably clean to avoid reinfection when restored production applications are brought online.
Step 4: Download the latest backup of your Commvault control plane and then create a new one
Not required for Commvault SaaS.
-
Log on to the cloud.commvault.com.
-
From the navigation pane, click Manage > CommCells.
-
Click your CommCell.
-
In the Support & Services area, click the DR backup timestamp.
-
Click the SET folder you want to download the files for.
The SET page appears with the list of DR backup files of various CommCell entities.
-
Download the backup file.
-
Create the new production control plane. For instructions, see .
Step 6: Configure backups for each recovered resource, and then run a manual backup
For each recovered resource, configure backups, and then run a manual backup.
Step 7: Delete any access nodes and MediaAgents deployed in the recovered control plane
Not required for Commvault SaaS.
If any access nodes or MediaAgents are manually deployed in your recovered control plane, you must manually delete them. (Auto-scaled access nodes are automatically deleted.)