Recovery Manager for Active Directory Disaster Recovery Edition
Automate and accelerate Active Directory recovery. Ransomware is today's most disruptive cyber threat, and Active Directory is increasingly in its crosshairs. Quest® Recovery Manager for Active Directory Disaster Recovery Edition slashes AD forest recovery time from days or weeks to just hours, giving you peace of mind that an AD disaster will not become a business disaster.
$19.7M saved in ransomware recovery losses
Lessons Learned from a Recent Ransomware Recovery
Be Prepared for Ransomware Attacks with AD Disaster Recovery Planning
Active Directory is a prime attack target
69%
of organizations impacted by ransomware
21days
Average downtime due to ransomware
25B
attempted attacks on Azure AD accounts
Fast and secure Active Directory forest recovery is vital following a cyberattack. The longer AD is down, the longer your business is down. “The restore process from many well-documented ransomware attacks has been hindered by not having an intact AD restore process," according to Gartner, which also states that you can “accelerate recovery from attacks by adding a dedicated tool for backup and recovery of Microsoft Active Directory.”
With Recovery Manager for Active Directory Disaster Recovery Edition, you can restore AD at least five times faster than the manual Active Directory forest recovery process, according to ESG Research. One reason for that is due to extensive automation, which reduces the risk of human error and having to start over as the result of those errors. Recovery Manager also protects your AD backups from compromise and eliminates the risk of malware reinfection. It’s like an insurance policy for AD that you can’t afford not to have.
Accelerates Recovery from Cyberattacks
This comprehensive backup software solution is ideal for helping you rapidly recover from cyberattacks that impact AD. It offers a range of recovery options, including system state restore and full server backup capabilities, providing flexibility in addressing various disaster scenarios. Recovery Manager goes beyond traditional system state backup by offering granular recovery of identity directory services, allowing you to restore specific AD components without resorting to a full domain or forest recovery.
In the case of a cyberattack, Recovery Manager proves invaluable for recovering compromised user accounts and service accounts. The solution can recover impacted accounts from pre-attack backups, even allowing for the reset of privileged account passwords to mitigate potential security breaches. This granular approach to recovery extends to deleted objects as well, enabling the restoration of specific AD objects without necessitating a complete forest or domain restore.
Recovery Manager’s versatility is evident in its multiple recovery methods, including phased recovery and the ability to restore AD to a clean operating system. This flexibility is crucial when dealing with complex ransomware scenarios that may have affected multiple domain controllers across different geographical locations. The solution's Secure Storage server feature provides air-gapped storage for AD backups, ensuring that backups remain uncorrupted and inaccessible to ransomware. Additionally, Recovery Manager can scan servers for malware before they are used in recovery and offers the option to restore AD to a Microsoft Azure virtual machine, further enhancing security during the recovery process. These advanced features, combined with its ability to perform various types of restores — from bare metal recovery to reinstalling AD on existing hardware — make Recovery Manager a powerful tool in your organization’s ransomware defense strategy.
Key Benefits
Adaptable to any disaster
Automated AD forest recovery
Flexibility and choice
Clean, malware-free recovery
Secure AD backups
Battle-tested
Streamlined Active Directory Disaster Recovery
Efficient and reliable AD backups
Secure storage
AD backups in the cloud
Phased recovery to shorten RTO
Flexible AD recovery options
Clean OS recovery to the cloud
Malware detection and removal
Operating system recovery
Additional Features
Online granular restore
Comparison reporting
AD management and health validation
Recovery console fault tolerance
Recovery roadmap
Hybrid AD and Azure Active Directory recovery
AD Disaster and Forest Recovery Services
Quest Professional Services ensure your Active Directory recovery plan is in place quickly and validates your forest recovery model. Whether your team lacks the technical expertise, does not have the manpower or just does not have time to configure, test and deploy your solution, our subject matter experts help you through this process using our tested implementation methodology.
- Verify backup and recovery plans aligned with industry best practices
- Test and document recovery plans for domain controllers, full forest and crisis scenarios
- Participate in a scheduled recovery exercise, ensuring full integration with other disaster recovery and business continuity plans
FAQs – Active Directory Disaster Recovery
Active Directory Recovery is the process of restoring Active Directory (AD) services and data after a catastrophic failure or cyberattack, such as ransomware. It involves rebuilding domain controllers, restoring AD databases, and reestablishing forest-wide services to bring the AD environment back to a functioning state. Active Directory recovery is critical because AD is the backbone of most organizations' IT infrastructure and identity services, controlling user authentication, access to resources, and application functionality.
Effective AD recovery requires careful planning, secure backups, and a rapid recovery solution like Recovery Manager to automate and accelerate the process. Manual recovery can be extremely time-consuming and error-prone, often taking days or weeks to complete. Purpose-built solutions like Recovery Manager for Active Directory Disaster Recovery Edition can significantly reduce recovery time to hours, minimize the risk of malware reinfection, and provide flexible recovery options such as phased recovery or restoring to a clean operating system. Given the increasing threat of ransomware and other cyberattacks targeting AD, having a robust and tested AD recovery plan is essential for maintaining business continuity.
Active Directory recovery encompasses several types of operations, ranging from granular object restoration to full forest recovery. For minor issues, online granular restore allows you to recover individual attributes or objects without restarting domain controllers. This is useful for correcting accidental changes or deletions. For more severe scenarios, there are multiple options for full recovery: Bare metal recovery (BMR) allows you to recover all volumes of a domain controller to new or different hardware; restore to clean OS enables you to restore AD onto a new Windows Server while reducing the risk of reinfection; and phased recovery lets you prioritize the restoration of critical domain controllers to get essential services running quickly.
Other recovery types include installing Active Directory on new servers to replace compromised DCs, uninstalling and reinstalling AD on existing servers, and repromotion of remaining DCs in a partially recovered forest. The choice of recovery method depends on the extent of the damage, the risk of malware persistence, and the organization's specific needs. Solutions like Recovery Manager for Active Directory Disaster Recovery Edition provide flexibility in choosing the most appropriate recovery method for a given situation, whether it's restoring to on-premises hardware, virtual machines, or even cloud-hosted VMs in Microsoft Azure.
Bare metal recovery (BMR) is a crucial capability of your Active Directory recovery arsenal because it allows you to recover not just the Active Directory data, but also the entire domain controller's operating system in the event of a catastrophic failure. This is especially important in rare scenarios where more than just Active Directory needs to be recovered. With BMR, you can restore a domain controller to its previous state on entirely new hardware, ensuring that all configurations, settings, and data are preserved.
Furthermore, BMR provides a more comprehensive and efficient recovery solution compared to traditional enterprise and Windows methods. It eliminates the need to manually reinstall the operating system and reconfigure the domain controller, which can be time-consuming and error-prone. By restoring both the operating system and Active Directory simultaneously, BMR significantly reduces downtime and ensures that your Active Directory infrastructure can be brought back online quickly and accurately, even in the most severe disaster scenarios. Quest allows you to restore AD to a clean OS on any machine, including physical machines, on-premises virtual machines or cloud-hosted virtual machines.
Tour
Flexible recovery methods
Specifications
Before installing Recovery Manager for Active Directory, ensure that your system meets the following minimum hardware and software requirements.
NOTE
- Recovery Manager for Active Directory supports only IPv4 or mixed IPv4/IPv6 networks.
- Processor
Minimum: 2.0 GHz
Recommended: 2.0 GHz or faster
CPU Cores
Minimum: 2 CPU cores
Recommended: 4 CPU cores
Memory
Minimum: 4 GB
Recommended: 8 GB
These figures apply only if the Active Directory domains managed by Recovery Manager for Active Directory include 1 million objects or less. Increase RAM size by 512 MB for every additional 1 million objects.
- Hard Disk Space
Full installation including the prerequisite software: 2.7 GB of free disk space
In case all the prerequisite software is already installed: 260 MB of free disk space
NOTE Additional storage space is required for a backup repository, at least the size of the backed-up Active Directory database file (Ntds.dit) and the SYSVOL folder plus 40MB for the transaction log files.
- Operating System
- Machine that hosts the Recovery Manager for Active Directory console must have same or higher version of Windows operating system than the processed domain controllers. Otherwise, the online compare and object search in a backup during the online restore operation may fail.
- 32-bit operating systems are not supported.
Installation
- Microsoft Windows Server® 2025, 2022, 2019, and 2016
Targets for backup, restore, or compare operations
- Microsoft Windows Server® 2025, 2022, 2019, and 2016 (including Server Core installation)
- Microsoft .NET Framework
Microsoft .NET Framework version 4.8 or higher is needed on the console system.
- Microsoft SQL Server and its components
Microsoft SQL Server versions
Microsoft SQL Server® is required for the following Recovery Manager for Active Directory features: Comparison Reporting and Forest Recovery Persistence.
Supported SQL Server versions:
- Microsoft SQL Server® 2022, 2019, 2017, 2016, and 2014 (Enterprise, Business Intelligence, Standard, Express, Web, or Developer Edition)
- Microsoft Windows PowerShell
Microsoft Windows PowerShell version 5.0 or later
- Integration with Change Auditor for Active Directory
Supported versions of Change Auditor for Active Directory: from 6.x to 7.x.
If any prerequisite software is not installed, the Setup program automatically installs it for you before installing Recovery Manager for Active Directory. If the prerequisite software to be installed is not included in this release package, it is automatically downloaded.
Continuous recovery: From version 10.0.1, Recovery Manager for Active Directory together with Change Auditor can restore the deleted object(s) and continuously restores the last change (if any) that was made to the object attributes after creating the backup, using the data from the Сhange Auditor database.
- Antivirus software that is supported for backup antimalware checks
The anti-virus checks are performed on the Forest Recovery Console machine running Windows Server 2016 or higher by means of antivirus software installed on the machine.
- Microsoft Defender
- Symantec Endpoint Protection 14.x
- Broadcom Endpoint Security (former name: Symantec Endpoint Protection 15)
- Supported server management systems
- Integrated Dell Remote Access Controller (iDRAC) 8 and 9
- HP ProLiant iLO Management Engine (iLO) 3, 4 and 5
- VMware vCenter/ESX Server 6.0, 6.5, 6.7, 7.0 and 8.0
- Microsoft Hyper-V Server 2016 or higher
NOTE: Microsoft .NET 4.8 is not required to be installed on the systems where the Forest Recovery and Backup agents are to be installed. The Secure Storage Agent does use .NET and it is recommended to install 4.8 on the Secure Storage system, but the agent will work with older versions.
Microsoft SQL Server components
Microsoft System CLR Types for SQL Server® 2014
If this component is not installed, it will be installed automatically by the RMAD setup.
Microsoft SQL Server Reporting Services
To display reports, Recovery Manager for Active Directory can integrate with Microsoft SQL Server® Reporting Services (SRSS) 2016, 2017, 2019, and 2022.
- Memory
1 GB (2 GB recommended)
- Hard disk space
2 GB or more
- Operating System
One of the following operating systems:
- Microsoft Windows Server® 2025, 2022, 2019, and 2016 (including Server Core installation)
Secure Storage Server
- Processor
Minimum: 2.0 GHz
Recommended: 2.0 GHz or faster
CPU Cores
Minimum: 2 CPU cores
Recommended: 4 CPU cores
Memory
Minimum: 4 GB
Recommended: 8 GB
- Operating system: Microsoft Windows 2016 or higher (including Server Core installation)
- A stand-alone server to be used as your Secure Storage server. This server should be a workgroup server and not joined to an Active Directory domain.
- An account that will be used to deploy the Storage Agent on the Secure Storage server. This account must also be a local Administrator on the Secure Storage server.
- Physical access to the Secure Storage server. Once the server is hardened access with regular methods will be disabled.
- Sufficient storage space on the Secure Storage server for all backup files. For one backup file, the space required is at least the size of the backed-up Active Directory database file (Ntds.dit) and the SYSVOL folder plus 40MB for the transaction log files.
- Cloud Storage
- Internet access available on the Recovery Manager for Active Directory console. A standard outbound HTTPS port 443 is used to upload data to Azure Blob and Amazon Web Services S3 Storage.
- Azure and Amazon Web Services subscription(s) to create and manage Azure and Amazon Web Services S3 Storage accounts and containers.
- A method of creating and managing Azure and Amazon S3 Storage accounts, containers, and policies for the storage account (lifecycle, immutability and replication policies).
You can only use the Password and SIDHistory Recoverability Tool if Microsoft's Active Directory Recycle Bin is not enabled in your environment.
Recovery Manager for Active Directory Disaster Recovery Edition is upgradeable from version 10.0 or later.