How Often Should You Test Your Active Directory Disaster Recovery Plan?

Welcome. This is Quest Unscripted. A vlog series on trending topics --and Quest solutions related to Active Directory, Office 365 --oh, and don't forget, Azure AD. You're here because you have questions. We're here because we have answers. I think. We will address questions we've received from customers --who experience the same challenges as you. All with the goal of helping you confidently move, manage, and secure --your Microsoft environment. We call the show Quest Unscripted because --except for this intro, nothing we say scripted or rehearsed. And we're pretty sure you'll notice that right away. Hey, Ghazwan. I know you work with some pretty large customers. Can you tell me the average size of your customers as well as how often you're seeing them do disaster recovery testing? Average size? I don't know what average size would be. We work with customers ranging between 20,000 to 300,000 employees, so average that. How often do they do disaster recovery testing? I would say they shoot to do one per year. Just the number of resources that get involved and the tasks that get assigned to these guys sometimes may slow it down a little, but I would say they usually shoot for about once a year. And that leads me to a question for Mr. Hymer. Brian, we were talking about PCI, and there has to be annual testing for PCI testing. But we're having a discussion-- how often do you feel customers should be doing DR testing? Well, that's a great question, Bryan. I think that if you're new to disaster recovery testing, especially Active Directory disaster recovery testing, then maybe you don't need to have more frequent tests. But you need to put the effort in at least on your first test to build the process out. And the customers I've worked with-- they're global. Most of them are global customers, and they're doing testing at least twice a year-- I'd say most of them. Or they just aren't doing testing at all, which is really wrong. So with that said, if they're not doing testing, do you have any guidance as far as what they should do to get ready to test and what they should be testing? Oh, yeah. Well, I mean, read through Microsoft's white paper if you're not using a product like ours. I mean, there's a number of other things that you can do. But yeah, you really need to focus down on preparation, communication, and then execution. And I'll give you an example. There's an energy company I work with. They do testing every six months or so, and it takes them about 2 and 1/2 weeks to get ready to test, right? And then they do their testing for a week, and then they've got to tear everything down afterwards. So it's roughly 3 and 1/2 weeks to a month of work for them to do. So Joe, I know you're with our professional service organization. Can you talk about our organization? What value we bring to help the organizations do these testing on their regular intervals. Yes, so have an offering that we send one of our consultants out to work with our customers and review the disaster recovery plan, and the configuration of our tool, as well as to review how it integrates with the overall business continuity disaster recovery exercise. And then, we'll sit with the customer to make sure that that goes smoothly, and that if there's anything that needs to be updated during that exercise, we're there to capture that with them and help them integrate that into their plans going forward. It's really important that you do the exercise to make sure that you know where to recover from, and you're able to hit all of those milestones along the way. As Brian said, a lot of the things that we see are communication related in there as well as just familiarity with, how do I bring back the environment? By definition, it's not something you're doing all the time, right? So you want to make sure you've got that at least periodically with you. So Mr. Hymer, how often do we [INAUDIBLE] the new release of our disaster recovery product? So we always try about a every six month area where we bring out a new release. We're a little behind that right now because we've got a pretty big feature we're bringing in. But yeah, that's probably it-- about every six months or so. So Joe, I mean, is this something that you're seeing customers maybe want to do on a semi-annual basis to have our people help get the organization up to latest, greatest versions? We have customers who take really sort of two approaches to it. One is the annual where they'll try to do one exercise without us, and then bring us back to help with the second exercise in the year. And then we do have some customers who only test once a year. Again, I think that as we see the evolution of security threats and reasons to test recovery, other than sort of a natural disaster, that pace is changing. And so we're shifting from seeing more customers looking at it once a year to customer shifting and looking at it twice a year or more. You-- [INTERPOSING VOICES] --little bit higher right now. Joe, I'm excited to hear that you guys are doing that services. Because bringing a person in that's experienced that, even if it's a different environment, is huge in being able to get a DR test down. So, an Active Directory is a unique animal. It's not like recovering application servers. It's very, very different. So that's really good to hear. Our clients really give us the feedback that, during that exercise, we're able to point out things that have worked or things that haven't gone well at other exercises we've been to-- other firms we've engaged in. Because our guys get to