Active Directory, and Microsoft Entra ID in the cloud, decide who can sign in to nearly everything in your business. When they are damaged by ransomware, a bad change or a failed migration, people cannot log in, applications stop and servers refuse to talk to each other. Many organizations have a backup of their domain controllers. Fewer have tested a recovery. Here is the difference.
A backup is not a recovery
A backup is a copy. A recovery is the sequence of steps that turns the copy into a working directory again, in the right order, on clean systems, in an amount of time the business can accept. Directory recovery has details that catch teams by surprise: restoring domain controllers in a consistent order, handling a forest with several domains, and making sure the restored directory is not re-infected by the same problem that caused the outage.
Three kinds of failure to plan for
- Whole-forest loss. Ransomware or an attacker with domain administrator rights can encrypt or delete every domain controller. Recovery means rebuilding the forest from a known-good copy.
- Bad change. A script, a Group Policy edit or a bulk update modifies thousands of objects. You need to see what changed and roll back only those changes, without restoring the entire directory.
- Cloud and hybrid drift. Accounts and groups in Entra ID and on-premises Active Directory fall out of step, and access ends up wrong in one place.
What a recovery plan should contain
- Isolated, immutable copies. Backups that an attacker with network access cannot change or delete, kept apart from the domain they protect.
- A written runbook. Who does what, in what order, with contact details that do not depend on email or the directory itself.
- Change auditing. A record of who changed what, so you can find the cause and undo it.
- A clean-room restore path. A place to restore and check the directory before it rejoins the production network.
- A test. Run the recovery at least once a year and measure how long it takes. An untested plan is a guess.
Questions to ask your team this week
- When did we last restore a domain controller, and how long did it take?
- Where are our directory backups, and can an administrator account delete them?
- Can we see every change to privileged groups in the last 30 days?
- If the directory were gone today, who has the runbook, and where is it stored?
A realistic recovery target
Decide, with the business, how long the company can operate without sign-in. Two numbers matter: how much directory change you can afford to lose, and how long recovery may take. A small office may accept a day. A hospital, a plant or a trading desk may accept minutes. The answer determines how often you back up, where the copies live and how much you invest in tools. Write the targets down, then test whether your current setup can meet them. If it cannot, that is the most useful finding the exercise will give you.
Where we can help
We supply and deploy directory recovery, change auditing and privileged access tools from Cayosoft and Netwrix, and we can help you write and test the plan. See our Identity & Data Security page.
Want a second opinion on your own environment? Request a free security check, or talk to an engineer.