Plan an Active Directory Forest Recovery Exercise

A forest recovery exercise tests whether an organization can restore Active Directory Domain Services (AD DS) after a forest-wide failure. It is materially different from restoring a file or testing a member server backup: a recovery can roll directory data back to the backup point and affect every domain controller that later replicates from it.

Keep the restored forest isolated

This guide prepares an isolated rehearsal; it is not a substitute for Microsoft’s forest recovery runbook or your tested incident procedure. Never connect a restored test domain controller to the production network. Use a dedicated isolated virtual network, controlled credentials, approved backup copies, and a recovery team that understands the production forest.

---

01

Record Domains, DCs, and Operations Masters

Prepare

Document the forest and domain structure, DC operating systems and roles, DNS and Global Catalog placement, writable DCs, backup source, and dependencies. Keep the inventory current and stored outside the forest so it remains available during an AD outage.

Get-ADForest | Select-Object RootDomain, Domains, ForestMode
Get-ADDomain -Identity corp.example.com | Select-Object DNSRoot, DomainMode
Get-ADDomainController -Filter * |
  Select-Object HostName, Site, IsReadOnly, IsGlobalCatalog, OperatingSystem
netdom query fsmo

❯ Illustrative Output (Results Vary)

Schema master               DC-ROOT-01.corp.example.com
Domain naming master        DC-ROOT-01.corp.example.com
PDC                         DC-ROOT-02.corp.example.com
RID pool manager            DC-ROOT-02.corp.example.com
Infrastructure master       DC-ROOT-02.corp.example.com

---

02

Verify the Recovery Inputs Exist

Recovery Readiness

For each domain, identify a recent, trusted system state or full server backup of a writable DC and confirm that the backup can be read. Record where the recovery media and instructions are stored. Verify that the team can retrieve the Directory Services Restore Mode (DSRM) credentials and required domain administrator credentials through the approved vault process; never paste them into notes or this inventory.

Domain: corp.example.com
Recovery DC: DC-ROOT-01
Backup date and time (UTC): 2026-10-05 02:00
Backup target and catalog verified: Yes
DSRM credential retrieval tested: Yes (vault procedure ID: DR-AD-01)
Isolated recovery network reserved: DR-LAB-AD

❯ Illustrative Output (Results Vary)

Go/no-go: Do not start the restore rehearsal until backup readability,
credential access, and isolation have each been verified.

---

03

Prove the Test Environment Is Isolated

Safety Gate

Before powering on a restored DC, remove its production network adapter or attach it only to a lab network with no route, bridge, VPN, or shared virtual switch to production. Confirm isolation from both the hypervisor and network-control plane. Use lab-only DNS and test clients, and prevent lab systems from authenticating against or synchronizing with production. Define who can approve network changes and how the lab will be destroyed. If isolation cannot be proven, stop.

Production adapter disconnected: Yes
Lab network has no route to production: Yes
VPN/bridge/shared virtual switch checked: Yes
Lab DNS and test clients prepared: Yes
Isolation verified by: [operator] and [network owner]

❯ Illustrative Output (Results Vary)

Go/no-go: Proceed only when every isolation check is verified.

---

04

Follow the Tested Forest Recovery Runbook

Isolated Rehearsal

Restore the selected writable DC in the lab by following the supported Microsoft forest recovery sequence for your Windows Server versions and backup product. A forest recovery normally requires at least one writable DC restored for every domain, and the forest root domain is recovered first. The official procedure determines when to restore AD DS and SYSVOL, seize operations-master roles, reset credentials, and rebuild other DCs. Do not improvise those steps from a generic checklist.

Record for every runbook checkpoint:
- step and operator
- start/end time (UTC)
- result and relevant event IDs
- blocker, decision, and approving owner
- backup used and lab DC identity

❯ Illustrative Output (Results Vary)

Example checkpoint: Restored first writable forest-root DC in isolation
Result: Passed; lab DNS and Directory Service checks completed

---

05

Validate the Forest and Close the Exercise

Verify and Close

Verify the restored DC’s AD DS and DNS health, expected SYSVOL and NETLOGON shares, required logons from lab-only clients, and replication with other restored lab DCs. Record elapsed recovery time and compare it with the recovery objective. A backup catalog check alone is not a successful restore test. Before teardown, confirm again that no lab network path reaches production, then remove test VMs and temporary backup copies according to policy.

AD DS and DNS checks: Passed / Failed
SYSVOL and NETLOGON shares: Passed / Failed
Lab-only authentication and replication: Passed / Failed
Elapsed recovery time: [duration] (objective: [duration])
Lab teardown and backup-copy handling: Complete / Pending
Runbook updates assigned to: [owner]

❯ Illustrative Output (Results Vary)

Exercise result: [Passed / Failed / Partial]
Open recovery gaps: [tracked items]
Production network remained isolated: Confirmed

Microsoft recovery references

Microsoft’s forest recovery guide and initial recovery procedure define the supported restore sequence and isolation considerations.