Page 121 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
Full-server recovery is needed when restoring to different hardware or a different operating-system instance. Bare-metal recovery is a supported backup-and-restore method for that scenario.
Read the checklist
DFSR-replicated SYSVOL can be restored authoritatively with msDFSR-Options or wbadmin -authsysvol. Microsoft describes wbadmin as simpler for same-hardware system-state restore and the attribute method as necessary for bare-metal restore.
Read the explainer
The forest-recovery sequence includes adding the global catalog role to a domain controller. Microsoft documents both the standard add operation and a repadmin-based method.
Read the guide
Raising available RID pools prevents a restored domain from reallocating a RID used after the backup point. The domain-wide RID space is maintained in the RID Manager object’s rIDAvailablePool attribute.
Read the playbook
Microsoft provides a PowerShell procedure that invalidates the current RID pool on one domain controller. Directory-Services-SAM event 16654 in the System log verifies completion on Windows Server 2012; Microsoft notes that earlier Windows versions do not log this event.
Read the briefing
Microsoft documents wbadmin.exe procedures for nonauthoritative AD DS restore. The procedure distinguishes nonauthoritative AD restore from an authoritative SYSVOL restore that can be performed alongside it.
Read the checklist
DoD and GCC High use security.microsoft.us with a workspace sensor endpoint under sensorapi.atp.azure.us, while GCC uses security.microsoft.com with a sensor endpoint under sensorapi.atp.gcc.azure.com.
Read the explainer
The forest-recovery guide calls for resetting trust passwords when recovery follows a security breach. It resets the trusting side first and then uses the same password on the trusted side during that domain’s recovery.
Read the guide
After seizure is confirmed in Ntdsutil, AD DS first attempts to transfer the role and proceeds with seizure only after that transfer fails. After seizure, Ntdsutil lists the roles and LDAP name of each current holder, and an elevated Netdom Query FSMO command provides a second holder check.
Read the playbook
Repadmin /replsum can verify AD DS and SYSVOL replication after controllers are restored or reinstalled. DFSR event 4602, or FRS event 13516 on legacy systems, indicates SYSVOL replication initialization.
Read the briefing