Active Directory disaster recovery: the domain controller is dead – now what?

A failed domain controller is unpleasant. Losing Active Directory without a tested recovery path is a disaster. This guide covers System State, the AD database, SYSVOL, DNS, FSMO roles and forest recovery.

The key principle

A domain controller is not just another file server. Active Directory is distributed. With multiple healthy DCs, a single hardware failure may be manageable; loss of the entire forest is a different scenario.

System State matters

Active Directory is part of System State backup. Microsoft documents AD backup through VSS, where the AD writer provides the required component information.

A second DC is not a backup

Replication provides availability, not historical protection. If an object is deleted or maliciously modified, the bad change can replicate. Real backups are still required.

Do not forget DNS

Active Directory depends heavily on DNS. Recovery without a functional DNS structure creates difficult secondary failures.

Understand FSMO roles

Schema Master, Domain Naming Master, RID Master, PDC Emulator and Infrastructure Master should be documented.

Check replication

Before maintenance, use `repadmin /replsummary`, `repadmin /showrepl` and `dcdiag`. A backup of an already unhealthy directory is not a good recovery point.

repadmin /replsummary
repadmin /showrepl
dcdiag

Non-authoritative restore

When a DC is lost but healthy domain controllers still contain current directory data, the recovered DC is normally brought back into replication.

Authoritative restore

When selected directory data must deliberately become authoritative, a different recovery process is required. This is a special case that should be planned.

Forest recovery

Losing multiple or all domain controllers changes the recovery scenario completely. Microsoft treats forest recovery as a dedicated disaster procedure.

Restore testing

A backup is only valuable if restoration works. Isolated Hyper-V networks and test environments are useful for practicing recovery.

What should be documented

Forest and domain names, FSMO roles, DNS zones, networks, sites, administrator accounts, backup locations, recovery media and the exact restore procedure.

Conclusion

AD backup is less about finding a perfect product and more about proving recoverability. System State backups, replication monitoring and regular restore tests are the foundation.