Accelerate AD Forest Recovery After a Cyberattack

BMR, although historically a convenient way to recover an entire server, has several downfalls in an AD attack incident.

The first is potential reintroduction of malware. BMR backs up and restores everything on the domain controller (DC), including the OS, registry, and system files. In the case of a cyberattack, the backup might contain rootkits, ransomware, or other malware installed by threat actors. When you restore the backup, those malicious DLLs and executables will be restored along with the backup.

Second is data loss. Determining the time window for a malware-free backup can be difficult if—as with many recent cyberattacks—malware remains latent for weeks or months before discovery. The further in the past you must go to find a clean backup, the more data is lost.

The third downside of BMR recovery is prolonged outages. BMR extends recovery time in several ways:

• Hardware setup: BMR is designed for recovery to matching hardware, so you are dependent on another infrastructure that might not be working because of the attack.
• Backup retrieval: Because BMR backups contain the entire system, they are large. Bigger backups consume more storage and network bandwidth and take longer to retrieve, especially when stored in the cloud.
• Rebuilding AD: Restoring AD from an older BMR backup requires recreating directory changes, reconfiguring applications, rejoining workstations—all of which requires time that delays recovery.
• Backup selection: Finding a clean BMR backup is an iterative process (retrieve, mount, extract, test, repeat) that takes time, further delaying recovery.

To ensure AD recovery in a cyberattack scenario, you need the ability to:

• Recover multiple AD forests
• Recover AD faster than you could do it manually by automating the process—ideally in minutes or hours
• Recover AD without reintroducing malware
• Recover AD even if your DCs are infected or wiped out
• Quickly provision new physical or virtual hardware for the recovery
• Easily set up and test your AD forest recovery plan
• Easily conduct post-breach forensics to ensure that malware is eradicated (you’re restoring AD to a clean environment)

No: DC snapshots are no substitute for a purpose-built AD backup and recovery solution for cyber disasters, for a few reasons. First, a forest recovered from snapshots will have data consistency problems. Second, if malware was on the DCs at snapshot time, you’ll simply be restoring the malware. Third, you must rebuild whatever servers you don’t restore from the snapshots, which will be a manual, time-consuming, and error-prone process. For more details on this, check out “Why DC Snapshots Are No Substitute for Active Directory Backups.” Fourth, Microsoft does not recommend DC snapshots for disaster recovery. 

Offline AD backups are an essential part of any comprehensive data protection strategy. By saving backups on a non-domain joined server, companies can ensure a safe place to start for AD recovery. To further enhance security, it’s recommended to protect backups from being overwritten by using a tested, secure offline storage methodology. Alternatively, third-party tools can be used to copy backup images to Azure or AWS blob storage for added redundancy. For more information, see “The Dos and Don’ts of AD Recovery.”