Identity resilience glossary
Active Directory forest recovery
Active Directory forest recovery is the coordinated process of restoring a functioning AD DS forest after a forest-wide failure. Microsoft's documented approach restores at least one writable domain controller in each domain from trusted backups. It is broader than recovering individual objects and requires decisions about the recovery state, isolation, and the directory infrastructure needed to resume service.
Restoring the existing forest
Traditional forest recovery brings each domain back to a trusted backup state. Changes made after the selected backups may be lost, including newly created objects and later updates. The newest backup is therefore not automatically the right one: teams need evidence that its directory state is safe to use. Recovery planning also needs to account for domain relationships and the functions provided by the affected controllers.
Rebuilding in a new forest is a different approach
Creating a new, clean forest and selectively rebuilding critical identities and workloads is not the same operation as restoring the original forest. Microsoft discusses this separate approach in its guidance on planning for compromise. It requires choices about which users, applications, and data to re-establish, and how to avoid bringing untrusted configuration into the new environment. It should not be described as a full, like-for-like forest restore.
Example: choosing a recovery path
Suppose a hypothetical organization finds damaging changes across its directory. If it can identify trusted backups, its response team may plan recovery of the existing forest. If trust in the old environment cannot be established, it may instead assess rebuilding critical services in a new forest. That is a separate design decision, with different scope, dependencies, and acceptance tests.
Preparation and validation matter
A forest recovery guide is a starting point for an environment-specific plan, not a universal runbook. Teams need access to suitable backups, recovery credentials, and a way to keep untrusted replication away from recovery work. After a compromise, restoring directory operation also does not remove the weaknesses that allowed the incident. Recovery and security remediation need to be planned together.