Active Directory backup and recovery: Recycle Bin, system state, and DSRM

Recovery is a security control

Ransomware groups target domain controllers because encrypting them stops everything. Recovery depends on clean backups that attackers could not reach, a tested procedure, and credentials such as the DSRM password stored outside AD. Without those, even a well-defended domain can be lost.

There are three levels of recovery: restoring a deleted object, restoring a DC, and recovering an entire forest from backup.

Recycle Bin for object recovery

The AD Recycle Bin, available at the Windows Server 2008 R2 forest functional level and later, keeps deleted objects with all attributes for the deleted object lifetime (180 days by default). Enabling it is irreversible and has no real downside.

Restore-ADObject brings back a user with group memberships intact, which a backup restore of one object would make much harder.

Snippet

Enable-ADOptionalFeature 'Recycle Bin Feature' -Scope ForestOrConfigurationSet -Target lab.internal
Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*user5*"' -IncludeDeletedObjects | Restore-ADObject

Lab: system state backup and DSRM

Install Windows Server Backup on the lab DC and take a system state backup to a separate volume. Set and record the DSRM password with ntdsutil. Then delete a test user, restore it from the Recycle Bin, and confirm group membership survived.

For a fuller exercise, restore the DC from the system state backup into an isolated network, booting into Directory Services Restore Mode with the DSRM password.

Snippet

Install-WindowsFeature Windows-Server-Backup
wbadmin start systemstatebackup -backupTarget:E: -quiet
wbadmin get versions
ntdsutil "set dsrm password" "reset password on server null" q q

Forest recovery planning

Keep at least two recent, offline or immutable backups of a DC per domain. Keep the forest recovery procedure written down outside the domain, with the DSRM passwords in a vault that does not depend on AD. Practice the restore in an isolated lab at least yearly.

Microsoft’s AD Forest Recovery guide describes the full process. The first time you read it should not be during an incident.

Diagram

Three levels of AD recovery

Match the tool to the problem.

Deleted object
Restore-ADObject from the Recycle Bin.
Failed DC
Rebuild and re-promote, or restore system state.
Compromised or encrypted forest
Forest recovery from clean, isolated backups using DSRM.

Check yourself

1. Which feature restores a deleted user with group memberships intact?

2. Why store the DSRM password outside AD?

3. What makes a DC backup useful after ransomware?