This solution outlines the services required for the forest recovery process.
The below services may be required during the forest recovery process:
Remote Procedure Call (RPC)
RPC Endpoint Mapper
Windows Management Instrumentation
IPSec Policy Agent
Windows Event Log
Active Directory Domain Services
DFS Replication (or File Replication depending on how Sysvol is configured)
Netlogon
Windows Firewall
Windows Installer (shouldn't be started, but must not be disabled)
Workstation
Server
DNS Client
DNS Server (if available)
The Group Policy Client service is disabled during the forest recovery process and enabled at the end of the process.
