During forest recovery, in the “MAKE DOMAIN CONTROLLER AVAILABLE” stage, the process hangs on “Ensure group policies are applied”. The agent connection is “unexpectedly lost”, and the process hangs or stalls. Refer to the sample below:
The issue is likely related to Firewall rules being enforced on the DCs by group policy, and the Forest Recovery Agent port is not allowed in those policy settings. Even if the Forest Recovery Agent was instructed to configure the Windows Firewall Exceptions when it was installed, hardening the firewall with Group Policy would likely override these settings. So when the Forest Recovery Console reaches the "Apply Group Policy" step, the agent unexpectedly disconnects, and the forest recovery hangs.
WORKAROUND:
Before starting the forest recovery, change the option of 'SkipApplyGroupPolicies' from its default value of "False" to "True". This option is located in the following configuration file default path:
C:\Program Files\Quest\Recovery Manager for Active Directory Forest Edition\FRConsoleSettings.xml, as shown here:
This will prevent the Forest Console from forcing a 'GPUpdate' on the domain controllers, and the recovery should get past this point. However, keep in mind that group policy will eventually get updated, and communication from the Forest Console to the Forest Recovery agent may be blocked.
Note: It is recommended to use a TEST environment first, and if this problem appears, add an 'Allow' rule in your group policy settings so that traffic to the Forest Recovery Agent is permitted. That way, a recovery in the production environment will still apply all the other Group Policy settings, and the final recovery is more secure. You can also configure a specific port for Forest Recovery Agent (and management agent) communications. This is done in the recovery project configuration; however, these are global settings that take effect across any other project you create under the Forest Console:
