Recovery Manager for AD Forest Edition 10.3.2 - User Guide

Advanced Actions tab

You can use this tab to make choices for scanning of malware or server maintenance during recovery. RMAD does not scan and remediate with this feature. The feature pauses the recovery during Directory Services Restore mode (DSRM) before the domain controller is restarted into normal mode allowing users to perform maintenance and run their own scans using third party tools and/or remediate if malware found. The choices are:

• Scan the selected backup with Microsoft Defender Antivirus during the project verification.

• Pause recovery in DSRM to perform additional actions before booting to normal mode.

During the pause you have an option to run a script and quarantine files.

Pause recovery in DSRM to perform additional actions before booting to normal mode can be enabled for specific domain controllers by selecting the option from the Advanced Action tab from each domain controller in the project, or for all domain controllers in the entire domain/forest.

To select all of the domain controllers in a domain or forest to be paused during recovery in DSRM mode, select Configure by domain and select a domain or multiple domains within the forest. To configure Run Script, Quarantine Files, Do Not Recover select any or all of the three and click on the Configure button.

Run Script

In addition to pausing, you can run a Powershell script on the domain controller after restoring Active Directory data from a backup.

On the top of the dialog, note the title Configure Advance Actions for: which states the name of the domain you have selected and where the script will be applied.

There is a check box that can be selected to apply this script to all domains.

The script, for example, could be used to inspect SYSVOL, looking for any file extension that is executable (.exe, .dll, .bat, .cmd, .ps1, etc.), and then renaming by adding an extension that is not executable. The script can be used to perform any tasks on the domain controller after it is recovered from the backup.

A sample script can be found in C:\Program Files\Quest\Recovery Manager for Active Directory Forest Edition\DefaultAdvancedActions.ps1

The script executes right after the backup has been restored in DSRM mode and just before the reboot into normal mode. Essentially at the same time when recovery can be paused with the checkbox on DC properties.

The DSRM pause is after the scripts run and pauses the reboot to the normal mode step.

As with any other Forest Recovery agent operation, the script runs under the SYSTEM security context. Since the Domain Controller is in DSRM mode, you cannot use a script to configure anything that relies on Active Directory.

Quarantine Files

You can also quarantine files on the domain controller after restoring Active Directory data from a backup.

On the top of the dialog, note the title Configure Advance Actions for: which states the name of the domain you have selected and where the quarantine will be applied.

There is a check box that can be selected to apply this quarantine to all domains.

The list of file extensions is loaded from the file:

C:\Program Files\Quest\Recovery Manager for Active Directory Forest Edition\DefaultQuarantineFilters.txt

Click on the Show Files button to see a list of malicious files that will be automatically included in the quarantine rules (for both Quarantine Files and Do Not Recover tabs).

Malicious files are shown for each backup selected for a domain controller, and the list can be grouped and/or sorted by SYSVOL File Path and Domain Controller. A list of the files is also included in the Forest Recovery Report, click View | Report….

SYSVOL_Quarantined is created with the file detected as malicious by the antivirus.

In PowerShell, quarantine rules can be configured as follows:

$quarantineRule = (Get-RMADFEDomain -Domain "rmad.local").QuarantineSysvolFiles
$quarantineRule.IsEnabled = $true
$quarantineRule.MaliciousFiles = $false
$quarantineRule.SpecifiedFiles = $true
$quarantineRule.Filters = @("*.exe")
$quarantineRule.Exclusions = @("*\scripts\config\setup\*")
$quarantineRule.RenameFiles = $true
$quarantineRule.RenameSuffix = "_INFECTED"
$quarantineRule.MoveFiles = $false
Set-RMADFEDomain -Domain "rmad.local" -QuarantineSysvolFiles $quarantineRule

Do Not Recover

You can specify specific files from being restored from a backup.

On the top of the dialog, note the title Configure Advance Actions for: which states the name of the domain you have selected and where the Do Not Recover will be applied.

There is a check box that can be selected to apply this Do Not Recover to all domains.

When a domain is selected the Pause recovery in DSRM to perform additional actions before booting to normal mode is no longer available on each domain controller for the selected domain, and The option is managed by domain settings is displayed.

To Resume recovery when paused, select all or individual domain controllers in the recovery project. There are two choices which can be made:

• ​ Resume All DCs which allows the resume function of all Domain Controllers in the recovery.
• Resume Selected DCs which will only allow the resume for the selected Domain Controllers.

Otherwise the Resume button will be unavailable.

Progress tab

You can use this tab to view progress of the recovery stages and steps applicable to the domain controller selected in the list. To view more information about a recovery step on this tab, point to that step, and then point to the question mark displayed next to it.

You can copy the information displayed on the Progress tab to the Clipboard and then paste it to another application (for example, a Microsoft Office Word file). To do so, point to the Progress tab, and then click the Copy button in the upper right corner of the tab. This copies all the information displayed on the Progress tab, including the current status of each recovery stage and step and any error messages displayed on the tab.

Script Results

When a script is run, the results are displayed in the Progress Tab under the Run Advanced Actions process, for any errors encountered.

Integrity Check

When a backup is created, a checksum is calculated for the backup file and saved in the backup file. An integrity check is performed on the backup during the progress and any issues are displayed as seen below.

If the integrity check is passed, no warnings or errors are displayed (just a green check mark):

If the backup is corrupted or the integrity check fails, an error message is displayed and the verification process is interrupted:

If the backup does not have a checksum, a warning message is displayed:

NOTE: Integrity checks are recorded as a Windows Eventlog event on the recorded on the target machine (domain controller) because they are performed by Forest Recovery Agent. The events can be found in Applications and Services Log | Recovery Manager for Active Directory.

Events tab

You can use this tab to view recovery events related to the entire Active Directory® forest, specific domain controllers, or both these categories of recovery events.

On this tab, you can use the following elements:

• Show - Select a category of recovery events to view:

  • Forest-wide events. Shows recovery events related to the entire Active Directory® forest.

  • Events for selected DCs. Shows recovery events related to the domain controllers selected in the list.

  • All events. Shows forest-wide events and events related to the domain controllers selected in the list.

• Copy - Copies events in the list to Clipboard.

• Save - Allows you to export events in the list to one of the following formats:

  • Text (Tab delimited) (*.txt)

  • CSV (Comma delimited) (*.csv)

Configuring advanced settings

You can change a number of advanced settings of the Forest Recovery Console. To do so, you need to modify the FRConsoleSettings.xml file that stores these advanced settings. You can find this file in the Recovery Manager for Active Directory (RMAD) installation folder (by default, this is %ProgramFiles%\Quest\Recovery Manager for Active Directory Forest Edition).

The changes you make in the FRConsoleSettings.xml file become effective right after you save the file. You do not need to restart the Forest Recovery Console.

The FRConsoleSettings.xml file includes the following XML elements you can modify:

CheckBackupIntegrity

Provides the ability to disable integrity checking used with several or very large backups, as integrity check may take a long time to complete.

• True - Enables the Integrity Check feature (default).

• False - Disables the Integrity Check feature.

CustomDriversPath

Specifies the port used by Quest Recovery Environment http service (for bare metal recovery only).

DaysBetweenProjectUpdates

Sets the maximum number of days (default is 30) between the updates of a recovery project. When the specified value is exceeded for a project, the Forest Recovery Console displays a warning.

DiagnosticsDataPath

Specifies the default location on the Forest Recovery Console computer for storing diagnostic data gathered with the Diagnostic Data Collector.

EnablePersistence

Enables or disables the Recovery Persistence feature. This element can take one of the following values:

• True - Enables the Recovery Persistence feature (default).

• False - Disables the Recovery Persistence feature.

EnableSecureBootForVMs

Allows the creation of a virtual machine during BMR recovery with secure boot disabled.

• True - VMs are created with SecureBoot option ON (for EFI firmware).

• False - VMs are created with SecureBoot option Off (for EFI firmware) (default).

ISOPath

Specifies the default location for storing custom drivers (for bare metal recovery only).

MaxAutomaticDnsCount

Limits the number of automatically selected DNS servers for domain controller DNS client settings. Default is 3.

MaximumBackupAgeInDays

Specifies the maximum age (in days, default is 60) of the backups to be displayed on the GUI. Backups whose age exceeds the specified value will not be displayed.

PasswordsLength

Sets the length (in characters) for the passwords automatically generated by RMAD.

PasswordsSymbols

Allows you to specify what symbols you want to use in the passwords automatically generated by RMAD.

This element can take the following values:

• Latin - Specifies to use English letters.

• Number - Specifies to use Arabic numerals.

• Upper - Specifies to use uppercase English letters.

• Lower - Specifies to use lowercase English letters.

• All - Specifies to use all of the above-listed characters (default).

You can specify multiple values in this element. When specifying multiple values, use a pipe (|) as a separator.

Example:

Latin | Number | Upper | Lower

RecoveryMediaHttpServicePort

Specifies the port used by the web server handling Recovery Media Images. Images are consumed by HPE® iLO management software to perform automatic server boots. By default, the port is set to 8080.

RidPoolIncreaseValue

Specifies the value by which to raise the number of available RID pools. Default is 100000

If necessary, you can revert to the default values in the FRConsoleSettings.xml file.

SelectDnsTimeout

Sets a timeout for the DNS server search operation performed during a forest or domain recovery. Use the format hh:mm:ss (default is 00:15:00).

SkipUnmodifiedFilesDuringRecovery

Enables or disables skipping the files that are identical on the domain controller and in the backup during restore operations. This element can take one of the following values:

• True - Enables skipping the files (default).

• False - Disables skipping the files.

TargetGcOccupancyLevel

Sets the global catalog partition occupancy level value to be used when advertising a rebuilt GC fast.

This element can take one of the following values:

• 0 - No occupancy requirement.

• 1 - At least one read-only partition in site added by Knowledge Consistency Checker.

• 2 - At least one partition in site fully synchronized (default).

• 3 - All read-only partitions in site added by Knowledge Consistency Checker, at least one synchronized.

• 4 - All partitions in site fully synchronized.

• 5 - All read-only partitions in forest added by the Knowledge Consistency Checker, at least one synchronized.

• 6 - All partitions in forest fully synchronized.

UseRemoveLingeringObjects

If this parameter is set to False, the Adjust to Active Directory changes operation will not call the "Remove lingering objects" command of the Repadmin tool. Default is True.

UseUnhostRehost

If this parameter is set to False, the Adjust to Active Directory changes operation will not call the "Unhost/Rehost" commands of the Repadmin tool. Default is True.

To revert to the default values

1. Delete the FRConsoleSettings.xml file.

2. Restart the Forest Recovery Console on the computer on which you deleted the file in step 1.

   Recovery Manager for Active Directory recreates the FRConsoleSettings.xml file and assigns default values to the elements in the file.