Protect Active Directory Domain Services (AD DS) and Microsoft Entra ID with separate recovery plans: they store and restore different identity state. Emergency access and service-continuity measures can keep administrators working during an outage, but they do not reverse destructive changes. AD DS forest recovery restores domain-controller data from trusted backups; Entra Backup and Recovery restores supported cloud objects and properties from its retained history. Neither is a universal rollback for a hybrid identity environment.
Resilience and recovery solve different problems
Resilience is the ability to keep essential work going when identity services or their dependencies are unavailable. It includes continuity planning and independent emergency administrative access. Recovery is the controlled restoration of identity state after corruption, deletion, or another destructive change. A continuity measure may buy time, but it cannot replace a usable backup and a tested restoration procedure.
Plan for AD DS and Entra separately, then map how they depend on one another. AD DS forest recovery and Entra tenant recovery have different backup sources, scopes, and ownership boundaries; restoring one does not restore the other.
What each recovery approach can restore
| Question | AD DS forest recovery | Microsoft Entra Backup and Recovery |
|---|---|---|
| What is restored? | Domain-controller directory state from an available, trusted backup; a forest-wide recovery restores each domain to the point represented by its last trusted backup. (Microsoft Learn, Determine how to recover the forest) | Supported cloud directory objects and properties to a previously known good state. Microsoft lists users, groups, apps, service principals, Conditional Access policies, named locations, authentication method policy, selected authorization policy properties, and Agent ID objects. (Microsoft Learn, Microsoft Entra Backup and Recovery overview) |
| Recovery granularity | Recovery can involve the forest or domains; the initial recovery sequence restores at least one writable domain controller in each domain. (Microsoft Learn, Determine how to recover the forest) | Administrators can compare current and backed-up state and recover supported objects; this is not a forest or tenant-wide point-in-time rollback. (Microsoft Learn, Microsoft Entra Backup and Recovery overview) |
| Backup source and history | An available trusted AD DS backup, made with an Active Directory-aware backup and restore application; Windows Server Backup is one example. The recovery point depends on the backup selected. (Microsoft Learn, Procedures) | Automatic backups are created once a day and retained for up to seven days, according to Microsoft’s current overview accessed in 2026. (Microsoft Learn, Microsoft Entra Backup and Recovery overview) |
| Hybrid ownership | AD DS-managed objects require an on-premises recovery approach. (Microsoft Learn, Microsoft Entra Backup and Recovery overview) | Difference reports can help identify changes to synchronized objects, but do not themselves restore AD DS. Moving source of authority is relevant only for supported object types. (Microsoft Learn, Microsoft Entra Backup and Recovery overview) |
Decide whether AD DS forest recovery is necessary
Whole-forest recovery is a last-resort option, not the default response to every directory problem. Microsoft’s forest recovery guidance for Windows Server 2016, 2019, 2022, and 2025 recommends understanding the cause and scope first, then evaluating alternatives. Its restoration guidance says, “In many cases, total forest recovery should be the last option.” (Microsoft Learn, Steps to restore the forest, last updated 2024-11-01.)
#1 Best Overall
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
A forest recovery returns each domain to the state represented by its last trusted backup. Changes made after that point—including useful account, group, or configuration changes—may be lost. A newer backup may retain more work but could also contain unsafe data if the incident began before that backup. Compare freshness with trustworthiness; use logs to help determine when the failure began. Where feasible, maintain backups of at least two writable domain controllers per domain. (Microsoft Learn, Determine how to recover the forest; Devising an AD Forest Recovery Plan.)
Microsoft describes forest recovery as restoring at least one domain controller in every domain from an available backup. That scope makes it materially different from restoring one object or repairing one domain controller. (Microsoft Learn, Determine how to recover the forest.)
Rank #2
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
Plan and execute AD DS recovery in a controlled order
The high-level sequence below reflects Microsoft’s forest-recovery guidance. It is a planning framework, not a substitute for the current procedure applicable to your topology, Windows Server version, and backup product. Involve business stakeholders and Microsoft Support when diagnosing forest-wide failures.
- Identify and scope the failure. Establish which domains and services are affected, when the problem began, and whether the cause is operational damage or suspected compromise. Review logs and determine which backups remain trustworthy.
- Choose the recovery method. Evaluate whether a narrower repair can resolve the problem before committing to forest recovery. Account for the changes that will be lost at the chosen recovery point.
- Recover one writable domain controller per domain in isolation. Start with a writable domain controller in the forest root. Recover parent domains before child domains so the trust hierarchy and DNS name resolution can be re-established in order.
- Restore AD DS and SYSVOL appropriately. For the first recovered writable domain controller in each domain, Microsoft specifies a nonauthoritative AD DS restore and an authoritative SYSVOL restore. Do not repeat authoritative SYSVOL restoration on additional domain controllers: it can cause replication conflicts.
- Validate before reconnecting. Check that restored data is not damaged while the initial systems remain isolated from production. Reconnect restored domains according to the recovery plan, then verify replication.
- Rebuild the wider environment. Redeploy remaining domain controllers, restore name resolution, and bring dependent business applications back in a planned order.
Microsoft’s procedures specify an Active Directory-aware backup and restore application, with Windows Server Backup as an example. Confirm that your actual backup method supports the required recovery operations before an incident. (Microsoft Learn, Procedures; Perform initial recovery.)
Recommended Free Tools
Rank #3
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
Understand Entra Backup and Recovery’s boundaries
Microsoft Entra Backup and Recovery is a built-in tenant feature for recovering supported objects and properties after accidental changes or security compromises. Its overview describes comparing current state with backup state, recovering supported objects, and reviewing recovery history. The supported-object list is not a promise that every tenant setting or every property can be recovered.
Hard-deleted objects cannot be recovered or recreated through this backup feature. Separately, Microsoft says soft-deleted users and some groups and app-related objects can be restored for 30 days. That soft-delete period is a distinct recovery mechanism, not an extension of backup-history retention. (Microsoft Learn, Microsoft Entra Backup and Recovery overview.)
Rank #4
- Entry-level NAS Home Storage: The UGREEN NAS DH4300 Plus is an entry-level 4-bay NAS that's ideal for home media and vast private storage you can access from anywhere and also supports Docker but not virtual machines. You can record, store, share happy moment with your families and friends, which is intuitive for users moving from cloud storage, or external drives to create your own private cloud, access files from any device.
- Smart Photo Backup & AI Album: Automatically back up photos and videos from your phone in real time and keep growing family memories organized with AI-powered photo albums. Semantic search, custom learning, and recognition of people, objects, pets, and similar photos help you quickly find the moments you want. Duplicate photo removal also helps keep your library organized—ideal for families and users with large photo collections.
- User-Friendly App & Easy Setup: Connect quickly via NFC, set up simply and share files fast on Windows, macOS, Android, iOS, web browsers, and smart TVs. You can access data remotely from any of your mixed devices. What's more, UGREEN NAS enclosure comes with beginner-friendly user manual and video instructions to ensure you can easily take full advantage of its features.
- More Cost-effective Storage Solution: Unlike cloud storage with recurring monthly fees, A UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $629.99 for a NAS, while for cloud storage, you need to pay $719.88 per year, $1,439.76 for 2 years, $2,159.64 for 3 years, $7,198.80 for 10 years. You will save $6,568.81 over 10 years with UGREEN NAS! *NAS cost based on DH4300 Plus + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Your Data, You Control：No third-party clouds, no hidden access, UGREEN NAS provides a more secure and private data storage solution. It stores data locally on your private hard drives and does automatic backups. Thus, you can keep full control over it. The advanced encryption is TRUSTe certified in the United States and is awarded the first (and only) ETSI EN 303 645 certification mark for NAS products by TÜV SÜD Group.
Tenant recovery also depends on operational preparation: Microsoft’s tenant recoverability guidance calls for advance planning, tested procedures, governance, and independent emergency administrative paths. Recovery capability does not eliminate the need to plan for service outages and dependency failures. (Microsoft Learn, Plan for tenant recoverability.)
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.For hybrid identity, recover from the right authority
First establish where the affected object’s source of authority resides. If an object is synchronized from AD DS, Entra difference reports may help show that its state changed, but the cloud backup feature is not a substitute for recovering the AD DS-managed object in its source directory. Plan an on-premises backup and recovery method for those objects. Microsoft’s overview notes that source of authority can be moved for supported object types; this does not make every synchronized object cloud-recoverable.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Best Value
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
Conversely, an AD DS backup cannot restore cloud tenant configuration such as Entra-managed Conditional Access policies. Inventory which identities and policies are managed in each environment, and make the relevant recovery procedure explicit for each.
Treat suspected compromise differently from accidental damage
A mistaken deletion or infrastructure failure is not the same scenario as an intrusion involving stolen credentials, privileged access, domain controllers, or backups. Microsoft’s general forest recovery guide explicitly does not cover security recommendations for recovering a hacked or compromised forest. A routine restore should not be treated as proof that an attacker has been removed.
Examples in Microsoft’s incident guidance include rogue administrator compromise, malicious or accidental scripts that spread corruption, malicious schema changes, malware on domain controllers, and replication failure. For a suspected intrusion, involve incident-response and identity-security specialists, determine which systems and backups can still be trusted, and use a compromise-specific recovery plan. (Microsoft Learn, Identify the problem, last updated 2024-11-01.)
Make recovery executable before an incident
- Document the forest topology, domain hierarchy, dependencies, backup locations, and responsible decision-makers.
- Record how to isolate recovery systems, validate restored data, and reconnect domains safely.
- For Entra, document supported recovery operations, emergency administrative access, governance decisions, and the steps for reviewing recovery history.
- In hybrid environments, map object ownership and source of authority so teams know whether to use AD DS or Entra recovery.
- Practice the custom AD DS forest recovery plan at least once a year, as Microsoft recommends in its 2025 planning guidance. A written plan alone does not demonstrate that backups and staff can perform the procedure.
Use the Microsoft Learn procedures that match the deployed Windows Server and Entra capabilities when carrying out a real recovery; the right sequence and available operations are version- and environment-dependent.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
